Re[2]: [SAtalk] meaning of rule descriptions

Hello Jay, Tuesday, July 1, 2003, 7:52:42 PM, you wrote: >> qualify for. See http://www.geocities.com/kl3434us/ North >> American Association of Unaccredited Colleges and >> Univerisities (sic) [No, that's not a joke site - it's real] JL> Actually, yes, it is a joke site. Not only are the ind

[SAtalk] Houghton Internationals' Anti-virus Service, Antigen, found FILEFILTER= *.pif file

Title: Houghton Internationals' Anti-virus Service, Antigen, found FILE FILTER= *.pif file Houghton Internationals' Anti-virus Service (Antigen for Exchange) found your_details.zip ->details.pif matching FILE FILTER= *.pif file filter. The file is currently Removed.  The message, "[SAtalk] Re:

[SAtalk] Why did this spam go through?

This spam had a 0 score, SA 2.54... wondering how it got through - it is full of lots of words about weight loss and all caps words like GUARANTEED, FREE - no HTML though, just plain text: Return-Path: <[EMAIL PROTECTED]> Received: from b6.e-i1.com (b6.e-i1.com [63.251.54.86]) by [domain]

Re: [SAtalk] How to call SA in Sendmail?

On 7/2/03 4:15 AM, "Mark Emerle" <[EMAIL PROTECTED]> wrote: (B (B> Hi- (B> (B> I have a related question. Is there a way to have mimedefang to call (B> spamc instead of spamassassin? I have yet to find documentation stating (B> that. (B (BIf i'm not mistaken, Dirk Muller on the MIMEDefang

[SAtalk] Blocked File Attachment

An Internet e-mail message was sent to you from an outside source that contained an prohibited file type, but was removed for security purposes. The message header is attached below. If you must use e-mail to receive business-related .exe files, there is a workaround. Please inform the sender of

Re: [SAtalk] meaning of rule descriptions

At 02:45 AM 7/2/03 +0200, Klaus Heinz wrote: Hi, There's been several comments on these, but I wanted to give some concrete examples from real spam in my mailbox. Yes, all three of these are very common spam messages. # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' ba

Re: [SAtalk] meaning of rule descriptions

> qualify for. See http://www.geocities.com/kl3434us/ North > American Association of Unaccredited Colleges and > Univerisities (sic) [No, that's not a joke site - it's real] Actually, yes, it is a joke site. Not only are the individual college sites obviously jokes if you click on them, but take

[SAtalk] ScanMail Message: To Recipient virus found and action taken.

Title: ScanMail Message: To Recipient virus found and action taken. ScanMail for Microsoft Exchange has detected virus-infected attachment(s). Sender = [EMAIL PROTECTED] Recipient(s) = [EMAIL PROTECTED] Subject = Spamassassin-talk digest, Vol 1 #1338 - 2 msgs Scanning Time = 07/01/2003 20:41

[SAtalk] Report to Recipient(s)

Incident Information:- Originator: [EMAIL PROTECTED] Recipients: [EMAIL PROTECTED] Subject:Spamassassin-talk digest, Vol 1 #1338 - 2 msgs WARNING: The file your_details.zip (details.pif) you received was infected with the W32/[EMAIL PROTECTED] virus. The file attachment was not successfully

[SAtalk] Report to Recipient(s)

Incident Information:- Originator: [EMAIL PROTECTED] Recipients: [EMAIL PROTECTED] Subject:Spamassassin-talk digest, Vol 1 #1338 - 2 msgs WARNING: The file your_details.zip (details.pif) you received was infected with the W32/[EMAIL PROTECTED] virus. The file attachment was not successfully

Re: [SAtalk] How could I know that Spamassassin is working in my system?

Chan Choth wrote: > Hi, > > I would like to use it site-wide, into Sendmail server running in > SuSE8.X. I do not know which one is the best with or without spamd. > What would you recommend? > > Regards, > Chan Choth Chan, FWIW, here is what I did on my Linux RedHat 7.2 system: Download, co

Re: [SAtalk] meaning of rule descriptions

Hello Klaus, I think what you have is culture clash - you are encountering some things that are very common in the US, but perhaps not so well known in Germany: KH> # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' KH> "Prestigious" and "non-accredited" don't seem to fi

[SAtalk] RBL tests timing out

Here's a problem that got us stumped: We're testing SA 2.55 on a FreeBSD 4.8 system. Things seem to be generally working except for the fact that all of the RBL tests time out. It doesn't seem to be a DNS problem with the system in general, because other non-SA DNS queries work fine, and even SA

RE: [SAtalk] Troubleshooting IMAPAssassin, Mail::SpamAssassin, Check Msg always returns 0 point score

jm writes: >"SpamAssassin" writes: >>I am trying to evaluate SpamAssassin 2.55 on a per user install >> through IMAPAssassin. (perl 5.008) >> >>When the message is passed to Mail::SpamAssassin, >> the score always comes back as 0 point, >> If the message is written to a file, >> then passed to sp

[SAtalk] Metrics / Statistics question

Hi All, I am running spam assassin 2.53 (spamd). I'd like to get metrics on what it's doing. I'm mainly interested in numbres like "percentage of messages examined that are spam", etc... I scanned the list archives and came across a few links, but no good directions. Could someone please poin

Re: [SAtalk] How could I know that Spamassassin is working in my system?

Hi, I would like to use it site-wide, into Sendmail server running in SuSE8.X. I do not know which one is the best with or without spamd. What would you recommend? Regards, Chan Choth Ralf Guenthner wrote: > Hi > > - Original Message - > From: "Puth Chan Choth" <[EMAIL PROTECTED]> > To:

Re: [SAtalk] meaning of rule descriptions

Klaus Heinz writes: >it would be nice if someone could explain some of the rule descriptions: > > # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' > >"Prestigious" and "non-accredited" don't seem to fit together for >describing a university. Someone suggested to me spamme

RE: [SAtalk] Bug 1927 - spamd looping - v2.54

[EMAIL PROTECTED] <> wrote: > Subject: RE: [SAtalk] Bug 1927 - spamd looping - v2.54 > > >> -Original Message- >> From: Dallas L. Engelken >> Sent: Tuesday, July 01, 2003 10:15 AM >> To: [EMAIL PROTECTED] >> Subject: [SAtalk] Bug 1927 - spamd looping - v2.54 >> >> >> if i >> take this m

[SAtalk] meaning of rule descriptions

Hi, it would be nice if someone could explain some of the rule descriptions: # describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' "Prestigious" and "non-accredited" don't seem to fit together for describing a university. Someone suggested to me spammers using this phrase t

Re: [SAtalk] Bug in whitelist_from?

At 02:41 PM 7/1/03 +0100, Adam T. Bowen wrote: in the man pages it says that whitelist_from only checks: Resent-From if available, otherwise Envelope-Sender Resent-Sender X-Envelope-From From Have things changed? From the 2.53 source code: if (defined

Re: [SAtalk] Troubleshooting IMAPAssassin, Mail::SpamAssassin, Check Msg always returns 0 point score

"SpamAssassin" writes: >I am trying to evaluate SpamAssassin 2.55 on a per user install > through IMAPAssassin. (perl 5.008) > >When the message is passed to Mail::SpamAssassin, > the score always comes back as 0 point, > If the message is written to a file, > then passed to spamassassin -t < in

Re: [SAtalk] Milters, Solaris & Sendmail

Out-of-the-box, no. In any case, you probably wouldn't want to try running milters on Sendmail 8.11.x, as they tend to be somewhat less than stable. Patrick Murphy wrote: I am running Solaris 8 with Sun's sendmail 8.11.6 and am in the process of choosing a milter to use. Does anyone know if Su

[SAtalk] Troubleshooting IMAPAssassin, Mail::SpamAssassin, Check Msg always returns 0 point score

I am trying to evaluate SpamAssassin 2.55 on a per user install through IMAPAssassin. (perl 5.008) When the message is passed to Mail::SpamAssassin, the score always comes back as 0 point, If the message is written to a file, then passed to spamassassin -t < input > output, the score point

[SAtalk] Milters, Solaris & Sendmail

I am running Solaris 8 with Sun's sendmail 8.11.6 and am in the process of choosing a milter to use. Does anyone know if Sun's sendmail can support a milter ( libmilter )? If it does is there a resource or instructions as to how this can be done ? Any help would be apprecieted. Patrick ---

Re: [SAtalk] Re: "Naughty" test names

On Tuesday 01 July 2003 10:54 am, Chris Barnes wrote: > Rick Beebe <[EMAIL PROTECTED]> wrote: > > I'd like to appeal to the SA collective to change the name of the > > PENIS_ENLARGE tests to something a little more innocuous. Apparently > > some people find it offensive to see it in their email. I'

[SAtalk] Couple of interesting links

Title: Message http://www.newscientist.com/news/news.jsp?id=ns3891   and   http://news.bbc.co.uk/1/hi/technology/3036092.stm

RE: [SAtalk] dcc and rbl checks not working....

See the FAQ on roaringpenguin.com... it covers this specifically. Steve -Original Message- From: VonEssen, John [mailto:[EMAIL PROTECTED] Sent: Tue 7/1/2003 3:33 PM To: [EMAIL PROTECTED] Cc: Subject: [SAtalk] dcc and rbl checks not wor

Re: [SAtalk] How to call SA in Sendmail?

Everywhere your milter calls spamassassin, replace it with spamc. I dunno about mimedefang's config files, but there has to be somewhere where it calls spamassassin. -- Thomas Cameron, RHCE, CNE, MCSE, MCT Cameron Technical Services, Inc. (512) 454-3200 Main http://www.camerontech.com - Origi

Re: [SAtalk] How to call SA in Sendmail?

Oops, I stand corrected, and will now shut up. -- Thomas Cameron, RHCE, CNE, MCSE, MCT Cameron Technical Services, Inc. (512) 454-3200 Main http://www.camerontech.com - Original Message - From: "Patrick Morris" <[EMAIL PROTECTED]> To: "Mark Emerle" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTE

Re: [SAtalk] dcc and rbl checks not working....

On Tue, Jul 01, 2003 at 04:33:32PM -0400, VonEssen, John wrote: > tests to work. One thing to note, I am using MIMEDefang, so the > spamassassin -D -r is not applicable. well, you don't want to use -r, but it's completely applicable. if it works as 'spamassassin -D', but not mimedefang, then your

Re: [SAtalk] Re: "Naughty" test names

At Tue Jul 1 18:54:00 2003, Chris Barnes wrote: > Q: how are they seeing this to begin with - it's in the header, not the > body. Are they using some oddball email program that is showing them > the headers? SpamAssassin's default for spam is to put the report in the body of the message, and co

[SAtalk] dcc and rbl checks not working....

Even though everything is installed, I have never seen a piece of Spam that has an rbl or dcc check in its list of performed tests. cdcc and dccproc are installed, and cdcc 'info' returns valid info. Net::DNS is installed. The only thing that might be an issue is my firewall, but I have open TCP/

[SAtalk] Re: "Naughty" test names

Rick Beebe <[EMAIL PROTECTED]> wrote: > I'd like to appeal to the SA collective to change the name of the > PENIS_ENLARGE tests to something a little more innocuous. Apparently > some people find it offensive to see it in their email. I've received > the odd complaint about the test name--usually w

Re: [SAtalk] How to call SA in Sendmail?

It's unneccesary. MIMEDefang doesn't call spamassassin -- it uses SA's Perl modules internally. Mark Emerle wrote: Hi- I have a related question. Is there a way to have mimedefang to call spamc instead of spamassassin? I have yet to find documentation stating that. smime.p7s Description

Re: [SAtalk] Two new techniques or old hat?

"adivvy" <[EMAIL PROTECTED]> wrote: 1. Considered spam by SA but subject not altered because of two 'subject:' fields: This one's new to me, and sounds like it would be an excellent indicator of spam. (Are two subject headers even allowed?) 2. A half-dozen spam (and only spam) messages delivered

[SAtalk] FW: Postmaster notify: see transcript for details

Can anyone make sense of this? I'm not sure, but it looks some weird error happened when sending some message to the spam-talk-admin weird... Got 3 of these in a row...1:47a, 1:50a, 2:11a > -Original Message- > From: Mail Delivery Subsystem [mailto:[EMAIL PROTECTED] > Sent: M

[SAtalk] sa-learn question...

I read in the FAQ that if SA makes an error in judgment with respect to its bayes filter that I can use sa-learn to correct this. I have also read that it is best to only do this with around 1000 pieces of mail at a time (per sa-learn man page). So is it bad to push one piece of mail though sa-l

RE: [SAtalk] How to call SA in Sendmail?

Hi- I have a related question. Is there a way to have mimedefang to call spamc instead of spamassassin? I have yet to find documentation stating that. -Mark -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Patrick Morris Sent: Tuesday, July 01, 2003 1

Re: [SAtalk] spamd "simply replaces" spamassassin? don't think so

At Tue Jul 1 15:16:11 2003, Iago wrote: > > I can't find spamassassin invoked in a *single* config > file. It's nowhere. So how the hell is it running in the > first place? What the heck does the installation script do > to make that, y'know, work at all? Use "ps -ef" to find out which p

Re: [SAtalk] How to call SA in Sendmail?

You need a milter. I like spamass-milter. -- Thomas Cameron, RHCE, CNE, MCSE, MCT Cameron Technical Services, Inc. (512) 454-3200 Main http://www.camerontech.com - Original Message - From: "Leo Huang" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 01, 2003 11:34 AM Subje

[SAtalk] spamd/spamc parameters

Hi, I have a question regarding the parameters to spamd/spamc. What I'm hoping to achieve is a setup where user_prefs are read from SQL but also have per-user bayes filtering and possibly per-user auto-whitelisting. To make things more fun the server doesn't have any users physically installed

Re: [SAtalk] Moving Bayes Database.

Found my problem. Just a FYI to everyone else. Make sure that you are running the same versions of the Berekely DB. They new one was Version 7 and the old one was V2. (1.8.5). A db_dump185, and db_load got it to the newest version. -Mark Mark Jenks wrote: Sorry about the confusion on the p

Re: [SAtalk] How to call SA in Sendmail?

You can't call SA directly from Sendmail. You'll need to either use a milter such as MIMEDefang (which I use here, there are others), or something like procmail. Leo Huang wrote: Hello, I want to call spamc in the Sendmail, so the messages won't be re-scanned if it is delivered to multiple us

RE: [SAtalk] Running spamd supervised?

> -Original Message- > From: Ralf Guenthner [mailto:[EMAIL PROTECTED] > Sent: Tuesday, July 01, 2003 11:12 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Running spamd supervised? > > > Hi list > > This may be a little off-topic, I apologize, but I tried to > run spamd under DJB's supe

Re: [SAtalk] How to call SA in Sendmail?

At 02:34 AM 7/2/2003 +1000, Leo Huang wrote: Hello, I want to call spamc in the Sendmail, so the messages won't be re-scanned if it is delivered to multiple users. How to call SA in the sendmail? Use spamass-milter or a similar milter plugin to sendmail that calls SA.

[SAtalk] Attachment headers in body, rawbody, or header?

Hello, I'm trying to write a rule based on the Content-Type: or Content-Disposition: header. Often, though, the headers I want are not in the top of the email, but in the attached part of the email, after the text, under the message boundary. Does SpamAssassin check these headers using the head

Re: [SAtalk] Spamassassin and qmail-scanner

Joseph Young Involved.com System Admin Thanks for replying. I know spamd is listening, because some email gets marked as spam. ~10% or ~20% are not. I have spamd enabled with the debug option. It shows no errors,failures or (0/0). joe - Original Message - From: "Ralf Guenthner" <[EMA

Re: [SAtalk] Spamassassin and qmail-scanner

Original Message - From: "Joe Young" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Tuesday, July 01, 2003 6:02 PM Subject: [SAtalk] Spamassassin and qmail-scanner > (spamassassin: 2.52. Clear:SA:0(0/0):. > Processed in 1.089797 secs); 30 Jun 2003 13:08:26 - > From this I can

Re: [SAtalk] baeys config parameters?

On Tuesday, Jul 1, 2003, at 05:29 US/Mountain, Tom Meunier wrote: The keyword isn't bayes_auto_learn_threshold_spam, but auto_learn_threshold_spam. Well, maybe the info in the spamassassin spamd README at

RE: [SAtalk] Spamassassin and qmail-scanner

> -Original Message- > From: Joe Young [mailto:[EMAIL PROTECTED] > Sent: Tuesday, July 01, 2003 11:01 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Spamassassin and qmail-scanner > > > Received: from [EMAIL PROTECTED] by wezen.involved.com by > uid 512 with qmail-scanner-1.16 > (spam

[SAtalk] How to call SA in Sendmail?

Hello, I want to call spamc in the Sendmail, so the messages won't be re-scanned if it is delivered to multiple users. How to call SA in the sendmail? Thanks, Leo --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Dat

Re: [SAtalk] Moving Bayes Database.

Sorry about the confusion on the permissions. The ones below are the way it should be. Amavisd-new is running under chroot, and if I leave the permissions like they are below, I can create the bayes with sa-learn, and it will create and use awl, and read bayes no problem at all. But if I copy

Re: AW: [SAtalk] best way for off-host users to submit to sa-learn?

At 02:56 AM 7/1/2003, you wrote: here's the script I currently use; mailbox handling is still quite bad but, hey it works for me. New in this version: it'll print a warning with the sender address of each email that DOESN'T contain a forwarded message, so you can easily tell the users: "Please forw

RE: [SAtalk] spamd "simply replaces" spamassassin? don't think so

> -Original Message- > From: Iago [mailto:[EMAIL PROTECTED] > Sent: Tuesday, July 01, 2003 10:16 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] spamd "simply replaces" spamassassin? don't think so > > > I'm running perl 5.8, spamassassin 2.55, solaris 2.7, > postfix 2.something (lat

[SAtalk] Bayes Database.

Hello everyone Is there a way to merge two bayes databes into one? I have two spam assassin servers running (quite well I might add) however their Bayes databases are out of sink. I can not run something like an NFS share between them, and therefore can't use one. What I would like to do is

Re: [SAtalk] spamd "simply replaces" spamassassin? don't think so

On Tue, Jul 01, 2003 at 07:16:11AM -0700, Iago wrote: > I can't find spamassassin invoked in a *single* config > file. It's nowhere. So how the hell is it running in the > first place? What the heck does the installation script do > to make that, y'know, work at all? You did fire up spamd

[SAtalk] Running spamd supervised?

Hi list This may be a little off-topic, I apologize, but I tried to run spamd under DJB's supervise program instead of starting it from an rc-script and although supervise seems to start it, spamd won't listen on port 783. Here's what I did: - Created a directory /var/qmail/supervise/spamd and pu

RE: [SAtalk] spamd "simply replaces" spamassassin? don't think so

Spamassassin itself doesn't do a thing, it just installs the Mail::SpamAssassin perl module, and leaves it up to the user to decide how to tie it into their mail system. The most common way for local users is via procmail, but that is by no means a standard. Darren -Original Message- Fro

[SAtalk] Spamassassin and qmail-scanner

Joseph Young Involved.com System Admin I don't know who to ask for help. I am running qmail-scanner with spamassassin and email that should be clearing be spam is not marked. qmail-scanner runs spamc in verbose mode and I get this in the header. Received: from [EMAIL PROTECTED] by wezen.involv

Re: [SAtalk] Default Scores of 0.001

At 03:01 AM 7/1/2003 +0100, R.W. wrote: It's purely idle curiosity, but why are there so many default score entries of 0.001 ? During development they tend to assign 0.001 to new rules so that they are run and can be tested without any significant impact on normal mail. Eventualy when they GA the

[SAtalk] Spamassassin and qmail-scanner

Joseph Young Involved.com System Admin I don't know who to ask for help. I am running qmail-scanner with spamassassin and email that should be clearing be spam is not marked. qmail-scanner runs spamc in verbose mode and I get this in the header. Received: from [EMAIL PROTECTED] by wezen.involved

RE: [SAtalk] Bug 1927 - spamd looping - v2.54

> -Original Message- > From: Dallas L. Engelken > Sent: Tuesday, July 01, 2003 10:15 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Bug 1927 - spamd looping - v2.54 > > > if i > take this message and pipe it through spamc > again, it processes fine. if i look in /var/log/maillog, it >

[SAtalk] RFC - Blocking Based on Layout of HTML

SpamAssassin has 'rawbody', 'full', and 'body' to represent ways you can analyze a message. I propose a fourth method of analysis, named something like 'html_layout'. A typical spam that gets through my filters looks something like this: text text So you basically have link to a centered ima

[SAtalk] Bug 1927 - spamd looping - v2.54

just wondering if anyone has seen this occurring much?? the spamd child process here is running for 6 minutes and 50 seconds. i had 3 processes this morning that were running for 14 minutes or more as well. it has nothing to do with expiry since i set expiry count to 200k and run my expiries at

Re: [SAtalk] Moving Bayes Database.

On Tue, Jul 01, 2003 at 05:28:00PM +0300, Mark Jenks wrote: > I deleted the bayes and let it create it's own, with no > problems. I put the files in place of the ones that it > created and it doesn't like them. I'm using the exact > same names. > > drwxr-xr-x3 amavisd amavisd 4096 Jun

[SAtalk] spamd "simply replaces" spamassassin? don't think so

I'm running perl 5.8, spamassassin 2.55, solaris 2.7, postfix 2.something (latest stable). I am seeing hundreds of copies of spamassassin spawned, so I think, "hey, I should cut over to using spamd". I read the man page. It says to "simply replace" spamassassin's invocations in my ma

Re: [SAtalk] Moving Bayes Database.

I deleted the bayes and let it create it's own, with no problems. I put the files in place of the ones that it created and it doesn't like them. I'm using the exact same names. Also, the box that I'm copying it from has the same versions of amavisd-new, postfix, and SA2.55. What else could it

Re: [SAtalk] BUGGY_CGI?

Hi, On Tue, 1 Jul 2003 13:52:40 +0100 "Darren Shrubsole" <[EMAIL PROTECTED]> wrote: > I'm still getting a BUGGY_CGI firing when using NMS FormMail. > > The relevant headers are: > > X-Mailer: NMS FormMail 3.08c1 > X-Spam-Status: No, hits=2.8 required=5.0 > tests=BUGGY_CGI > ver

RE: [SAtalk] Intriguing header forgery

> -Original Message- > From: Martin Radford [mailto:[EMAIL PROTECTED] > Sent: Monday, June 30, 2003 5:55 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Intriguing header forgery > > > Hi all, > > Now I admit that I don't regularly read all the headers of spam that I > receive, but this

[SAtalk] re: Help in installation

System info: OS: Red Hat 7.2 Perl 5.6.1-34.99.6 SA 2.55.1 MTA : Postfix-1.1.9 AV: Sophos MailMonitor I've recently installed SA-2.55-1 along with perl 5.6.1-34.99.6, configure the local.cf. When I run /usr/bin/spamd I'm getting the following: Can't locate HTML/Parser.pm in @INC (@INC contains: .

[SAtalk] Two new techniques or old hat?

Title: Message 1. Considered spam by SA but subject not altered because of two 'subject:' fields:   Microsoft Mail Internet Headers Version 2.0thread-index: AcM4I/aNXM78fdr8S76EyIBRhpBXSw==Content-Type: text/html; charset="iso-8859-1"Received: from mail..com ([192.168.0.3]) by smtp..com wi

Re: [SAtalk] re: SA installation problem

Hi, On 01 Jul 2003 11:49:28 +0800 Jon Miller <[EMAIL PROTECTED]> wrote: > Greetings, > I new to the list so I apologize if the following has already been > covered. I recently install (attempted) SA-2.55-1 (rpms) on a RHL7.2 > server. > gateway:/etc/mail/spamassassin# rpm -qa | grep spamassass

Re: [SAtalk] Bug in whitelist_from?

> >and it is getting a USER_IN_WHITELIST -100 score. The whitelist rule > >causing this is: > > > >whitelist_from [EMAIL PROTECTED] > > whitelist_from looks at several other headers, not just the literal From: > header > > In particular, I bet '"Sender" is postmaster or [EMAIL PROTECTED] It is

RE: [SAtalk] Creative spam, any ideas?

> -Original Message- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Monday, June 30, 2003 9:43 PM > To: Ralf Guenthner > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Creative spam, any ideas? > > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hello Ralf, > > Monday,

Re: [SAtalk] Bug in whitelist_from?

At 12:04 PM 7/1/03 +0100, Adam T. Bowen wrote: We have received some email this morning with the From and To headers like: From: "" <> To: [EMAIL PROTECTED] and it is getting a USER_IN_WHITELIST -100 score. The whitelist rule causing this is: whitelist_from [EMAIL PROTECTED] whitelist_from

RE: [SAtalk] BUGGY_CGI?

I'm still getting a BUGGY_CGI firing when using NMS FormMail. The relevant headers are: X-Mailer: NMS FormMail 3.08c1 X-Spam-Status: No, hits=2.8 required=5.0 tests=BUGGY_CGI version=2.54 Should it still be firing? Or is that a bug? Darren. > Mad Martian wrote on Sun, 29 Jun 2

[SAtalk] Bug in whitelist_from?

Hi, We have received some email this morning with the From and To headers like: From: "" <> To: [EMAIL PROTECTED] and it is getting a USER_IN_WHITELIST -100 score. The whitelist rule causing this is: whitelist_from [EMAIL PROTECTED] but if I change the * glob to something like [EMAI

Re: [SAtalk] baeys config parameters?

On Tue, Jul 01, 2003 at 06:29:03AM -0500, Tom Meunier wrote: > The keyword isn't bayes_auto_learn_threshold_spam, but > auto_learn_threshold_spam. FYI: either will work in 2.60. -- Randomly Generated Tagline: "4) Bobby Flay is coming to your house to tape an episode of "Food Nation" so you t

Re: [SAtalk] USER_AGENT_MOZILLA scores

On Tue, Jul 01, 2003 at 01:31:28PM +0200, Kai Schaetzl wrote: > I believe these heavy negative scores have been removed from SA-2.60, > anyway, because they can be easily forged. They were lowered significantly in 2.54, and the rules were removed for 2.60. -- Randomly Generated Tagline: "If you

RE: [SAtalk] baeys config parameters?

The keyword isn't bayes_auto_learn_threshold_spam, but auto_learn_threshold_spam. > > -Original Message- > From: Chad Leigh -- Shire.Net LLC [mailto:[EMAIL PROTECTED] > Sent: Monday, June 30, 2003 7:09 PM > To: [EMAIL P

Re: [SAtalk] USER_AGENT_MOZILLA scores

Dr. Juergen Klueners wrote on Tue, 1 Jul 2003 10:16:10 +0200 (MET DST): > I am using spamassassin and it works well. Today I got a lot of false > positives for the reason that These are not false positives, they are false *negatives*! The "-" indicates non-spamminess. > > score USER_AGENT_FORT

Re: [SAtalk] "required hits" option

Now it's clear. It wasn't clear to me from the manpage. Thank you very much for help On Tue, 1 Jul 2003 13:53:38 +0300, Hannu Liljemark <[EMAIL PROTECTED]> wrote: On Tue, Jul 01, 2003 at 09:07:00AM +0300, t macek wrote: How can I use the "required hits" option? I don't know, how to use it. Can y

Re: [SAtalk] "required hits" option

On Tue, Jul 01, 2003 at 09:07:00AM +0300, t macek wrote: > How can I use the "required hits" option? I don't know, > how to use it. Can you give me and PRACTICAL example, what > it is for? required_hits n.nn (default: 5) Set the number of hits required before a mail is considere

[SAtalk] skip some ip's to be checked

Hi ML, we use SA on a Mail-GW and works fine ! We only use auto-learn and don't feed the bayes DB manually. My problem is that when a spammer sends spam to a postbox which doesn't exist, the "postmaster" sends the mail back over our relayer and then the bayes DB learns that mails from this intern

Re: [SAtalk] Moving Bayes Database.

On Tue, Jul 01, 2003 at 12:42:00AM +0300, Mark Jenks wrote: > I just tried this and it doesn't work. No matter how I set the > permissions on the bayes files, it > won't read them. But if I teach it, it will work just fine. > > .spamassassin # /usr/bin/sa-learn --rebuild > Failed to create def

RE: [SAtalk] Newbies?

you can join the rwhois list but I doubt they would be much help with SpamAssassin, so you had better post here ;0) Regards Tom -Original Message- From: sietze [mailto:[EMAIL PROTECTED] Sent: 01 July 2003 08:58 To: [EMAIL PROTECTED] Subject: [SAtalk] Newbies? Hi there, Newbies can po

Re: [SAtalk] learning mailserver headers

Simon Byrnand wrote on Tue, 01 Jul 2003 17:17:35 +1200: > I can't quite see a scenario that would cause that, except maybe forwarded > messages that are showing all headers hmm.. :) > Bounces containing the headers of messages coming from your machines? Kai -- Kai Schätzl, Berlin, Germa

[SAtalk] Procmail+Spamassassin Recipe

Hi, OS: Redhat Linux 9.0 KERNEL: 2.4.20-smp MTA:Exim 3.36 SPAM: SpamAssassin 2.55 PROCMAIL: Procmail 3.22 HOW OUR MAIL WORKS -- USERS: 4000 DOMAINS:160 Each users mail resides in /var/spool/mail/$LOGNAME I have se

RE: [SAtalk] best way for off-host users to submit to sa-learn?

Hmmm. I have the same problem. Loads of POP users. They have been invited to forward messages they find offending to a special spam-queue. I noticed already that it is not a good idea to feed Bayes with these messages, because of the replaced headers. Is there a way to feed Bayes just the message c

Re: [SAtalk] Creative spam, any ideas?

Hello Bob Original Message - From: "Robert Menschel" <[EMAIL PROTECTED]> To: "Ralf Guenthner" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Tuesday, July 01, 2003 3:42 AM Subject: Re: [SAtalk] Creative spam, any ideas? > 2) I've been collecting these into rules which identify the u

[SAtalk] USER_AGENT_MOZILLA scores

Hi, I am using spamassassin and it works well. Today I got a lot of false positives for the reason that score USER_AGENT_FORTE -2.900 score USER_AGENT_GNUS_UA -6.400 -6.300 -2.900 -6.300 score USER_AGENT_KMAIL -5.800 -5.801 -6.300 -6.400 score USER_AGENT_MOZILLA_UA -5.801 -5.800 -5.701 -6.300 sco

[SAtalk] Newbies?

Hi there, Newbies can post here as well or do you prefer them to go elsewhere? (RTFM, FAQ etc. have been done and I have SA up and running.) Regards Sietze --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Repor

AW: [SAtalk] best way for off-host users to submit to sa-learn?

>> I think it's not a good idea to use forwarded mails as a source for >> "learning". Somewhere in the SA's documentation indicates this issue. > >Yes, we are not forwarding, we are redirecting. But I realize >that is >not a good way. redirect/resend/bounce is where the mail is >resent in >