Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-10 Thread Lucas Albers
How exactly did you determine what your hit percentage was for DCC,Razor and your RBL's? Could you send me more information on how you accomplished this, as I would like to analyze the results on my mail server. >> >> I've got a similar impression with my corpuses here, the DCC hit >> rate appears

Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-10 Thread Lucas Albers
> Joe - > > I've been running it on RH 9 since 2.53, and it has been rock solid. I > just > made sure I unset the LANG environment variable before running the > installation. > -- Is it worthwhile to have SA complain loudly if the defined langage is utf? Should it refuse to run? Complain on the c

Re: [SAtalk] postfix-2.0.13-20030706

2003-07-10 Thread Lucas Albers
> What's new about it, is that Postfix/amavisd-new - with this snapshot - > can now do realtime smtp 5xx rejection of spam/virus (or save them to a > quarantine directory, as before.) That lifts Postfix into SA-Exim 4's > class as far as I'm concerned and I'm happy to be able to support it :-) > >

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Lucas Albers
I used this method. I recently upgraded to File::Scan+ Mcafee Uvscan on mimedefang to detect zipped copies of the sobig virus. File::Scan will not detect virus's that are zipped. --luke > > Get the PERL module File::Scan and load it. Then get the MimeDefang > package > and install it. Mimedefang is

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-10 Thread Simon Byrnand
At 23:45 10/07/03 -0400, Barry McLarnon wrote: On Jul 10, 2003 05:40 pm, Simon Byrnand wrote: > However, are you able to generate any stats for the above tests > (from the same period of time) for how often they triggered in > *ham* ? EG so we can get an idea of the false positive rates of > DCC, r

[SAtalk] Just for a giggle...

2003-07-10 Thread Simon Byrnand
Came across these guys being advertised in a spam :) http://www.hosting.bag.gs/ Regards, Simon --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasof

Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-10 Thread Thomas Cameron
Joe - I've been running it on RH 9 since 2.53, and it has been rock solid. I just made sure I unset the LANG environment variable before running the installation. -- Thomas Cameron, RHCE, CNE, MCSE, MCT Cameron Technical Services, Inc. (512) 454-3200 Main http://www.camerontech.com - Origina

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-10 Thread Barry McLarnon
On Jul 10, 2003 05:40 pm, Simon Byrnand wrote: > However, are you able to generate any stats for the above tests > (from the same period of time) for how often they triggered in > *ham* ? EG so we can get an idea of the false positive rates of > DCC, razor, and the various RBL'ssometimes the fa

[SAtalk] Re: Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8installed.

2003-07-10 Thread Tom Diehl
On Thu, 10 Jul 2003, Joe Flowers wrote: > I have a Red Hat Linux 9 machine that has Perl 5.8 installed on it, and Perl > 5.8 on this machine looks deeply embedded to the core of the OS, based on > the ton of dependencies when I do "rpm -e perl". I need to run SpamAssassin > on this machine, but th

Re: [SAtalk] How to uninstall?

2003-07-10 Thread AltGrendel
Chris Ochap wrote: Click your heels together three times. -Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 2:19 PM To: [EMAIL PROTECTED] Subject: [SAtalk] How to uninstall? I totally can't get spamassassin working--how do you

RE: [SAtalk] How to uninstall?

2003-07-10 Thread Marvin Raab
Not very nice... Roberta, if one of your clients said "I can't get this Server working, how do I unplug it?", wouldn't you advise them to seek help form someone knowledgeable rather than throwing it away? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED

[SAtalk] sa-learn & attached spam, scanning Courier IMAP

2003-07-10 Thread Pierre Beck
I'm using the following method / setup: For a group of users, I have a Courier IMAP folder with several subfolders, as well as ham & spam subfolders. If a user detects a false negative, he can simply drop it into the spam / ham folder and a cronjob will exec "sa-learn --dir --spam /home/user/M

RE: [SAtalk] How to uninstall?

2003-07-10 Thread Chris Ochap
Click your heels together three times. -Chris > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 2:19 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] How to uninstall? > > I totally can't get spamassassin working--ho

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Dan O'Brien
Simon Byrnand <[EMAIL PROTECTED]> wrote: > And I did try adding those headers on a test server to > see if it does work, and it does, $u actually puts <> around the email > address by itself and $g doesnt, so for them to look consistent, you want > > HX-Envelope-From: <$g> > HX-Envelope-To: $u

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Simon Byrnand
At 21:19 10/07/03 -0300, Raul Dias wrote: Em Qui, 2003-07-10 às 20:03, Simon Byrnand escreveu: > >sendmail.cf > > > ># > ># Format of headers # > ># > > > >blah > >blah > > > >HX-Envelope-From: $g > >HX-Envelope-To: $u > > > >if i recall correctl

Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-10 Thread Christopher M. Iarocci
> I have a Red Hat Linux 9 machine that has Perl 5.8 installed on it, and Perl > 5.8 on this machine looks deeply embedded to the core of the OS, based on > the ton of dependencies when I do "rpm -e perl". I need to run SpamAssassin > on this machine, but the SpamAssassin docs highly recommends

Re: [SAtalk] SA won't install

2003-07-10 Thread Simon Byrnand
At 19:13 10/07/03 -0400, Scott Johnson wrote: Apologies. Redhat 6.2 Perl 5.6.1 installed by CPAN about two years ago Make sure you don't have *two* different versions of perl on your system. Do a whereis perl And see if you have both /usr/bin/perl and /usr/local/bin/perl. If you do, its possibl

Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-10 Thread Simon Byrnand
At 19:38 10/07/03 -0400, Joe Flowers wrote: I have a Red Hat Linux 9 machine that has Perl 5.8 installed on it, and Perl 5.8 on this machine looks deeply embedded to the core of the OS, based on the ton of dependencies when I do "rpm -e perl". I need to run SpamAssassin on this machine, but the Spa

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Raul Dias
Em Qui, 2003-07-10 às 20:03, Simon Byrnand escreveu: > >sendmail.cf > > > ># > ># Format of headers # > ># > > > >blah > >blah > > > >HX-Envelope-From: $g > >HX-Envelope-To: $u > > > >if i recall correctly :) > > Looks plausable, as $g is in Ret

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Dan O'Brien
Simon Byrnand <[EMAIL PROTECTED]> wrote: > Is there any special reason you need the Envelope-Recipient ? If you run SA > from the local delivery agent you already know who the recipient is when > procmail is called, if you run SA from a filter like Mimedefang then there > are potentially *mul

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Dan O'Brien
Yorkshire Dave <[EMAIL PROTECTED]>wrote: > sendmail.cf > > # > # Format of headers # > # > > blah > blah > > HX-Envelope-From: $g > HX-Envelope-To: $u Most Excellent!!! Works like a champ! Anybody have the sendmail.mc format? I've got my mi

[SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-10 Thread Joe Flowers
I have a Red Hat Linux 9 machine that has Perl 5.8 installed on it, and Perl 5.8 on this machine looks deeply embedded to the core of the OS, based on the ton of dependencies when I do "rpm -e perl". I need to run SpamAssassin on this machine, but the SpamAssassin docs highly recommends using Perl

Re: [SAtalk] SA won't install

2003-07-10 Thread Scott Johnson
Apologies. Redhat 6.2 Perl 5.6.1 installed by CPAN about two years ago Tony Earnshaw wrote: Scott Johnson wrote: Which I think means there's something wrong with my perl install (5.6.1, as noted in the path above), but I'm not sure what. Might ring a bell with someone if you detailed your OS

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Simon Byrnand
At 23:03 10/07/03 +0100, Yorkshire Dave wrote: On Thu, 2003-07-10 at 22:08, Dan O'Brien wrote: > Am I correct in my observation that SendMail, in its default > configuration, does *NOT* create the X-Envelope-From and X-Envelope-To > headers? > > If so, how does one get SendMail to create them? > se

Re: [SAtalk] SA won't install

2003-07-10 Thread Tony Earnshaw
Scott Johnson wrote: Which I think means there's something wrong with my perl install (5.6.1, as noted in the path above), but I'm not sure what. Might ring a bell with someone if you detailed your OS and version. And how you came by Perl 5.6.1. I have RH 7.2. It had 5.6.0. The first time I thr

Re: [SAtalk] tricky spam

2003-07-10 Thread Tony Earnshaw
Chr. von Stuckrad wrote: Or is there something causing me to only use 'ored' strings? Yours is Posix, Matt's is Perl/PCRE. Best, Tony -- Tony Earnshaw I love the music of Wagner. The only sound that pleases me more is that of a cat outside my 9th floor window, trying to cling to the glass with

Re: [SAtalk] How to balance new rules for hams that looks like spam

2003-07-10 Thread Tony Earnshaw
Raul Dias wrote: So, how do you balance this kind of situation? Is whitelisting the only way to go? I reckon that whitelisting's the only way, in this case. Even SA has a list of bona fide e-mail firms/orgs like Amazon in itself, so that your kind of example is exempted. To my mind, SA is a bit

Re: [SAtalk] spam with no body...

2003-07-10 Thread Tony Earnshaw
Matt Kettler wrote: I've seen a lot of "empty body" spam myself lately. Personally I attribute this to broken spam generation tools that somehow fail to properly send the body of the message. There's lots broken mass-mail software out there, as is evidenced by the "RANDOM_WORD" markup seen in

Re: [SAtalk] spam with no body...

2003-07-10 Thread Greg Cirino
| I've been seeing this too, so I added the following rule to my local.cf: | | header __TEXT_HTML_BA Content-Type =~ /text\/html/i | meta NO_BODY_BA __TEXT_HTML_BA && !HTML_MESSAGE | describe NO_BODY_BA Message with no body | score NO_BODY_BA 4 | | It's been working great for me. we strip text/

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Simon Byrnand
At 17:08 10/07/03 -0400, Dan O'Brien wrote: Am I correct in my observation that SendMail, in its default configuration, does *NOT* create the X-Envelope-From and X-Envelope-To headers? No it doesn't. However it does create a "Return-Path" header that is the same as what would be in X-Envelope-Fro

[SAtalk] How to uninstall?

2003-07-10 Thread Roberta J. Leon
I totally can't get spamassassin working--how do you uninstall it? Thanks <>

RE: [SAtalk] tricky spam

2003-07-10 Thread David B Funk
On Thu, 10 Jul 2003, Chris Santerre wrote: > > > I had a rule note on this from before. Haven't got to it yet. Basicaly > because of the FP rate. I'm going to write a few quick rules that look for > letterzeroletter and letter1letter. You can see why the FP rate would be > high. But I would score

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Yorkshire Dave
On Thu, 2003-07-10 at 22:08, Dan O'Brien wrote: > Am I correct in my observation that SendMail, in its default > configuration, does *NOT* create the X-Envelope-From and X-Envelope-To > headers? > > If so, how does one get SendMail to create them? > sendmail.cf # # Fo

RE: [SAtalk] tricky spam

2003-07-10 Thread Thomas Rücker
Hallo, > > Hi, i've attahced a very tricky SPAM mail that has been > > scored with 0.8 > > points, what can be done with this kind of SPAM?. > > Thanks > > German > > > It is easy to write a rule for some of the better knowns ones like > /(f|ph)(o|0)t(o|0)/i > but with all the ways of doing OBFU i

Re: [SAtalk] Increasing bayes_msgcount and db

2003-07-10 Thread Theo Van Dinter
On Thu, Jul 10, 2003 at 02:10:46PM -0700, Richard Stockton wrote: > No explanation of how this will be handled in 2.60, but perhaps > that is hidden in the new docs somewhere. It's all in the new sa-learn docs. In short, you can disable auto-expiry/auto-sync if you want to. For expiry, you set t

Re: [SAtalk] Syntax for dns_available test?

2003-07-10 Thread Theo Van Dinter
On Thu, Jul 10, 2003 at 12:07:17PM -0400, John P Verel wrote: > In Mail::SpamSssassin::Conf, there's the option called dns_available. I > want to point this to my ISP's DNS server to speed up the RBL checks. > > dns_available test: server1.ltd, etc. > > Can someone clarify how to set this up? dn

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Luis Hernán Otegui
Can anyone make a recommendation as to an AV package, preferably one which can be built into an (S)RPM without too terribly much work and which will play nice with Sendmail? Well, not an RPM, but HBEDV AntiVir Milter works wonderfully overhere, has daily updates, and installs in a breeze! Plus, it

Re: [SAtalk] Syntax for dns_available test?

2003-07-10 Thread Matt Kettler
At 12:07 PM 7/10/2003 -0400, John P Verel wrote: dns_available test: server1.ltd, etc. Can someone clarify how to set this up? It's actualy .tld, not ltd.. In general what you do is instead of "server1.tld" specify some domain that you want SA to perform a MX record lookup for via dns. So in y

Re: [SAtalk] Increasing bayes_msgcount and db

2003-07-10 Thread Richard Stockton
I filed bug report #2208 and received this "resolution". http://bugzilla.spamassassin.org/show_bug.cgi?id=2208 [EMAIL PROTECTED] changed: What|Removed |Added ---

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-10 Thread Simon Byrnand
At 11:31 10/07/03 -0400, Barry McLarnon wrote: On Jul 9, 2003 01:47 am, Kelsey Cummings wrote: > On Wed, Jul 09, 2003 at 10:24:55AM +1200, Simon Byrnand wrote: > ... > > > Certainly my initial impression after 24 hours is that DCC is the > > most effective, followed by RAZOR2, followed by PYZOR. Al

Re: [SAtalk] spam with no body...

2003-07-10 Thread Sandy S
I've been seeing this too, so I added the following rule to my local.cf: header __TEXT_HTML_BA Content-Type =~ /text\/html/i meta NO_BODY_BA __TEXT_HTML_BA && !HTML_MESSAGE describe NO_BODY_BA Message with no body score NO_BODY_BA 4 It's been working great for me. Sandy S. - Original Message

RE: [SAtalk] Digest::SHA1 problems

2003-07-10 Thread Dan O'Brien
> I have the same problem trying to install on a RH 8.0 box. Havent found > a solution yet though. > > Richard Humphrey Just hit this one, myself. I worked around it by installing the perl-Digest-SHA1-2.01-10.i386.rpm from the Red Hat 9 disc 2. I suspect it's included with Red Hat 8.0 also. R

Re: [SAtalk] spamd not listening, mail not scanned

2003-07-10 Thread Ken Winke
Actually...I think spamd may be running and listening on the correct port.  I did more digging and found:   [EMAIL PROTECTED] qmail-smtpd]# lsof -PniCOMMAND   PID USER    FD  TYPE   DEVICE  SIZE  NODE  NAMEspamd 727    spamd    5u  IPv4   1295  TCP   127.0.0.1:783 (LISTEN)

[SAtalk] SunONE iMS 5.2 (hf 1.12) and spamassassin

2003-07-10 Thread Jadrian S. Johnson
I've read through the posts regarding the integration of SunONE with Spamassassin, but have a pertinent question. When following Sun's brightmail configuration options, the iMS server must be running in direct LDAP mode. From the posts and configuration files I've seen, if I follow their similar in

Re: [SAtalk] spam with no body...

2003-07-10 Thread Rick Macdougall
VonEssen, John wrote: I have been seeing this sort of spam come up on several different mail servers I work on. The email is definitely spam and it tests positive for a few RBL, but not enough to raise its score significantly. The one I got the other day only scored 2.9. I know that on my system

[SAtalk] sendmail and X-Envelope-From header

2003-07-10 Thread Dan O'Brien
Am I correct in my observation that SendMail, in its default configuration, does *NOT* create the X-Envelope-From and X-Envelope-To headers? If so, how does one get SendMail to create them? Thanks, Dan O'Brien __ Axon Solutions, Inc.

Re: [SAtalk] spam with no body...

2003-07-10 Thread Matt Kettler
At 12:57 PM 7/10/2003 -0400, VonEssen, John wrote: I have been seeing this sort of spam come up on several different mail servers I work on. The email is definitely spam and it tests positive for a few RBL, but not enough to raise its score significantly. The one I got the other day only scored 2.9

Re: [SAtalk] sa-learn question

2003-07-10 Thread mikea
On Thu, Jul 10, 2003 at 02:47:50PM -0400, Wendell Smith wrote: > I am trying to feed sa-learn some spam/ham and I was wondering > something... > > Can I feed sa-learn ONE file that contains a large number of emails? I > ask this because I use Evolution and sort my mail into folders. Now > instead

Re: [SAtalk] sa-learn question

2003-07-10 Thread Matt Kettler
At 02:47 PM 7/10/2003 -0400, Wendell Smith wrote: Can I feed sa-learn ONE file that contains a large number of emails? It should work if it's in mbox format and you tell sa-learn to use that format. The alternative is to use a tool to split it out into many files in a single directory and use the

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Ryan Bingham
I second the recommendation for MailScanner. We use it in conjunction with Sophos here (with great results), and MailScanner can use any number of anti-virus engines -- including clamAV -- and can use multiple scan engines at the same time. It also integrates with SpamAssassin and has a host of

Re: [SAtalk] tricky spam

2003-07-10 Thread Chr. von Stuckrad
On Thu, Jul 10, 2003 at 01:54:07PM -0400, Matt Kettler wrote: > body LOCAL_SHOCKING_PHOTOS /\bsh(?:0|o)c(?:1|i)ng ph(?:0|o)t(?:0|o)(?:s|z)/i Did I miss something in the docs? I'd have written this (witch char classes) as: body LOCAL_SHOCKING_PHOTOS /\bsh[0o]ck[1i]ng ph[0o]t[0o][sz]/i (by the wa

[SAtalk] SA won't install

2003-07-10 Thread Scott Johnson
I'm trying to upgrade our SA install to 2.55, but when I try to use CPAN I get a whole bunch of errors: t/basic_lint.t11 100.00% 1 t/db_awl_path.t 41 25.00% 3 t/db_based_whitelist.t81 12.50% 1 t/db_based_wh

Re: [SAtalk] tricky spam

2003-07-10 Thread Luis Hernán Otegui
Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 points, what can be done with this kind of SPAM?. Thanks German Bueno, primero que nada, por fin aparece otro argentino en la lista! Ya creía que era el único que tiraba para estos lados... Segundo, dále al sa-learn sobre el m

Re: [SAtalk] Syntax for dns_available test?

2003-07-10 Thread John P Verel
On 07/10/03 14:02 -0400, Matt Kettler wrote: > > So in your case you might do: > > dns_available test: optonline.net > I did this: dns_available test: 167.206.3.216 ... which is the server shown in nslookup. I also have nameserver 167.206.3.216 nameserver 167.206.7.4 nameserver 167.206.112

RE: [SAtalk] spam with no body...

2003-07-10 Thread Chris Santerre
> -Original Message- > From: VonEssen, John [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 12:58 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] spam with no body... > > > I have been seeing this sort of spam come up on several different mail > servers I work on. > > The emai

Re: [SAtalk] tricky spam

2003-07-10 Thread Jim Ford
> On Thu, Jul 10, 2003 at 11:53:01AM -0300, German Staltari wrote: > > Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 > > points, what can be done with this kind of SPAM?. I see you're not using Razor, DCC or RBLs. I'll bet if you had it would've been hit hard - they make

[SAtalk] How to balance new rules for hams that looks like spam

2003-07-10 Thread Raul Dias
Hi, Now I am facing a problem with hams. Some advertising mails are legitimate mails that the user did subscribe to receive it. The problem is that it looks like spam, uses spams techniques (like "web_bugs"), it smells like spam. But it isn't. Some of this mails are getting even medium scores

Re: [SAtalk] tricky spam

2003-07-10 Thread Matt Kettler
At 11:53 AM 7/10/2003 -0300, German Staltari wrote: Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 points, what can be done with this kind of SPAM?. Thanks German This kind of spam is admittedly very well suited to bayes, as someone else already noted, but there are rules

[SAtalk] spam with no body...

2003-07-10 Thread VonEssen, John
I have been seeing this sort of spam come up on several different mail servers I work on. The email is definitely spam and it tests positive for a few RBL, but not enough to raise its score significantly. The one I got the other day only scored 2.9. I know that on my system I send back a 554 User

[SAtalk] sa-learn question

2003-07-10 Thread Wendell Smith
I am trying to feed sa-learn some spam/ham and I was wondering something... Can I feed sa-learn ONE file that contains a large number of emails? I ask this because I use Evolution and sort my mail into folders. Now instead of saving each mail one-at-a-time I want to highlight all of them and then

[SAtalk] spamd not listening, mail not scanned

2003-07-10 Thread Ken Winke
I'm attempting to run SA 2.55 after a manual install.  I'm running qmail with vpopmail with sql support for user and domain info. I've installed everything from the docs and from the FAQs, and am using qmail-scanner with spamassassin support to get and tag the mail.    spamd appears to be r

Re: [SAtalk] Spamassassin With qmail

2003-07-10 Thread Daniel Daley
Depends on what kind of setup you're looking for. Here's a good start for using spamd with .qmail files http://www.gbnet.net/~jrg/qmail/ifspamh/ Thanks, --Dan-- On Thursday, July 10, 2003, at 10:06 AM, Jose M.Herrera wrote: Where I can Find documentation about integration of spamassassin and

RE: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Marek Dohojda
Personally I use Clamav, and it works like a charm. -Original Message- From: Daniel Daley [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 8:33 AM To: Thomas Cameron Cc: [EMAIL PROTECTED] Hi Thomas, > Can anyone make a recommendation as to an AV package, preferably one > whic

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Steve Thomas
On Wed, Jul 09, 2003 at 08:23:25PM -0400, Rick Macdougall is rumored to have said: > > Ummm, except for the fact that MailScanner in and of itself is not a > virus scanner. Points for trying though. Doh! I misread the original mail. I thought he was looking for a scanning mechanism, not the sc

Re: [SAtalk] Syntax for dns_available test?

2003-07-10 Thread Tony Earnshaw
John P Verel wrote: In Mail::SpamSssassin::Conf, there's the option called dns_available. I want to point this to my ISP's DNS server to speed up the RBL checks. However, I'm unclear of the syntax of this option, shown as: dns_available test: server1.ltd, etc. Can someone clarify how to set this

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread lanceeck
Thomas Cameron wrote: > > Can anyone make a recommendation as to an AV package, preferably one > > which > > can be built into an (S)RPM without too terribly much work and which > > will > > play nice with Sendmail? Get the PERL module File::Scan and load it. Then get the MimeDefang package an

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Rick Macdougall
Steve Thomas wrote: Doh! I misread the original mail. I thought he was looking for a scanning mechanism, not the scanner itself. Revised recommendation: MailScanner and Sophos. :) I replied to him off list cause I thought it was OT, but I'll repost my recommendation here just for fun. Since h

RE: [SAtalk] tricky spam

2003-07-10 Thread Chris Santerre
> -Original Message- > From: German Staltari [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 10:53 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] tricky spam > > > Hi, i've attahced a very tricky SPAM mail that has been > scored with 0.8 > points, what can be done with this k

[SAtalk] RE: [Exim] Strange files left in /tmp

2003-07-10 Thread Jeffrey Wheat
I know it is one of them as the files are owned by the account that these programs run as. I installed temp-watch but it is not much help other than seeing the file creation and deletion. It would be very nice to have something like that to show the process name the actually created the file. Tha

RE: [SAtalk] tricky spam

2003-07-10 Thread Test, James
I like to make lots of custom rules (I gratifying watching how effective they can be). I have several that I update with porn words that spammers try to be clever with. In your case: body CLEVER_P0RN/(?:sexua1|0rgies|ph0t0s|sch00l)/i Notice that they use one's for the letter L, zero's

Re: [SAtalk] A simple question

2003-07-10 Thread Matt Kettler
At 09:25 AM 7/10/2003 +0200, Timothée HESPEL wrote: Hello, I would like to know if we can use sa-learn --spam on tagged spam, or just on non-detected spam. Thanks Timothée HESPEL In general, sa-learn should be fed a nice balanced diet of all kinds of spam, tagged and otherwise. However feeding i

[SAtalk] Spamassassin With qmail

2003-07-10 Thread Jose M.Herrera
Where I can Find documentation about integration of spamassassin and qmail. Thanks --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bullet

[SAtalk] Syntax for dns_available test?

2003-07-10 Thread John P Verel
Greetings. In Mail::SpamSssassin::Conf, there's the option called dns_available. I want to point this to my ISP's DNS server to speed up the RBL checks. However, I'm unclear of the syntax of this option, shown as: dns_available test: server1.ltd, etc. Can someone clarify how to set this up? Th

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-10 Thread Barry McLarnon
On Jul 9, 2003 01:47 am, Kelsey Cummings wrote: > On Wed, Jul 09, 2003 at 10:24:55AM +1200, Simon Byrnand wrote: > ... > > > Certainly my initial impression after 24 hours is that DCC is the > > most effective, followed by RAZOR2, followed by PYZOR. All > > together is probably most effective of co

Re: [SAtalk] tricky spam

2003-07-10 Thread mikea
On Thu, Jul 10, 2003 at 11:53:01AM -0300, German Staltari wrote: > Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 > points, what can be done with this kind of SPAM?. First and foremost, you can feed it to the Bayesian classifier as spam using sa-learn. That will cause all

Re: [SAtalk] Anti-virus suggestions requested

2003-07-10 Thread Daniel Daley
Hi Thomas, Can anyone make a recommendation as to an AV package, preferably one which can be built into an (S)RPM without too terribly much work and which will play nice with Sendmail? I'm not sure what kind of money you're willing to spend but I'll throw a relatively low cost but very well pe

[SAtalk] tricky spam

2003-07-10 Thread German Staltari
Hi, i've attahced a very tricky SPAM mail that has been scored with 0.8 points, what can be done with this kind of SPAM?. Thanks German mbox Description: Binary data

AW: [SAtalk] [OT] RE: DOS Attack? (for Mike Vanecek)

2003-07-10 Thread Martin Bene
Hi Mike, >I suspect that what we are seeing is some form of syn requests >from sendmail?? > >For example, I am now receiving the same sort of activity from >another jp site: >Jul 9 09:00:34 www kernel: Asia2 IN=eth0 OUT= >MAC=00:d0:09:3d:69:81:00:04:5a:ef:5e:1d:08:00 SRC=202.12.30.137 >DST=192

Re: [SAtalk] [OT] RE: DOS Attack? (for Mike Vanecek)

2003-07-10 Thread Mike Vanecek
On Thu, 10 Jul 2003 12:33:54 +0900, alan premselaar wrote > On 7/10/03 11:48 AM, "Mike Vanecek" <[EMAIL PROTECTED]> wrote: > > ...snip... > > > > [EMAIL PROTECTED] admin]$ whois uchuu.12inch.com > > BW whois 3.4 by Bill Weinman (http://whois.bw.org/) > > Copyright 1999-2003 William E. Weinman > >

Re: [SAtalk] LDAP Storage instead of SQL Storage

2003-07-10 Thread Kristian Koehntopp
On Wed, Jul 09, 2003 at 05:00:32PM -0400, Theo Van Dinter wrote: > On Wed, Jul 09, 2003 at 10:47:39PM +0200, Kristian Koehntopp wrote: > > ConfStorageLDAP support, and if so, how do I get the patch > > submitted into the SpamAssassin proper? > > As with all patches, you can submit it via bugzilla.

Re: [SAtalk] Increasing bayes_msgcount and db

2003-07-10 Thread Mark
- Original Message - From: "Richard Stockton" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 1:04 AM Subject: [SAtalk] Increasing bayes_msgcount and db > I am trying to increase the bayes db and msgcount size because > the defaults cause it to reset every hour

RE: [SAtalk] Wow, spam with scores as low as 2.1??

2003-07-10 Thread Benjamin Tomhave
"false negative" -- spam deemed ham "false positive" -- ham tagged as spam There's probably other lingo on this list that means the same thing. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of > [EMAIL PROTECTED] > Sent: Wednesday, July 09, 2003 11:49 P

[SAtalk] spamd/spamc which token db?

2003-07-10 Thread Gokcen Ogutcu
Hello, I'm running spamd/spamc pair. I was using popfile and it was working quite fine. But because it was not originaly meant for blocking spam and it doesn't have a multi-user support i'm giving spamassassin a try. Anyways, when running the spamd/spamc pair, when i don't supply a path for token

Re: [SAtalk] where to check to configure spam?

2003-07-10 Thread Ralf Guenthner
Original Message - From: "Daniel Tan" <[EMAIL PROTECTED]> To: "spamassassin" <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 9:49 AM Subject: [SAtalk] where to check to configure spam? > got this from maillogusing mailscanner and spam assassin 2gether... > > it is just a normal em

Re: [SAtalk] A simple question

2003-07-10 Thread Ralf Guenthner
- Original Message - From: "Timothée HESPEL" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 9:25 AM Subject: [SAtalk] A simple question > Hello, > I would like to know if we can use sa-learn --spam on tagged spam, or > just on non-detected spam. > Thanks > Timo

[SAtalk] where to check to configure spam?

2003-07-10 Thread Daniel Tan
got this from maillogusing mailscanner and spam assassin 2gether... it is just a normal email...how do i define whether or not i want to use any of these spam thingy like DOUBLE_CAPSWORD, HTML_20_30...blah blah blah.. Jul 10 15:45:16 mail MailScanner[5961]: Message h6A7jBZJ009035 from 192.16

Re: [SAtalk] Exit when threshold/score reached

2003-07-10 Thread Matthew Cline
On Wednesday 09 July 2003 05:42 pm, Chris Ochap wrote: > I know I saw the option for spamassassin/spamd to stop scanning once the > appropriate users score has been reached, but I cannot find it again. I > have spamd/spamc running on qmail/vpopmail/maildrop with per user > configs. I don't see it

[SAtalk] A simple question

2003-07-10 Thread Timothée HESPEL
Hello, I would like to know if we can use sa-learn --spam on tagged spam, or just on non-detected spam. Thanks Timothée HESPEL --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing

Re: [SAtalk] Very bad spamd performance!

2003-07-10 Thread Xavier
As suggested, I started spamd with '-L' flags and things were immediately better. So, I sniffed a few packets with all checks enabled and saw that the RBL servers were the problem! :-/ Tx for your help, Xavier -- If Bill Gates had a dime for every time a Windows box crashed... ...Oh, wait a minut