Re: [SAtalk] How to remove the Spam report in the mail body

2003-07-11 Thread Matt Kettler
At 12:22 PM 7/12/03 +1000, Leo Huang wrote: Spamassassin adds the report in the body. How can I remove it? I tried to use "report_header 1", but it doesn't work. In 2.5x the "report_header" option no longer exist.. use "report_safe 2" instead. Check the man page for Mail::SpamAssassin::

[SAtalk] How to remove the Spam report in the mail body

2003-07-11 Thread Leo Huang
Hello, Spamassassin adds the report in the body. How can I remove it? I tried to use "report_header 1", but it doesn't work. Start SpamAssassin results 17.20 points, 6 required; * 1.1 -- From: does not include a real name * 0.6 -- From: ends in numbers * 0.6 -- Invalid Date: head

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-11 Thread David B Funk
On Thu, 10 Jul 2003, Dan O'Brien wrote: > Yorkshire Dave <[EMAIL PROTECTED]>wrote: > > sendmail.cf > > > > # > > # Format of headers # > > # > > > > blah > > blah > > > > HX-Envelope-From: $g > > HX-Envelope-To: $u > > Most Excellent!!! Works li

Re: [SAtalk] sa-learn using Cyrus IMAP Mailboxes

2003-07-11 Thread Nix
On Wed, 9 Jul 2003, Jeff Capeci spake: [stuff] Interesting. The headers of this mail included: X-Spam-Status: No, hits=1.2 required=5.0 tests=HTML_40_50,HTML_MESSAGE version=2.55 X-Spam-Level: * X-Spam-Report: This mail is probably spam. The original message has been attached along with this

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-11 Thread David B Funk
On 11 Jul 2003, Yorkshire Dave wrote: > On Fri, 2003-07-11 at 01:27, Simon Byrnand wrote: > > At 21:19 10/07/03 -0300, Raul Dias wrote: > > >Em Qui, 2003-07-10 às 20:03, Simon Byrnand escreveu: > > > > > > > >sendmail.cf [snip..] > > > > >HX-Envelope-From: $g > > > > >HX-Envelope-To: $u > > > > >

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-11 Thread Nix
On 10 Jul 2003, Yorkshire Dave said: > HX-Envelope-From: $g > HX-Envelope-To: $u This adds the header even to mail that's being relayed on and not locally delivered. If you don't want that, something like H?l?X-Envelope-Sender: $g will do the trick. -- `We cannot get a new line down the pipe

[SAtalk] Dan Zachary/Jaars/WCT is out of the office.

2003-07-11 Thread Dan_Zachary
I will be out of the office starting 07/11/2003 and will not return until 07/31/2003. I'm out of the office until August 4th. --- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing

[SAtalk] RE: [Exim] Strange files left in /tmp

2003-07-11 Thread Jeffrey Wheat
The culprit turns out to be sophie. Thanks for all the replies. Regards, Jeff > -Original Message- > From: Philip Hazel [mailto:[EMAIL PROTECTED] > Sent: Friday, July 11, 2003 5:12 AM > To: Jeffrey Wheat > Cc: Sheldon Hearn; [EMAIL PROTECTED]; > [EMAIL PROTECTED] > Subject: RE: [Exim] S

Re: [SAtalk] BAYES_XX scores

2003-07-11 Thread Matt Kettler
At 12:56 PM 7/11/2003 -0500, Genchev, Sergei wrote: I use bayes tests and do not use network tests with SA 2.55. Thing that puzzles me is the default scores for my situation. Is there any reason that BAYES_80 score (5.3) is bigger then BAYES_90 score (4.027) and even BAYES_99 score (5.2)? BAYES_1

Re: [SAtalk] sendmail and X-Envelope-From header

2003-07-11 Thread Yorkshire Dave
On Fri, 2003-07-11 at 01:27, Simon Byrnand wrote: > At 21:19 10/07/03 -0300, Raul Dias wrote: > >Em Qui, 2003-07-10 às 20:03, Simon Byrnand escreveu: > > > > > >sendmail.cf > > > > > > > ># > > > ># Format of headers # > > > ># > > > > > > > >blah

Re: [SAtalk] asian fonts induce false negatives?

2003-07-11 Thread Matt Kettler
Summary: Known bug in your version, fixed in 2.54 and newer. No, the Asian fonts have nothing to do with it. The reason for your false negative is that you're using 2.53, which is very well known to be easily abused by spammers. The REFERENCES and IN_REP_TO rules both have very large negative s

Re: [SAtalk] BAYES_XX scores

2003-07-11 Thread Theo Van Dinter
On Fri, Jul 11, 2003 at 12:56:27PM -0500, Genchev, Sergei wrote: > Is there any reason that BAYES_80 score (5.3) is bigger then BAYES_90 score > (4.027) and even BAYES_99 score (5.2)? BAYES_10 vs. BAYES_01 vs. BAYES_00 > also look strange. See http://spamassassin.taint.org/faq/index.cgi?req=show&

RE: [SAtalk] question about returning mail

2003-07-11 Thread Luzynski, Steve
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: Friday, July 11, 2003 11:44 AM > To: dawnshade; [EMAIL PROTECTED] > Subject: Re: [SAtalk] question about returning mail > > At 04:44 PM 7/11/2003 +0400, dawnshade wrote: > >In this case: [EMAIL PROTECTED] - not rea

[SAtalk] BAYES_XX scores

2003-07-11 Thread Genchev, Sergei
I use bayes tests and do not use network tests with SA 2.55. Thing that puzzles me is the default scores for my situation. Is there any reason that BAYES_80 score (5.3) is bigger then BAYES_90 score (4.027) and even BAYES_99 score (5.2)? BAYES_10 vs. BAYES_01 vs. BAYES_00 also look strange. As

[SAtalk] Re: sa-learn seg faulting

2003-07-11 Thread Malte S. Stretz
On Friday 11 July 2003 19:02 CET Fred Bacon wrote: > Hi, I'm running spamassassin 2.54 on a Redhat 7.3 distribution. > > I have my users place unmarked spam into a shared IMAP folder on our > server. Every night I have a cron job learn the contents of the folder > as spam. On occasion (perhaps on

Re: [SAtalk] asian fonts induce false negatives?

2003-07-11 Thread mikea
On Fri, Jul 11, 2003 at 09:59:22AM -0700, Support wrote: > Hi, > > I have a user who gets SPAM with scores of around -6.0 points. One thing > I've noticed is that they have asian characters(and some english). Could > this be inducing a false negative? > > Also one side question. how exactly is

RE: [SAtalk] tricky spam

2003-07-11 Thread Chris Santerre
> -Original Message- > From: David B Funk [mailto:[EMAIL PROTECTED] > Sent: Friday, July 11, 2003 12:38 PM > To: Chris Santerre > Cc: Spamassassin-Talk (E-mail) > Subject: RE: [SAtalk] tricky spam > > > On Fri, 11 Jul 2003, Chris Santerre wrote: > > > > Usually write it like, /(f|ph)ot0

Re: [SAtalk] sa-learn seg faulting

2003-07-11 Thread mikea
On Fri, Jul 11, 2003 at 01:02:01PM -0400, Fred Bacon wrote: > Hi, I'm running spamassassin 2.54 on a Redhat 7.3 distribution. > > I have my users place unmarked spam into a shared IMAP folder on our > server. Every night I have a cron job learn the contents of the folder > as spam. On occasion (

[SAtalk] asian fonts induce false negatives?

2003-07-11 Thread Support
Hi, I have a user who gets SPAM with scores of around -6.0 points. One thing I've noticed is that they have asian characters(and some english). Could this be inducing a false negative? Also one side question. how exactly is a negative score accumulated? Are there negative points added to the

[SAtalk] sa-learn seg faulting

2003-07-11 Thread Fred Bacon
Hi, I'm running spamassassin 2.54 on a Redhat 7.3 distribution. I have my users place unmarked spam into a shared IMAP folder on our server. Every night I have a cron job learn the contents of the folder as spam. On occasion (perhaps once every two to three weeks), a message in the folder will c

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-11 Thread Kelson Vibber
Simon Byrnand <[EMAIL PROTECTED]> wrote: Razor2 on the other hand does sometimes give me FP's, one thing in particular is messages from Incredimail seem to trigger Razor (yes I know incredimail is incredibly spammy in the way it sends messages, it triggers a lot of SA rules too :) I vaguely rec

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-11 Thread Kelson Vibber
Barry McLarnon <[EMAIL PROTECTED]> wrote: On Jul 11, 2003 01:43 am, Lucas Albers wrote: > How exactly did you determine what your hit percentage was for > DCC,Razor and your RBL's? ... Nothing fancy... I had the spam archived in one mbox file, so I just used grep on that file to find the test names

RE: [SAtalk] tricky spam

2003-07-11 Thread David B Funk
On Fri, 11 Jul 2003, Chris Santerre wrote: > > Usually write it like, /(f|ph)ot0|(f|ph)0to/i > Minor perl technicality, use the 'non rembering' version of the grouping operator, (?: ... ). As you probably aren't going to interpolate the match in a backreference, don't waste the CPU and memory to '

Re: [SAtalk] question about returning mail

2003-07-11 Thread Matt Kettler
At 04:44 PM 7/11/2003 +0400, dawnshade wrote: In this case: [EMAIL PROTECTED] - not real address. How i can tell to Spamassassin don't doing this It's not spamassassin that's doing it, spamassassin itself can't even try to do this. Exim however can do things like this, and it's Exim that needs

RE: [SAtalk] Spamc on remote host

2003-07-11 Thread Tony Bunce
I have tried this with no success, The issue we are having is that it can take upto 4 mins for spamc to realize that the spamd host is not running.  I have tried to use the –t option with spamc but that only seams to effect how long spamc will wait on spamd after the connection is made.  I

[SAtalk] Spamc on remote host

2003-07-11 Thread Tony Bunce
Is anyone here using spamc on a remote host system wide?    If so what are you doing to ensure that if the spamd system fails that mail will still be delivered?   Thanks, Tony B, CCNA, Network+ Systems Administration GO Concepts, Inc. / www.go-concepts.com Are you on the GO yet? W

Re: [SAtalk] tricky spam

2003-07-11 Thread German Staltari
Hi, i'm using Razor, but not DCC or RBLs. Razor said nothing about it. Thanks for the answers list. :) German - Original Message - From: "Jim Ford" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 10, 2003 4:55 PM Subject: Re: [SAtalk] tricky spam > > > On Thu, Jul 10,

Re: [SAtalk] How to uninstall?

2003-07-11 Thread Hannu Liljemark
On Fri, Jul 11, 2003 at 01:19:00AM +0300, Roberta J. Leon wrote: > I totally can't get spamassassin working--how do you > uninstall it? The "best" method depends on how you installed it. If from a rpm package, 'rpm -e spamassassin' will probably do the trick (replace spamassassin with whatever is

Re: [SAtalk] Razor2 vs DCC vs Pyzor ?

2003-07-11 Thread Barry McLarnon
On Jul 11, 2003 01:43 am, Lucas Albers wrote: > How exactly did you determine what your hit percentage was for > DCC,Razor and your RBL's? > Could you send me more information on how you accomplished this, as > I would like to analyze the results on my mail server. Nothing fancy... I had the spam

RE: [SAtalk] How to uninstall?

2003-07-11 Thread Roberta J. Leon
Yes, of course. But if someone decided NOT to use something after trying it, I'd help them do what they wished. And I tried the heels thing, of course, and it didn't work. It almost never does! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marvin Raab Se

RE: [SAtalk] tricky spam

2003-07-11 Thread Chris Santerre
> -Original Message- > From: David B Funk [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 6:15 PM > To: Chris Santerre > Cc: 'German Staltari'; [EMAIL PROTECTED] > Subject: RE: [SAtalk] tricky spam > > > On Thu, 10 Jul 2003, Chris Santerre wrote: > > > > > > > I had a rule no

[SAtalk] dccifd not availabe

2003-07-11 Thread Daniel Siegers
Hi there,   i´m getting this message in SA´s debugoutput.   DCC ist installed, /var/dcc/libexec is in PATH.   Any idea ?       Mit freundlichen Grüßen / Kind regards   Daniel SiegersSystemadministrator   Heinrich Bauer Dienstleistungs KGBrieffach 4620Burchardstraße 11D-20077 Hamburg   Telefon 

Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed.

2003-07-11 Thread Thomas Cameron
- Original Message - From: "Lucas Albers" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, July 11, 2003 12:29 AM Subject: Re: [SAtalk] Adding Perl 5.6.1 to RH Linux 9 that already has Perl 5.8 installed. > Is it worthwhile to have SA complain loudly if the defined langage is u

RE: [SAtalk] How to balance new rules for hams that looks like spam

2003-07-11 Thread Chris Santerre
> -Original Message- > From: Raul Dias [mailto:[EMAIL PROTECTED] > Sent: Thursday, July 10, 2003 4:03 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] How to balance new rules for hams that > looks like spam > > > Hi, > > > Now I am facing a problem with hams. > > Some advertising mai

Re: [SAtalk] Sun Enterprise 10000, spamd relay

2003-07-11 Thread Paul Davies
Not a problem, we have a nuclear power station on-site... From: Kristian Koehntopp <[EMAIL PROTECTED]> To: Jonathan Nichols <[EMAIL PROTECTED]> CC: Paul Davies <[EMAIL PROTECTED]>, [EMAIL PROTECTED] Subject: Re: [SAtalk] Sun Enterprise 1, spamd relay Date: Wed, 9 Jul 2003 11:01:41 +0200 O

[SAtalk] question about returning mail

2003-07-11 Thread dawnshade
Hello all, Spamassassin2.55+exim4.20: transports: # Spam Assassin spamcheck: driver = pipe command = /usr/local/bin/exim -oMr spam-scanned -bS use_bsmtp = true transport_filter = /usr/local/bin/spamc home_directory = "/tmp" current_directory = "/tmp" # must use a pr

Re: [SAtalk] postfix-2.0.13-20030706

2003-07-11 Thread Tony Earnshaw
Tony Earnshaw wrote: The new TLS patch for Postfix 2.0.13 doesn't work properly yet, smtpd and smtp have to talk to Amavisd unencrypted and encryption can't be turned off at the moment to talk to Amavisd (bug), so the smtpd servers should not advertise STARTTLS on an EHLO. The above has now bee

Re: [SAtalk] postfix-2.0.13-20030706

2003-07-11 Thread Tony Earnshaw
Lucas Albers wrote: So now their are three mail combinations that can block spam at the smtp 5xx rejection stage. SA-Mimedefang-Sendmail Postfix-2.xxx-CVS+AMavis SA-Exim Don't forget Tom Kistner's Exiscan for Exim 4, either. That can do virus scanning too, like Amavisd-new (needs extra virus scan

Re[2]: [SAtalk] Wow, spam with scores as low as 2.1??

2003-07-11 Thread Abigail Marshall
Hello Matt, Wednesday, July 9, 2003, 6:36:03 PM, you wrote: >> >> > 4.0 (Medium), >> >>Oww. >> >>These three settings are going to give you false positives galore. MK> 4.0 isn't all that bad.. according to STATISTICS.txt 4.0 should give you MK> 0.44% FP rate in v 2.54, which is a lot more tha

Re[3]: [SAtalk] Attachment Checks

2003-07-11 Thread Abigail Marshall
SB> Yes, SA does use a lot of memory - about 20MB, but the amount of memory SB> doesn't really change based on the message size, which was why I was SB> expressing surprise. It takes *longer* to scan a larger message, but SB> compared to the static overhead of 18MB for the libraries and regex's t