Re: automated reporting tools (was Re: [SAtalk] reporting idea)

2003-07-27 Thread Justin Mason
Justin Mason writes: [...autoreporting] Whoa -- that's a 2 day delay on posts to the SpamAssassin-talk list. not good :( --j. --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Fo

Re: [SAtalk] Trustic and Spamassassin?

2003-07-27 Thread Justin Mason
Beirne Konarski writes: >On Sunday 27 July 2003 10:32 pm, Beirne Konarski wrote: >> I'm trying to use Trustic with Spamassassin. I have a working Trustic >> account and followed the instructions at Trustic to use it with SA >> (http://www.trustic.com/help/dns#SA), but it doesn't look like SA is >

[SAtalk] Error when doing spamassassin -r

2003-07-27 Thread Christian Dysthe
Hi, I get an "unable to report spam" warning when I do a "spamassassin -r". Some of the debug lines: debug: Removing Markup debug: Razor1 is not available debug: Current PATH is: /usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/usr/games:/home/christian/bin debug: DCC is not available: dccproc not fo

Re: [SAtalk] How to remove an rbl from SA?

2003-07-27 Thread Simon Byrnand
At 00:04 28/07/2003 -0400, Steven W. Orr wrote: I seem to be getting a number of false positives because of ipwhois.rfc-ignorant.org This is an rbl that IMNSHO should *not* be used by anyone unless they deliberately want to block all clients of uunet. I know of which I speak. Can someone tell me ho

Re: [SAtalk] How to remove an rbl from SA?

2003-07-27 Thread Daniel Bird
set RCVD_IN_RFCI to 0 in your prefs file. It's the same for all rules I believe. e.g.: score RCVD_IN_RFCI 0 Dan - Original Message - From: "Steven W. Orr" <[EMAIL PROTECTED]> To: "spamassassin talk" <[EMAIL PROTECTED]> Sent: Monday, July 28, 2003 5:04 AM Subject: [SAtalk] How to remove a

Re: [SAtalk] How to remove an rbl from SA?

2003-07-27 Thread Kai MacTane
At 7/27/03 09:04 PM , Steven W. Orr wrote: I seem to be getting a number of false positives because of ipwhois.rfc-ignorant.org [snip] Can someone tell me how to shut it off? The test appears to be called RCVD_IN_RFCI; you could just set its score to 0 in 50_scores.cf. Alternatively, the other par

Re: [SAtalk] Trustic and Spamassassin?

2003-07-27 Thread Daniel Bird
Yep, mine works. This is my entry in /etc/mail/spamassassin/local.cf # Use the Trustic community-based block list header RCVD_IN_TRUSTIC eval:check_rbl('isp', 'assigned adress.') # <-note dot on the end of address describe RCVD_IN_TRUSTICFound in Trustic community blocking list

[SAtalk] How to remove an rbl from SA?

2003-07-27 Thread Steven W. Orr
I seem to be getting a number of false positives because of ipwhois.rfc-ignorant.org This is an rbl that IMNSHO should *not* be used by anyone unless they deliberately want to block all clients of uunet. I know of which I speak. Can someone tell me how to shut it off? TIA -- -Time flies lik

Re: [SAtalk] Trustic and Spamassassin?

2003-07-27 Thread Beirne Konarski
On Sunday 27 July 2003 10:32 pm, Beirne Konarski wrote: > I'm trying to use Trustic with Spamassassin. I have a working Trustic > account and followed the instructions at Trustic to use it with SA > (http://www.trustic.com/help/dns#SA), but it doesn't look like SA is > checking it. I ran SA in de

[SAtalk] Trustic and Spamassassin?

2003-07-27 Thread Beirne Konarski
I'm trying to use Trustic with Spamassassin. I have a working Trustic account and followed the instructions at Trustic to use it with SA (http://www.trustic.com/help/dns#SA), but it doesn't look like SA is checking it. I ran SA in debug mode and also did a line trace to watch what was going o

RE: [SAtalk] Send spam emails to an user folder

2003-07-27 Thread Larry Gilson
> -Original Message- > From: Leonardo Costa > > i'm using SA at procmail and i set to send the spam emails to the > following file (/var/spool/mail/spam). is there some way to > send it to an especifie file at users home directory? By the way you are writing this, I assume that you ar

Re: [SAtalk] Re: FORGED_MUA_OUTLOOK hitting with Outlook XP???

2003-07-27 Thread Martin Radford
At Fri Jul 25 09:16:45 2003, Tony Finch wrote: > > On Thu, 24 Jul 2003, Martin Radford wrote: > > > > If that's correct, I think people on the beta program really should > > report it as a bug, irrespective of the fact that a Message-ID is not > > technically mandatory. > > Lots of headers that S

Re: [SAtalk] Am I nuts or should this have been flagged differently

2003-07-27 Thread Matthew Cline
On Friday 25 July 2003 11:52 am, Jeff Funk wrote: > Here's a header of an e-mail I just received. The F'word has been replaced > with X's. Isn't there a default rule in SA somewhere that would catch > that? Seems like a pretty obvious nasty to me . . . . No, such a word is commonly used in non-

Re: [SAtalk] Analysing spam mail...

2003-07-27 Thread Matthew Cline
On Sunday 27 July 2003 04:41 am, Bonny wrote: > How may I check spam that wasn't detected by SA and thus add or adjust > SA to catch those messages too? You can look at full headers for the spam, then check out the "X-Spam-Status" header; it will tell you how many hits the message got, and which

Re: [SAtalk] Block an entire Network?

2003-07-27 Thread Simon Byrnand
At 23:17 25/07/2003 -0400, Matt Kettler wrote: At 03:09 PM 7/25/03 +0300, Turgut Kalfaoglu wrote: > >How does one go about blacklisting an entire network, say for example > >[EMAIL PROTECTED] does not seem to work? If you have the option; block it from the firewall OR router. It saves SO much overh

Re: [SAtalk] Re: [AMaViS-user] amavisd-new, spamassin does not tiebayes db rw

2003-07-27 Thread Tony Earnshaw
Branko F. Grac(nar wrote: as stated in perldoc Mail::SpamAssassin::Conf parameter auto_learn is on by default and i don't have it anywhere disabled. Nothing changes even if i set it to value 1. Hmmm ... using amavisd-new (for me v20030616 section VII =~ line 1061 in amavisd.conf) I have to tur

Re: [SAtalk] odd error during --lint

2003-07-27 Thread Tony Earnshaw
Turgut Kalfaoglu wrote: Yes I do; proper access rights and all. I ended up deleting everything bayes* in /etc/mail/spamassassin and it's re-creating them now. really odd. -turgut Tell us what happened and if you solved it. Hope you made a backup of the database first :) Not that it has anything

Re: [SAtalk] Block an entire Network?

2003-07-27 Thread Tony Earnshaw
Nix wrote: however, blocking entire IP classes such as 61.*.*.* is, in my opinion, a very narrow minded thing to do. keep in mind that the internet is a global entity, and by blocking that particular IP class, you'll have blocked me from being able to reply to you. Not necessarily. Blocking 240.0

Re: [SAtalk] max white/blacklist

2003-07-27 Thread Simon Byrnand
At 13:56 25/07/2003 -0400, Dave Stern - Former Rocket Scientist wrote: What is the maximum number of white/blacklist entries before SA chokes (V2.54)? I'm resuming 300+ is nowheres near the limit. Also, if these are on a single line, how long can it wrap for? Is 1600+ characters too long? Hi Da

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Vicki Brown
Tony Earnshaw wrote: >Fed up with people who expect everyone else to be clairvoyants. Please accept my apologies; I was not sufficiently clairvoyant to know what information _you_ would think was important in _my_ message. That said, I disagree with the premise any of the info you asked for _is_

Re: [SAtalk] SA not filtering spam.

2003-07-27 Thread Matt Kettler
At 11:40 PM 7/24/03 -0400, Daniel Carrera wrote: In any event, SA doesn't seem to be filtering spam at all. I only get about 1 or 2 spams a day, so it's hard to say anything certain, but not a single one of those (in the last 3 days) has been picked up by SA. What mechanism did you use to integrat

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Daniel Carrera
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, Jul 28, 2003 at 12:36:20AM +0200, Tony Earnshaw wrote: > >Mailserver - FreeBSD. Again, why does this matter? How could it possibly > >matter? > > FreeBSD is not a mailserver. I thought it was. Isn't a mail server a computer that serves mail

[SAtalk] Send spam emails to an user folder

2003-07-27 Thread Leonardo Costa
i'm using SA at procmail and i set to send the spam emails to the following file (/var/spool/mail/spam). is there some way to send it to an especifie file at users home directory? #what i have now :0fw | /usr/bin/spamassassin :0: * ^X-Spam-Status: Yes /var/spool/mail/spam #what i want to have

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Daniel Carrera
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Jul 27, 2003 at 06:26:09PM +0200, Tony Earnshaw wrote: > >Today two pieces of nasty x-rated spam came through the filters with > >negative > >scores because the spammer spoofed the From address to be _my_ address (the > >address part only; the

Re: [SAtalk] Spam Corpus

2003-07-27 Thread John Rudd
On Sunday, Jul 27, 2003, at 12:27 US/Pacific, Nix wrote: On Wed, 23 Jul 2003, Daniel Carrera stipulated: On Thu, Jul 24, 2003 at 12:00:13AM +0100, Nix wrote: Spam actually seems to differ quite a lot between individuals, Really? Why would that be the case? I think it depends which spammers' ma

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Tony Earnshaw
Vicki Brown wrote: Excuse me... refuse? REFUSE? Refuse _point blank_??? What are you on ?! Fed up with people who expect everyone else to be clairvoyants. Think about it. Mailserver - FreeBSD. Again, why does this matter? How could it possibly matter? FreeBSD is not a mailserver. MTA -sendmail

[SAtalk] Re: [AMaViS-user] amavisd-new, spamassin does not tie bayes db rw

2003-07-27 Thread Branko F. Gračnar
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 24 of July 2003 20:26, Mark Martinec wrote: > From my logs (SA 2.60): > debug: bayes: 2816 tie-ing to DB file R/O > /var/amavis/.spamassassin/bayes_toks debug: bayes: 2816 tie-ing to DB file > R/O /var/amavis/.spamassassin/bayes_seen > > d

Re: [SAtalk] [RD] rule discussion

2003-07-27 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Chris, Friday, July 25, 2003, 7:09:32 AM, you wrote: CS> Well I've done another update on the rules site. Some great rules CS> submitted again. Lots I want to incorporate myself. Agreed. I've captured a few that I've added to my user_prefs. Th

Re: [SAtalk] qmail, virtual users, and spamassassin

2003-07-27 Thread Robert Fleming
--On Thursday, July 24, 2003 6:31 PM -0400 Jason Parsons is rumoured to have written: I'm having a bit of confusion around virtual users in spamassassin with qmail. I would like to use a configuration based on the username part of the 'rcpt to' email address of a message. What am I missing? Is

[SAtalk] Installing SA on SuSE webmailserver 2.0 fails

2003-07-27 Thread typotype
Can anybody help? Any idea how to install SA on SuSE webmailserver 2.0 Trying install SA (like on other Servers) with webmin fails. trying $#>perl -MCPAN -e shell shell#> install Mail::SpamAssassin fails too. Is there anybody outside, can help? Kurt

Re: [SAtalk] Spam assassin rules wiki.

2003-07-27 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello AltGrendel, Wednesday, July 23, 2003, 11:41:34 AM, you wrote: A> Ok, I've seen lots of requests and no responce for a SpamAssassin A> rules wiki. Maybe I'm wrong, but I don't recall any responses saying A> "I have one here". I didn't have one

Re: automated reporting tools (was Re: [SAtalk] reporting idea)

2003-07-27 Thread Chad Leigh -- Shire . Net LLC
On Friday, Jul 25, 2003, at 12:55 US/Mountain, Justin Mason wrote: However, I have heard that spamcop's reporting tool will do a decent job of it; Not in my experience. We got blacklisted because a user on one of our mailing lists got infected with a virus that sent something that got tagged a

Re: [SAtalk] reporting idea

2003-07-27 Thread Raul Dias
AFAIK, this is what a spamcop report does. With the bonus that the spam source might be added to spamcop's RBL. IMO, it would be a good addition to sa to have spamassassin -R report to spamcop too. (Maybe a Net::Spam::Spamcop.pm would help ;) []'s Raul Dias Em Sex, 2003-07-25 às 13:50, [EMAIL

Re: [SAtalk] SA not filtering spam.

2003-07-27 Thread Daniel Carrera
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yes, I KNOW! My MTA is configured to redirect emails that fail SA's test. This is demonstrated by the fact that it has already redirected over 100 emails which failed SA's test. On Fri, Jul 25, 2003 at 07:44:59AM +0300, Jari Fredriksson wrote: > D

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Vicki Brown
At 18:26 +0200 2003-07-27, Tony Earnshaw wrote: >Vicki Brown wrote: > >> Today two pieces of nasty x-rated spam came through the filters with >>negative >> scores because the spammer spoofed the From address to be _my_ address (the >> address part only; the "real name" is not mine, they don't have

Re: [SAtalk] Spam Corpus

2003-07-27 Thread Nix
On Wed, 23 Jul 2003, Daniel Carrera stipulated: > On Thu, Jul 24, 2003 at 12:00:13AM +0100, Nix wrote: > >> Spam actually seems to differ quite a lot between individuals, > > Really? Why would that be the case? I think it depends which spammers' mailing lists you've landed up on. -- `We canno

[SAtalk] Am I nuts or should this have been flagged differently

2003-07-27 Thread Jeff Funk
Here's a header of an e-mail I just received. The F'word has been replaced with X's. Isn't there a default rule in SA somewhere that would catch that? Seems like a pretty obvious nasty to me . . . . Subject: Naked victims being XX X-Spam-Status: No, hits=2.5 required=6.6 tests=DAT

Re: [SAtalk] Taint mode?

2003-07-27 Thread Jim Knuth
- Original Message - From: "Bob Apthorpe" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, July 27, 2003 8:21 PM Subject: Re: [SAtalk] Taint mode? > On Sun, 27 Jul 2003 19:13:59 +0200 "Jim Knuth" <[EMAIL PROTECTED]> wrote: > > > what is the taint mode? > > > > in command "spa

Re: [SAtalk] Block an entire Network?

2003-07-27 Thread Nix
On Thu, 24 Jul 2003, alan premselaar said: > however, blocking entire IP classes such as 61.*.*.* is, in my opinion, a > very narrow minded thing to do. keep in mind that the internet is a global > entity, and by blocking that particular IP class, you'll have blocked me > from being able to reply

[SAtalk] I need to be quicker on the draw..

2003-07-27 Thread Evan Platt
Phone Call to our ISP: "Hi, I work for ipost.com, we write a anti-spam software for ISP's, would you be interested in evaluating our software?" I said: "No thanks." I SHOULD HAVE said: "Do you have anything that gets rid of phone spams?" :-) Evan

Re: [SAtalk] Taint mode?

2003-07-27 Thread Bob Apthorpe
On Sun, 27 Jul 2003 19:13:59 +0200 "Jim Knuth" <[EMAIL PROTECTED]> wrote: > what is the taint mode? > > in command "spamassassin -tD < sample-spam.txt" > come " taint mode? no " Taint mode is a security feature of perl designed to reduce problems stemming from suspect user data. Basically, under

Re: [SAtalk] odd error during --lint

2003-07-27 Thread Turgut Kalfaoglu
Tony: Yes I do; proper access rights and all. I ended up deleting everything bayes* in /etc/mail/spamassassin and it's re-creating them now. really odd. -turgut On Sun, 27 Jul 2003, Tony Earnshaw wrote: > Turgut Kalfaoglu wrote: > > > # spamassassin --lint > > Failed to run BAYES_90 SpamAssass

automated reporting tools (was Re: [SAtalk] reporting idea)

2003-07-27 Thread Justin Mason
Matt Kettler writes: >That and SA might not be able to accurately determine what IP needs to be >reported.. (ie: is your first MX the most recent, or the second most recent >received: line? is one of them forged to make it appear that a message went >to your secondary MX, then to the primary an

Re: [SAtalk] Want to turn off AWL (at least for my address)

2003-07-27 Thread Tony Earnshaw
Vicki Brown wrote: Today two pieces of nasty x-rated spam came through the filters with negative scores because the spammer spoofed the From address to be _my_ address (the address part only; the "real name" is not mine, they don't have that information). Solve this at your MTA level. Only you kno

Re: [SAtalk] odd error during --lint

2003-07-27 Thread Tony Earnshaw
Turgut Kalfaoglu wrote: # spamassassin --lint Failed to run BAYES_90 SpamAssassin test, skipping: (No write permission to ndbm file at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore.pm line 933. Etc. The spamd/amavis/procmail user who/whatever it is doesn't have write

[SAtalk] Taint mode?

2003-07-27 Thread Jim Knuth
Hi, what is the taint mode? in command "spamassassin -tD < sample-spam.txt" come " taint mode? no " cu Jim --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available

Re[2]: [SAtalk] What it some spam passes through?

2003-07-27 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Bonny, I second Daniel's suggestion to use the Bayesian features. They work wonderfully. Meanwhile, do you have full access to the SA setup? Or like me are you and end-user, limited to using just user_prefs? If you have full access to the SA

[SAtalk] Troubles: Installing SA on SuSE webmailserver 2.0 fails - HELP needed

2003-07-27 Thread Kurt Fleischmann
Can anybody help? Any idea how to install SA on SuSE webmailserver 2.0 (Kernel 2.2.16) using with postfix, ldap-auth Trying install SA (like on other Servers) with webmin fails. trying $#>perl -MCPAN -e shell shell#> install Mail::SpamAssassin fails too. In an other Thread I saw the question f

Re: [SAtalk] How to "whitelist" an address?

2003-07-27 Thread Tim
Hi Bonny, On Sun, 27 Jul 2003, Bonny wrote: > As the subject states, I got a false positive on a message sent to me > from a mailing list. > > How do I put that e-mail address into a whitelist? Simply add the address to your ~/.spamassassin/user_prefs file in the following format: whitelist_f

[SAtalk] odd error during --lint

2003-07-27 Thread Turgut Kalfaoglu
Hi there. I added a new rulem and ran lint, and this is what I got: # spamassassin --lint Failed to run BAYES_90 SpamAssassin test, skipping: (No write permission to ndbm file at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore.pm line 933. ) Failed to run BAYES_01 SpamAs

[SAtalk] Analysing spam mail...

2003-07-27 Thread Bonny
How may I check spam that wasn't detected by SA and thus add or adjust SA to catch those messages too? Thank you... -- Bonny - Registered Linux User #251752 --- VB LUG Moderator --- Computer - A device designed to speed and automate errors. pgp0.pgp Description: PGP signature

Re: [SAtalk] What it some spam passes through?

2003-07-27 Thread Bonny
In data Sat, 26 Jul 2003 22:37:52 -0400 Daniel Carrera <[EMAIL PROTECTED]> scriveva: > 1) Use the Bayesian feature of SA so that it can "learn" to > distinguish spam better. That would mean to use use_bayes 1 auto_learn 1 right? > 2) Instead of blindingly strengtening all rules,

[SAtalk] How to "whitelist" an address?

2003-07-27 Thread Bonny
As the subject states, I got a false positive on a message sent to me from a mailing list. How do I put that e-mail address into a whitelist? Thanx... -- Bonny - Registered Linux User #251752 --- VB LUG Moderator --- Sex is like software: it's better when it's free! pgp0.pgp Descri

Re: Re[2]: [SAtalk] spam funny

2003-07-27 Thread Justin Mason
Bob Menschel writes: >AL> Hmm, I understand the idea now. I will argue about positive score >AL> for unknown signatures, but negative score for signatures in the >AL> my ~/.gnupg is good > >I'd like to see the ability to run such tests. And following SA >practices, each would be a test with its ow

Re: [SAtalk] rule ideas..

2003-07-27 Thread Turgut Kalfaoglu
Ah! many thanks for the BIZ rule! -t - Turgut Kalfaoglu: http://www.kalfaoglu.com EgeNet Internet Services: http://www.egenet.com.tr --- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, P