RE: [SAtalk] Exim 4.22 and SA 2.55

>>this latest server I'm building >>requires blocking of email, not just filtering > >I used [1] for exim3 but there is also a help for exim4 [2]. > >[1] http://dman.ddts.net/~dman/config_docs/exim3_spamassassin.html >[2] http://dman.ddts.net/~dman/config_docs/exim4_spamassassin.html See also http

Re: [SAtalk] `HTML::Parser' not found.

At 21:34 19/08/2003 +0200, Luis Muñiz wrote: Hi there! I've just setup (not system-wide[1]) Mail-SpamAssassin-2.55. My problem is that every time a mail is received, procmail' log shows the following: Can't locate HTML/Parser.pm in @INC (@INC contains: /home/colab/kreator/usr/local/share

Re: [SAtalk] OT SA policy for ISP usage

On Tuesday, August 19, 2003, at 03:25 PM, Fred I-IS.COM wrote: Can anyone provide a policy for an ISPs' use of Spam Assassin to filter customers e-mail?   We need to update our policy to explain about SA and our use of it.   I'd like to see how other companies are doing it, how they protect them

Re: [SAtalk] `HTML::Parser' not found.

What are the permissions on the file (and the directories it's in)? Maybe SA can't read it. Luis Muñiz wrote: Hi there! I've just setup (not system-wide[1]) Mail-SpamAssassin-2.55. My problem is that every time a mail is received, procmail' log shows the following: Can't locate HTML

[SAtalk] someone fake my from address

sorry if i was not clear before but someone put my address as from and send out a spam what can i do to aovid being tagged as a spammer Return-Path: <[EMAIL PROTECTED]> Received: from DJH4R401 ([63.237.164.221]) by mx4.centurytel.net (8.12.9/8.12.9) with ESMTP id h7JKXujM080317 for <[EMAIL PR

[SAtalk] how does auto-learn work?

Hi, I'm wondering how it is possible to keep bayes "fresh" with both spam and ham, and understand how can SA do auto-learning? How exactly does SA automatically provide ham to bayes? I imagined sa-learn would have to be fed ham and spam manually, otherwise if it is done automatically, wouldn't it

Re: [SAtalk] Exim 4.22 and SA 2.55

Chris, Will Postfix block email at the SMTP level if the email reaches a score I specify, or at least block it from being delivered to the POP server that sits behind it? Chris - Original Message - From: "Covington, Chris" <[EMAIL PROTECTED]> To: "Christopher M. Iarocci" <[EMAIL PROTECT

Re: [SAtalk] No AWL again

> HI, attached to this message there are another two cases of no AWL > adjustment in SA-2.60-CVS. But, again, if I run > > % check_whitelist |grep andrinileo > > I get > > -100.0(-100/1) -- [EMAIL PROTECTED]|ip=non. > > Same with check_whitelist |grep guillestiu: > > -100.0

[SAtalk] FreeBSD + Sendmail

Is there a howto out there for getting SpamAssassin setup with FreebSD 4.7 and Sendmail? I got Sendmail, Procmail and Spamassassin installed, but I am not sure if its working or not. I have sendmail setup to forward all non-local email to my backend Exchange server. Will this work or do I need to

re[2]: [SAtalk] More complex rules

Hi Matt, Thanks for the reply. I need the storage because of the logistics involved in the actual problem. Your approach would require hundreds, perhaps thousands, of rules in the real problem I am trying to solve. I used a really simple rule just to illustrate what I want to do. So the que

Re: [SAtalk] Exim 4.22 and SA 2.55

Will Postfix block email at the SMTP level if the email reaches a score I specify, or at least block it from being delivered to the POP server that sits behind it? Chris --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.507 / Viru

[SAtalk] 4.3 and 4.2 seem low for these two spams

[To: address munged] --- From [EMAIL PROTECTED] Tue Aug 19 00:32:38 2003 Received: from adsl-64-108-125-74.dsl.euclwi.ameritech.net (adsl-64-108-125-74.dsl.euclwi.ameritech.net [64.108.125.74]) by dover.retry.com (8.12.6/8.12.6) with SMTP id h7J6WcQp022674

[SAtalk] reporting ips

where do i report ips that send spam --- This SF.net email is sponsored by Dice.com. Did you know that Dice has over 25,000 tech jobs available today? From careers in IT to Engineering to Tech Sales, Dice has tech jobs from the best hiring compa

RE: [SAtalk] Re: How To Change Recipient In User Unknown Message?

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of John > P Verel > Sent: Tuesday, August 19, 2003 6:43 AM > To: spamassassin list > Subject: [SAtalk] Re: How To Change Recipient In User Unknown Message? > > > > On 08/19/03 07:06 +0100, Yorkshire Dave wro

Re: [SAtalk] Exim 4.22 and SA 2.55

On Tue, 2003-08-19 at 22:20, Chad Leigh -- Shire.Net LLC wrote: > > > > not just for Linux either -- this uses the exim local_scan() capability > to do this at SMTP reception time. Works great. > > Chad Teergrubing before rejecting, that's nice, I

[SAtalk] `HTML::Parser' not found.

Hi there! I've just setup (not system-wide[1]) Mail-SpamAssassin-2.55. My problem is that every time a mail is received, procmail' log shows the following: Can't locate HTML/Parser.pm in @INC (@INC contains: /home/colab/kreator/usr/local/share/perl/5.6.1 /usr/local/lib/perl/5.6.1 /usr

Re: [SAtalk] Exim 4.22 and SA 2.55

[EMAIL PROTECTED] wrote: Or Exim with Sa-Exim exim.org sa-exim.sf.net or Exim with MailScanner (www.mailscanner.info) On Tuesday, August 19, 2003, at 11:26 AM, Covington, Chris wrote: Why don't you consider Postfix and Amavisd-new, since you're switching to a new mailer anyway? http://www.g

Re: [SAtalk] HEX IN URI and attachments

Hey all...I'm really interested...I was unable to find other references...so please feel free to flame me...but I'm really interested in determining how I can create a rule that applies a score against email that has a "HEX" based URI in the body of the message AND a meta rule includingattachme

Re: [SAtalk] Re: Which ham to trian sa-learn

On Tue, 2003-08-19 at 17:03, Chris Barnes wrote: > Yorkshire Dave <[EMAIL PROTECTED]> wrote: > > I'd figure it's better to use your recent ham, the same as with spam, > > that way your bayes database contains tokens from what's happening now > > as opposed to what happened years ago. > > I underst

[SAtalk] OT SA policy for ISP usage

Can anyone provide a policy for an ISPs' use of Spam Assassin to filter customers e-mail?   We need to update our policy to explain about SA and our use of it.   I'd like to see how other companies are doing it, how they protect themselves etc.   Thanks for your time,   Frederic TaraseviciusIn

[SAtalk] Snicker of the day

This spammer chose the wrong random word to put at the end of their subject line: Subject: Satisfy your lover with your penis less Suzanne -- [EMAIL PROTECTED] - http://www.igs.net/~tril/ First the fish needs to say, "something ain't right about this ca

Re: [SAtalk] Which ham to trian sa-learn

At 12:11 PM 8/19/2003 +0200, Martin Bretschneider wrote: I've got ham since 2000 in my archive containing 1. personal emails from friends 2. important mailings lists (university and so) 3. not that important mailing list (GnuPG, OpenOffice.org, Sylpheed, GNOME and so on) I have got spam of the last

Re: [SAtalk] Useful reporting with SA

At 11:09 AM 8/19/2003 -0500, Ken Winke wrote: I assume the rules I want to test go into mass-check.cf. No, as per the file itself, only scores can go there. Put the rules you want to test into your local.cf, or in with the spamassassin rules. (note: if you run mass-check from a directory tree of

Re: [SAtalk] Exim 4.22 and SA 2.55

Check here too: http://www.timj.co.uk/linux/exim.php On Tuesday, August 19, 2003, at 01:30 PM, Martin Bretschneider wrote: "Christopher M. Iarocci" <[EMAIL PROTECTED]> wrote: Hi Christopher, Anybody have Exim and SA running as a SPAM filtering/blocking gateway that would want to share their co

Re: [SAtalk] DNS check doesn't work

Wow, that was a 5 hour delay from when I sent that message. Frederic Tarasevicius Internet Information Services, Inc. Fred I-IS.COM wrote: > Try running spamassassin -D and it should provide more information > when attempting to do DNS tests. > > Frederic Tarasevicius > Internet Information Serv

[SAtalk] tests performed

Hi Is there any way to check what test is spamassassin performing? It seems that some of them are not performed, specially those referring to what words are in a mail.   Thanks   Guillermo

Re: [SAtalk] Exim 4.22 and SA 2.55

On Tuesday, August 19, 2003, at 11:30 AM, Martin Bretschneider wrote: "Christopher M. Iarocci" <[EMAIL PROTECTED]> wrote: Hi Christopher, Anybody have Exim and SA running as a SPAM filtering/blocking gateway that would want to share their configs with me, and knowledge for that matter? I'm a qma

Re: [SAtalk] Exim 4.22 and SA 2.55

Or Exim with Sa-Exim exim.org sa-exim.sf.net On Tuesday, August 19, 2003, at 11:26 AM, Covington, Chris wrote: Why don't you consider Postfix and Amavisd-new, since you're switching to a new mailer anyway? http://www.geocities.com/scottlhenderson/spamfilter.html Chris -Original Message---

RE: [SAtalk] User who receives load of spam and blacklist_to

> -Original Message- > From: Paul Hutchings [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 19, 2003 9:54 AM > To: '[EMAIL PROTECTED]' > Subject: [SAtalk] User who receives load of spam and blacklist_to > > > One of our users has left and his account receives _loads_ of > spam, quite

Re: [SAtalk] Exim 4.22 and SA 2.55

"Christopher M. Iarocci" <[EMAIL PROTECTED]> wrote: Hi Christopher, > Anybody have Exim and SA running as a SPAM filtering/blocking gateway > that would want to share their configs with me, and knowledge for that > matter? I'm a qmail person myself, but this latest server I'm building > requires

Re: [SAtalk] DNS check doesn't work

Try running spamassassin -D and it should provide more information when attempting to do DNS tests. Frederic Tarasevicius Internet Information Services, Inc. http://www.i-is.com/ 810-794-4400 mailto:[EMAIL PROTECTED] - Original Message - From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>

[SAtalk] Re: Which ham to trian sa-learn

Yorkshire Dave <[EMAIL PROTECTED]> wrote: > I'd figure it's better to use your recent ham, the same as with spam, > that way your bayes database contains tokens from what's happening now > as opposed to what happened years ago. I understand feeding it the recent spam, but see no disadvantages (and

Re: [SAtalk] Useful reporting with SA

> All of the above features can be obtained by running the mass-check tool, > followed by the hit-frequencies tool. This will generate the exact same > report as the STATISTICS.txt file that comes with SA, but for YOUR corpus, > ruleset and scores. In fact, this is exactly how the SA developers do

[SAtalk] Bayes configured, not checking

I have a complete site running Spamassassin 2.55 . I have run >1000 spams and >1000 hams through sa-learn, and the database has been created in /root/.spamassassin. The local.cf includes a line "use_bayes 1" as well as a "auto_learn 1" line. If I run "spamassassin --lint -D" it shows that the tok

RE: [SAtalk] User who receives load of spam and blacklist_to

Thanks - I'm about to head off for the day, but I shall take a look on your emporium and see what I can do! regards, Paul -- Paul Hutchings Network Administrator, MIRA Ltd. Tel: 44 (0)24 7635 5378, Fax: 44 (0)24 7635 8378 mailto:[EMAIL PROTECTED] > -Original Message- > From: Chris Santerr

[SAtalk] [RD] Rule debugging trouble

I'm once again trying to debug some of my rules, and I'm having trouble with what *seems* to be a bug in the handling of some types of nested multipart MIME messages. A customer reported an untagged pornspam over the weekend. They forwarded the message as an attachment (attached), so I can see whi

Re: [SAtalk] DNS check doesn't work

On Tue, Aug 19, 2003 at 10:37:07AM -0400, [EMAIL PROTECTED] wrote: > i don't understand why the dns check doesn't work on my installation of SA... it > can't be due to the score because it is on by default, in the FAQ, i ve seen that SA > has 13 addresses and randomlly asks to 3 of them... i sear

[SAtalk] Women: Revolutionary Climax Product Will Astonish You (fwd)

Another got through: -- Forwarded message -- Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from localhost (localhost.localdomain [127.0.0.1]) by localhost.localdomain (Postfix) with ESMTP id A43606A711 for <[EMAIL PROTECTED]>; Tue, 19 Au

RE: [SAtalk] Exim 4.22 and SA 2.55

Why don't you consider Postfix and Amavisd-new, since you're switching to a new mailer anyway? http://www.geocities.com/scottlhenderson/spamfilter.html Chris -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Christopher M. Iarocci Sent: Tuesday, August 19,

Re: [SAtalk] Re: forged From: check?

alan premselaar wrote: > Bob Proulx wrote: > > I would rather do this all within SA, though, since that is > > already hooked into the mail flow. > > how do you have SA imeplemented at your site? this sounds like something > that's easily done with MIMEDefang (as a matter of fact, i have a routine

[SAtalk] DNS check doesn't work

Hello everybody i don't understand why the dns check doesn't work on my installation of SA... it can't be due to the score because it is on by default, in the FAQ, i ve seen that SA has 13 addresses and randomlly asks to 3 of them... i searched on the web and found no answer... i haven't ever s

[SAtalk] Exim 4.22 and SA 2.55

Anybody have Exim and SA running as a SPAM filtering/blocking gateway that would want to share their configs with me, and knowledge for that matter? I'm a qmail person myself, but this latest server I'm building requires blocking of email, not just filtering, and I was advised that EXIM was the rig

[SAtalk] FP - How did it get thru?

2 samples attached. 203.208.228.153 is one of my server ip which is not an open rely. Will my ip be blacklisted? How can i prevent this?  spam.zip Description: Zip compressed data

Re: [SAtalk] Blacklist To problem

At 09:07 AM 8/18/03 -0700, Patrick Morris wrote: > >This option no longer exists. I used to use it myself, but after it was >gone I realized it was a lot more efficient to stop them before they get >to SA (in my case, by having Sendmail reject mail to invalid accounts). Ok, did that, it works w

[SAtalk] User who receives load of spam and blacklist_to

One of our users has left and his account receives _loads_ of spam, quite a bit of which scores around 3-4 so slips under the 5 point threshold. Occasionally a work related email arrives, so we need to keep the account active a while longer. What I'd like to be able to do is to apply some sort

[SAtalk] Re: How To Change Recipient In User Unknown Message?

On 08/19/03 07:06 +0100, Yorkshire Dave wrote: > > There needs to be a page somewhere to explain why bouncing spam is > bad. Based on this thread and the reference to the notes on linux.org, I'm persuaded that attempting to bounce spam is not the right way to go about this and have amended my pr

[SAtalk] No AWL again

HI, attached to this message there are another two cases of no AWL adjustment in SA-2.60-CVS. But, again, if I run % check_whitelist |grep andrinileo I get -100.0(-100/1) -- [EMAIL PROTECTED]|ip=non. Same with check_whitelist |grep guillestiu: -100.0(-100/1) -- [EMAIL PROT

RE: [SAtalk] Rules

> -Original Message- > From: Alan Fullmer [mailto:[EMAIL PROTECTED] > Sent: Monday, August 18, 2003 10:46 PM > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: [SAtalk] Rules > > > Is there a good website / url someone could post that > describes how to write > rules for spam a

Re: [SAtalk] Which ham to trian sa-learn

On Tue, 2003-08-19 at 11:11, Martin Bretschneider wrote: > Hi Sa-users and devs again, > > I've got ham since 2000 in my archive containing > 1. personal emails from friends > 2. important mailings lists (university and so) > 3. not that important mailing list (GnuPG, OpenOffice.org, Sylpheed, > G

[SAtalk] Which ham to trian sa-learn

Hi Sa-users and devs again, I've got ham since 2000 in my archive containing 1. personal emails from friends 2. important mailings lists (university and so) 3. not that important mailing list (GnuPG, OpenOffice.org, Sylpheed, GNOME and so on) I have got spam of the last 3 months. Which ham should

[SAtalk] Site wide Bayes effectiveness with minimal training

Hi, Does anyone have any evidence (empircal or anecdotal) as to how well 2.5x fares against 2.4x using Bayes sitewide with minimal training (no more than SA does when autolearning)? It's my understanding (BICBW) that most of the PHRASE rules disappeared in 2.5x in favour of Bayes. Which is all w

[SAtalk] HEX IN URI and attachments

All, Is it safe to say that no legitimate email would try and hide a URI in the body of a message by using the hex equivalent of the link? It seems to me that is the case. if so, I would like to write a rule that detects the use of this tactic. Also, is it possible for SA to detect attachments?

RE: [SAtalk] sa-learn on mbox files exported from Exchange?

Thanks Martin - anyone have any thoughts on the matter (particularly the headers issue)? Proportionately the amount of spam that slips through it minute, so I'm really not sure if I should be running sa-learn on the few that do, or just put it down to the fact that something will always slip thr

Re: Re[2]: [SAtalk] Moved into the ex-ip of a spammer

Hi, Note: This is not precisely on-topic for SATalk though it hints that SPEWS is not the worst you may have to deal with. On Sun, 17 Aug 2003 18:49:06 -0700 Abigail Marshall <[EMAIL PROTECTED]> wrote: > YD> There are only 2 > YD> places in the whole world that get denied at the MTA here and SB

Re: [SAtalk] How To Change Recipient In User Unknown Message?

Hi, On 19 Aug 2003 07:06:46 +0100 Yorkshire Dave <[EMAIL PROTECTED]> wrote: > On Tue, 2003-08-19 at 03:39, John P Verel wrote: > > I've got my .procmailrc set up to generate an exit code 67 to bounce > > spam back to the sender. Problem is the user and domain are not what I > > want, which is [EM

Re: [SAtalk] Re: forged From: check?

On 8/19/03 1:51 PM, "Bob Proulx" <[EMAIL PROTECTED]> wrote: (B (B> Matt Kettler wrote: (B>> Bob Proulx wrote: (B>>> whitelist_from_rcvd [EMAIL PROTECTED] example.com (B>> (B>> whitelist_from_rcvd [EMAIL PROTECTED] mymachine.example.com (B>> (B>> where "mymachine.example.com" is some inte