[EMAIL PROTECTED] writes:
> as to routing them somewhere else...
> does SA have a custom header even possible?
> cos the only way i can think of tossing them into another bucket would
> be to run a series of regexs in a filter to toss them elsewhere
simple: if X-Spam-Status contains VBOUNCE, mov
On Wed, 2003-08-20 at 18:51, Kai MacTane wrote:
> At 8/20/03 09:46 AM , Yorkshire Dave wrote:
>
> >If someone instructed me to /dev/null anything marked as spam, and all
> >attempts to explain why that was bad had failed, i think a deliberate
> >typo would see it all piling up in a mailbox called
I use it with Kmail 1.5 without spamd. I guess Kmail must slow it up by
piping each message in sequence through spamassassin.
I did not see where (per --help) Spamassassin by itself appeared to read an
entire Mbox and perform parallel lookups, writing results out to a new mbox.
I've tried va
Hi all,
I wanted to upgrade to 2.55 and ran into the following problem:
compiling works fine, but when the tests are executed (make test)
the machine just silently crashes completely up to the point where even
Ctrl-Alt-Delete does not work any more.
This happens as soon as the tests for spamd ar
Hello,
I have the following router in my exim 4.22 configuration file:
spamcheck_router:
no_verify
domains = ! +local_domains
condition = "${if and { {!def:h_X-Spam-Flag:} \
{!eq {$received_protocol}{spam-scanned}}} {1}{0}}"
driver = accept
transport = spamchec
Well, depending on your setup...
What we do is use an IMAP server, but the vast majority of our users are
POP3. So, anybody who wants auto deletion or server side filtering gets
some mojo applied to their account, so that tagged spam winds up in the IMAP
trash folder. Everything in that folder g
jeff covey writes:
> when i pipe a message to "sa-learn --single --spam", i'm suddenly
> getting:
>
> Cannot open bayes_path /home/jeff/.spamassassin/bayes R/O: Inappropriate ioctl for
> device
> Cannot open bayes_path /home/jeff/.spamassassin/bayes R/W: File exists
> Learned from 0 messages.
>
Reading the documentation for sa-learn I don't see how to tell it to use
the site-wide databases in stead of the per-user db. How do I use
site-wide bayes db?
Thanks
Jefferson Cowart
[EMAIL PROTECTED]
---
This SF.net email is
On Wed, 2003-08-20 at 20:28, Justin Mason wrote:
> So I'm being driven nuts by AV software which mails "your message contains
> a virus" notifications even when the virus is known to forge From addrs.
>
> Since they're not really anti-spam rules -- SpamAssassin's raison d'etre
> -- I don't think t
At 01:02 PM 8.20.2003 -0400, Chris Santerre wrote:
>
>
>> -Original Message-
>> From: AltGrendel [mailto:[EMAIL PROTECTED]
>> Sent: Wednesday, August 20, 2003 12:01 PM
>> To: SA-Talk
>> Subject: Re: [SAtalk] Configure to delete messages
>>
>>
>> On Wed, 2003-08-20 at 11:24, Daniel Kaliel
Hello everyone,
I've been using SA for at least a year or two now and love it! We
combine it with MailScanner with ClamAV and out of 20,000 emails per
week receive no viruses and block out around 4,000 pieces of
spam.and really only about 100 pieces of spam slip through the
cracks. I think t
Well I got spamass-milter installed and when I send the test mail outlined in
the activation.txt file, my root user gets the messages and they are properly
marked, but when I set up my forwarding to my exchange box, none of the mail
that gets forwarded to my exchange box gets caught as spam. I even
Glen Stewart writes:
> I use it with Kmail 1.5 without spamd. I guess Kmail must slow it up by
> piping each message in sequence through spamassassin.
>
> I did not see where (per --help) Spamassassin by itself appeared to read an
> entire Mbox and perform parallel lookups, writing results o
At 10:51 AM 8/20/2003 -0700, you wrote:
Ooh... I like the "typo" solution. Keep in mind, of course, that it's
possible that the only way to get them to realize they've made a mistake is
to *show them* the contents of .dev.null. (Especially if you've set up your
filtering criteria such that they
Chris Santerre writes:
> What do you guys think of this simple header line:
>
> Received: from Evan ([81.68.237.96])
>
> Shouldn't there be a .com, .net, .biz, etc.. after the Evan all the time? I
> know most of us will have something like this:
It's the HELO term used, and yes a one-word HELO
You need to run spamd with (I believe) -x as an argument. And make sure
your datasource info is in the local.cf file.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Eric
Ochoa
Sent: Wednesday, August 20, 2003 2:42 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk]
On Wed, Aug 20, 2003 at 12:36:54PM -0700, Erick Calder is rumored to have said:
>
> the complaints are legit so SA and even the Bayesian filter let them
> through... any suggestions out there? what are others doing about this?
Grin and bear it. Not much else you can do.
--
"The concept is inte
So I'm being driven nuts by AV software which mails "your message contains
a virus" notifications even when the virus is known to forge From addrs.
Since they're not really anti-spam rules -- SpamAssassin's raison d'etre
-- I don't think they're appropriate for the distribution. But a
page on the
COuld it possible be the double base64 text trick again? Those tend to be
goofy. I don't quite understand the darn trick myself. No one has posted a
very good explanation yet. Does this spam hit the BASE64_ENC_TEXT rule?
--Chris
> -Original Message-
> From: John McGivern [mailto:[EMAIL PR
I'm getting a bunch of mails from MAILER-DAEMONs around the world
complaining mostly that [EMAIL PROTECTED] does not exist.
these are generated by dictionary spammers who are using my e-mail address
for the reply-to header.
the complaints are legit so SA and even the Bayesian filter let them
throu
when i pipe a message to "sa-learn --single --spam", i'm suddenly
getting:
Cannot open bayes_path /home/jeff/.spamassassin/bayes R/O: Inappropriate ioctl for
device
Cannot open bayes_path /home/jeff/.spamassassin/bayes R/W: File exists
Learned from 0 messages.
Cannot open bayes_path /home/jeff/.s
> On Wed, 2003-08-20 at 16:24, Daniel Kaliel wrote:
>> I have been trying to find documentation on how to do this, but have
>> not found any. I spoke with the partnership of my company on this and
>> how it is safer not to, instead filtering email on there email client,
>> however, they have decid
> -Original Message-
> From: AltGrendel [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, August 20, 2003 12:01 PM
> To: SA-Talk
> Subject: Re: [SAtalk] Configure to delete messages
>
>
> On Wed, 2003-08-20 at 11:24, Daniel Kaliel wrote:
> > I have been trying to find documentation on how to
--On Wednesday, August 20, 2003 1:04 PM -0400 [EMAIL PROTECTED] wrote:
> does anyone know spam sender "[EMAIL PROTECTED]"?
Yeah, my buddy Jim! What's he doing sending out spam??
Care to expand some more on this? Anonymizer is a well known software app
that allows you to browse without other si
Hiya
I’ve configured spamc to
use a host that resolves to 2 addresses, and I’m seeing something odd
when the spamd server at the first address isn’t
running.
I twiddled with libspamc.c and
defined DO_CONNECT_DEBUG_SYSLOGS, and have recorded the following:
Aug 20 18:24:16 horus2
At 8/20/03 09:46 AM , Yorkshire Dave wrote:
If someone instructed me to /dev/null anything marked as spam, and all
attempts to explain why that was bad had failed, i think a deliberate
typo would see it all piling up in a mailbox called .dev.null ready for
when they realise they made a mistake :)
At 8/20/03 09:28 AM , Sandy S wrote:
I'm no expert so I may be off-base here, but shouldn't the rule have ()?
body RULE_NAME /(bannedc|banned c)/i
I think that without them you're scanning for one of the following strings:
"bannedcanned c" or "bannedbanned c".
And personally, I'd just do:
body RULE
I've searched through the lists and haven't found enough information to go
about this on my own so here goes: I have successfully installed SA+Razor
sitewide, I use qmail. I have a MySQL database running and the SASQL
plugin for SquirrelMail is installed and it works ok. Problem is, even
with al
On Wed, 2003-08-20 at 16:57, Christopher X. Candreva wrote:
> On Wed, 20 Aug 2003, Jim wrote:
>
> > I've been getting these once in a while, they just seem to have random
> > words in them.. no sales pitch that I can see. And they are always
> > different sets of words.
>
> Either you are using
At 8/20/03 07:27 AM , Keith Olmstead wrote:
I tag the spam from SA and move it to another partition, so another pop
process can check just the spam. It delivers fine to that partition, but
it is not creating the dir as needed. It is suppose to create dirs under
as follows:
$home/Maildir/
It
/pic.gif/i does not match "pic.gif"
Try /pic\.gif/i
-Matt Thomas
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On
> Behalf Of Amnon
> Sent: Wednesday, August 20, 2003 9:17 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] Scanning for an attachment file name
>
does anyone know spam sender "[EMAIL PROTECTED]"?
---
This SF.net email is sponsored by Dice.com.
Did you know that Dice has over 25,000 tech jobs available today? From
careers in IT to Engineering to Tech Sales, Dice has tech jobs from the
best
I had a couple of users ask me today if there was a change to
our mail config, as the number of spams they received had dropped off
considerably. I personally didn't notice much (750+ spams since Sunday), but I'm
wondering if anyone else has noticed anything.Perhaps the worms going
around ha
I'm no expert so I may be off-base here, but shouldn't the rule have ()?
body RULE_NAME /(bannedc|banned c)/i
I think that without them you're scanning for one of the following strings:
"bannedcanned c" or "bannedbanned c".
Sandy
- Original Message -
From: "John McGivern" <[EMAIL PROTECT
I'm considering exporting all my spam to a txt file, and then feeding it
to spam assassin, but I'm not sure how.
I'm also tempted to do the same with the mails that are getting spam
points, but are not quite marked as spam.
(I know how to export stuff to a txt file, I was just wondering if it's
a
It depends how you have SA set up, and what calls it. SpamAssassin will
not ever delete mails -- it just tags them.
Daniel Kaliel wrote:
I have been trying to find documentation on how to do this, but have
not found any. I spoke with the partnership of my company on this and
how it is safer
On Wed, 2003-08-20 at 16:24, Daniel Kaliel wrote:
> I have been trying to find documentation on how to do this, but have
> not found any. I spoke with the partnership of my company on this and
> how it is safer not to, instead filtering email on there email client,
> however, they have decided to
Maybe it's the image of a sales pitch for Viagra that they're trying to
sell.
The words, I'd assume, are there to confuzzle a bayesian filter.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Jim
Sent: Wednesday, August 20, 2003 11:07 AM
To: [EMAIL PROTECTED]
Hi,
On Wed, 20 Aug 2003 15:07:00 + Jim <[EMAIL PROTECTED]> wrote:
> I've been getting these once in a while, they just seem to have random
> words in them.. no sales pitch that I can see. And they are always
> different sets of words.
This is an attempt to defeat bayesian classifiers.
> I
On Wed, 20 Aug 2003, Jim wrote:
> I've been getting these once in a while, they just seem to have random
> words in them.. no sales pitch that I can see. And they are always
> different sets of words.
The random words are meant as a Bayes-buster. If you look at the raw HTML
content, you'll see
I am looking for documentation on how to configure
Spamassassin to delete all messages marked as spam instead of the header
change. I spoke to the partners in company on the risk of doing this,
however they have decided to go in that direction. Can someone point me to
where I can find out
On Wed, Aug 20, 2003 at 08:29:53AM -0700, Patrick Morris wrote:
> Maybe the big image with a Viagra ad in the middle of it has something
> to do with it. :)
Doh! Of course you're right.
In my defense, I had looked at the HTML briefly and didn't notice the link,
and opened it in a browser (Galeo
What am I doing wrong? I added a rule:
body PIC_GIF/pic.gif/i
describe PIC_GIFPIC_GIF
score PIC_GIF 9.0
The message source is below. The string pic.gif apears four different time in
it. Why doesn't SA sees it?
---
Recei
On 19 Aug 2003 09:40:20 -0700 "Richard M. Myers" <[EMAIL PROTECTED]> wrote:
> Spamassassin attaches "X-Spam-Report: This mail is probably spam." to
> ALL emails it processes REGARDLESS of whether it deems them actual spam
> in the end.
Which version? How do you have it installed (individual or
On Tue, 19 Aug 2003 23:41:39 -0400 Glen Stewart <[EMAIL PROTECTED]> wrote:
> The serial execution of queries and response-waiting really slows
> SpamAssassin down. Can it be threaded so all the messages are loaded
> and queries in parallel?
Patches to perl to provide a robust threading model a
On Wed, 2003-08-20 at 11:24, Daniel Kaliel wrote:
> I have been trying to find documentation on how to do this, but have
> not found any. I spoke with the partnership of my company on this and
> how it is safer not to, instead filtering email on there email client,
> however, they have decided to
On Wed, 20 Aug 2003, Jim wrote:
> I've been getting these once in a while, they just seem to have random
> words in them.. no sales pitch that I can see. And they are always
> different sets of words.
Either you are using a text mail client, or have images turned off. not a
band thing ! The add
On Mon, 2003-08-18 at 20:02, Justin Mason wrote:
> Yorkshire Dave writes:
> > As long as it's worth blocking on it, I'll keep working at ciphers. If
> > all the spammers start using real encryption I'll look for another way.
> > I'm just taking advantage of a stupid subset of spammers while I can.
Well, I'm running off RH 8.0...so I know I've read issues before with UTF
and not having LANG=en_US, but I've never encountered any problems before
with spamd . My standard environment right now is LANG=en_US.UTF-8
Would it be best with this setup to switch to a regular en_US?
...ken
-
On Wed, 2003-08-20 at 15:15, Chris Santerre wrote:
> What do you guys think of this simple header line:
>
> Received: from Evan ([81.68.237.96])
>
> Shouldn't there be a .com, .net, .biz, etc.. after the Evan all the time? I
> know most of us will have something like this:
I've seen a fair amou
I have been trying to find documentation on how to
do this, but have not found any. I spoke with the partnership of my
company on this and how it is safer not to, instead filtering email on there
email client, however, they have decided to have all SPAM immediately
deleted. So if anyone kn
Maybe the big image with a Viagra ad in the middle of it has something
to do with it. :)
Jim wrote:
I've been getting these once in a while, they just seem to have random
words in them.. no sales pitch that I can see. And they are always
different sets of words.
I made a few tiny edits to obfus
I've been getting these once in a while, they just seem to have random
words in them.. no sales pitch that I can see. And they are always
different sets of words.
I made a few tiny edits to obfuscate the recipient, but other than that
it's intact.
Is it some kind of probe?
--- Begin Message ---
"Chad Leigh -- Shire.Net LLC" wrote:
> We send all email through spamassassin but do no actual filtering. ALL
> email is passed to the customer so that they can process the SA flags
> themselves if they choose to.
This is how I set up our domain hosting server; but because domain
email accounts
On 08/19/03 20:54 -0700, Mustafa Kapasi wrote:
Have you examined /var/log/maillog?
John
---
This SF.net email is sponsored by Dice.com.
Did you know that Dice has over 25,000 tech jobs available today? From
careers in IT to Engineering to Tech
Ken Gordon wrote:
[spams snipped]
I've had customers report a few of these; SA seems to ignore the actual
message body; and therefore a long list of tests which would otherwise
trigger (and push such messages to 5.5-6 with default rules, and
probably over 10 with some of the custom rules I've wr
Hello,
I am neeing some help. I am trying to get SA to correctly deliver and create dirs in
MailDir format. What is happening is, the spam is getting tagged and delivered like I
want it too, but it does not seem to be creating the dir like it is suppose to. Does
anyone know why this happenin
> > Hope someone can help me to fix the prob :-)
>
> If you run the two message through spamassassin manually, does it detect
> them both? If so, it's an Exim problem.
>
Hi,
hm, how can I test a mail with attachment ? The pure text I scanned with
spamassassin -t < spam.txt | less
but how can I
> -Original Message-
> From: Ken Winke [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, August 19, 2003 7:52 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] Useful reporting with SA
>
>
> Okay...we're making good baby steps here.
>
> I believe I've got mass-check to work on my
> corpuses
> > [EMAIL PROTECTED]
> >
> > I can't see any diffrence but the mail is not marked as ***SPAM***
> >
> > Hope someone can help me to fix the prob :-)
>
> I suspect that your attachment is making the email larger than the maximum
> size message SA will scan. Try setting the maximum size larger.
I'm just curious as to something that was hinted on before. Will future SA
versions allow users to write other evaltest files like .cf files now? Will
there be a way to test them like --lint'ing rules now? (I'm guessing no, you
would have to feed the test with STDIN and STDOUT.) I like the idea of
"Fred I-IS.COM" wrote:
> Can anyone provide a policy for an ISPs' use of Spam Assassin to
> filter customers e-mail?
Make it opt-in: the customer MUST take some sort of specific action in
order to have SA filter their mail.
In our case, the customer actually signs up for an added-value
mail-filt
What do you guys think of this simple header line:
Received: from Evan ([81.68.237.96])
Shouldn't there be a .com, .net, .biz, etc.. after the Evan all the time? I
know most of us will have something like this:
Received: (from [EMAIL PROTECTED])
But that is enclosed in paran's. I'm pretty sure
> -Original Message-
> From: Robert Menschel [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, August 20, 2003 12:37 AM
> To: [EMAIL PROTECTED]
> Subject: [SAtalk] mass-check and user_prefs
>
>
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> After several months of developing rules an
Kris Deugau wrote:
> I'm once again trying to debug some of my rules, and I'm having trouble
> with what *seems* to be a bug in the handling of some types of nested
> multipart MIME messages.
Just to add to the confusion, I've just noticed that the message
received at the support address I answer
Bill,
I've just started using spamassassin on my mail server. What
seems to be the consensus as to a good nominal size to set the maximum size
to be? I realize a lot of this depends on the system it's running on, but
maybe a ball park figure?
Thanks,
Mark
At 08:02 AM 8/20/2003 -0400,
> -Original Message-
> From: Chris Trudeau-Personal [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, August 19, 2003 9:29 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [SAtalk] HEX IN URI and attachments
>
>
> Hey all...I'm really interested...I was unable to find other
> references...so
> pleas
Good Morning!
For some reason, Bayes does not appear to be functioning on our
site-wide SA box. `spamassassin -D --lint` complained that it could not
open the files so I ran `sa-learn -rebuild`. Now it sees the files but
after two weeks it still claims that there is no information...
debug: ba
Hey everyone! Thanks for all the responses! I was out of the office yesterday.
I do have the /i at the end of my rule so it looks like this:
body RULE_NAME /bannedc|banned c/i
so that I could catch the case as well.
I know that phrase is in there obviously but it just won't find it! When I
Chris,
i was about to throw my hands upin frustration...
I think this is it. I have raw mbox mail that spawned the thought, so I'll
test the meta comparison and let you know!
thanks!!!
CT
- Original Message -
From: "Chris Santerre" <[EMAIL PROTECTED]>
To: "'Chris Trudeau-Personal
> >>this latest server I'm building
> >>requires blocking of email, not just filtering
> >
> >I used [1] for exim3 but there is also a help for exim4 [2].
> >
> >[1] http://dman.ddts.net/~dman/config_docs/exim3_spamassassin.html
> >[2] http://dman.ddts.net/~dman/config_docs/exim4_spamassassin.htm
> [EMAIL PROTECTED]
>
> I can't see any diffrence but the mail is not marked as ***SPAM***
>
> Hope someone can help me to fix the prob :-)
I suspect that your attachment is making the email larger than the maximum
size message SA will scan. Try setting the maximum size larger. If I
understand c
At 17:20 19/08/2003 -0400, Fred I-IS.COM wrote:
Wow, that was a 5 hour delay from when I sent that message.
Only 5 hours ? Thats pretty good for this list, sometimes I don't see my
own posts the same day :)
(And no, I'm only slightly exagerating..)
Regards,
Simon
On Wed, Aug 20, 2003 at 11:25:59AM +0200, Jens Strohschnitter wrote:
> Hope someone can help me to fix the prob :-)
If you run the two message through spamassassin manually, does it detect
them both? If so, it's an Exim problem.
--
Randomly Generated Tagline:
"Shell programming can be a difficu
Hi
I've integrated the Spam-blocker "SpamAssassin" into Exim 4.20 and
it works fine. But mails that have files attached will be scanned
but not recognized as spam.
A testmail that is recognized as spam is detected as spam, but the
same mail, that has an attachment is not recognized as spam.
In the
Hi,
On Tue, 19 Aug 2003 21:34:38 +0200 Luis Muñiz <[EMAIL PROTECTED]> wrote:
> I've just setup (not system-wide[1]) Mail-SpamAssassin-2.55. My
> problem is that every time a mail is received, procmail' log shows
> the following:
>
> Can't locate HTML/Parser.pm in @INC (@INC contains: ...
I use sendmail and spamd on RH Linux 8.0, Perl 5.6
Spamd starts prior to sendmail.
Services Start properly.
Server is in DMZ behind a firewall.
This server forwards emails to an internal server.
my users have been getting spam even after installing spamd.
want to know if spamd is really working in
Spamassassin attaches "X-Spam-Report: This mail is probably spam." to
ALL emails it processes REGARDLESS of whether it deems them actual spam
in the end.
Is there any way to turn off this behavior? Does anyone know a good
reason why Spamassassin should operate this way?
I would think that
landy wrote:
> sorry if i was not clear before but someone put my address as from and
> send out a spam
>
>
> what can i do to aovid being tagged as a spammer
Do nothing.
No one (hopefully) tags anyone because of email-address.
SpamAssassin certainly does not.
The serial execution of queries and response-waiting really slows
SpamAssassin down. Can it be threaded so all the messages are loaded
and queries in parallel?
---
This SF.net email is sponsored by Dice.com.
Did you know that Dice has over 2
> sorry if i was not clear before but someone put my address as from and
> send out a spam
>
>
> what can i do to aovid being tagged as a spammer
>
> Return-Path: <[EMAIL PROTECTED]>
> Received: from DJH4R401 ([63.237.164.221]) by mx4.centurytel.net
> (8.12.9/8.12.9) with ESMTP id h7JKXujM080317
At 10:37 AM 8/19/2003 -0400, [EMAIL PROTECTED] wrote:
Hello everybody
i don't understand why the dns check doesn't work on my installation of
SA... it can't be due to the score because it is on by default, in the
FAQ, i ve seen that SA has 13 addresses and randomlly asks to 3 of them...
i searc
- Original Message -
From: "Mike Carlson" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, August 19, 2003 7:26 PM
Subject: [SAtalk] FreeBSD + Sendmail
> Is there a howto out there for getting SpamAssassin setup with FreebSD 4.7
> and Sendmail?
>
> I got Sendmail, Procmail and
Okay...we're making good baby steps here.
I believe I've got mass-check to work on my corpuses...creating two log
files of spam.log and ham.log.
When I run those through hit-frequence, it does generate a giant table of
info for me, but I can't seem to get any of the results that are created
like
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
After several months of developing rules and testing them with regex
searches within my email client, I'm thinking it's time for me to
actually begin using mass-check to test new rules.
Challenge: I'm a domain master on a shared domain server, and don
At 11:02 AM 8/19/2003 -0400, Tim wrote:
Another got through:
First, you're using an old devel version that was a CVS snapshot from
mid-June. You need to understand that CVS versions are constantly changing,
and may not work always work 100% correctly. In particular, it's not
uncommon for the ru
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello Tim,
Tuesday, August 19, 2003, 8:02:16 AM, you wrote:
T> Another got through:
Interesting. When I run your email as is through my SA, it also sneaks
through, scoring 4.5 of 9.
However, while building rules to detect this specific spam, scann
87 matches
Mail list logo
