[SAtalk] Re: Returned mail: "Zone rejected due to abuse." FORRIE.COM

2003-08-30 Thread Jack L. Stone
Forrier: What is this all about "Zone rejected due to abuse. What the h*** abuse are you talking about??? The email world is full of "madness" with block overkill at the moment. At 02:46 PM 8.30.2003 -0500, Mail Delivery Subsystem wrote: >The original message was received at Sat, 30 Aug 200

[SAtalk] Spamassassin in vhost env

2003-08-30 Thread Alexander Newald
Hello, I've running spamassassin for a long time now but I changed my mail system to a virtual email / userid mapping system. All mail for email adresses are stored on disk by a single userid (vhost). Virtual mail delivery is done by sendmail and procmail. Inside procmail the $LOGNAME matches the

Re: [SAtalk] hardware recomendations

2003-08-30 Thread Matt Kettler
At 01:57 PM 8/30/03 +, [EMAIL PROTECTED] wrote: Until it died of hardware failure, I had a P150 with qmail, spamc/spamd, and a lightly loaded Apache handling about 6K messages/day. CPU load was always in the .2-.3 range, except after an ISP outage where load was at 50 to 60 for over an hour. We

Re: [SAtalk] hardware recomendations

2003-08-30 Thread Thomas Cameron
- Original Message - From: "Jon Fraley" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, August 29, 2003 2:15 PM Subject: [SAtalk] hardware recomendations > I am planning on putting a Red Hat 9.0 box on our network to scan > incoming email using sendmail, spamass-milter and spam

Re: [SAtalk] OT: Weird logs from the mailing list....

2003-08-30 Thread Bart Schaefer
On Sat, 30 Aug 2003, Forrest Aldrich wrote: > OT question: I've recently been seeing these types of entries in my > mail log (sendmail 8.12.9+SA-2.55+SA-Milter) which I can't explain. The latest SourceForge user newsletter says: ... Now every email that is sent through our mail servers, eithe

Re: [SAtalk] OT: Weird logs from the mailing list....

2003-08-30 Thread Jack L. Stone
TopPost: I'm having the same problem with the same program combo was about to as the list as well... just pops up once in a while At 01:07 PM 8.30.2003 -0400, Forrest Aldrich wrote: >OT question: I've recently been seeing these types of entries in my mail >log (sendmail 8.12.9+SA-2.55+SA

[SAtalk] sa-learn

2003-08-30 Thread Thomas Reed
Greetings,   Im new to the SA system and have a question about sa-learn.  I have implemented SA at a site wide level and would like to set up 2 global mail folders, one for missed spam and one for misclassified spam, so users can move said messages to these folders.  Then I'd run a cron job a

[SAtalk] Yet another masking trick

2003-08-30 Thread Keith McDufffee
Has anyone seen this trick yet? Viewing Piulhix2k7f9z72orn from Work? Got any ideas for rules for that one? --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

[SAtalk] OT: Weird logs from the mailing list....

2003-08-30 Thread Forrest Aldrich
OT question: I've recently been seeing these types of entries in my mail log (sendmail 8.12.9+SA-2.55+SA-Milter) which I can't explain. It would seem that spamd is getting something confused when analyzing inbound messages from the spamassassin-talk list -- this isn't happening in any other

Re: [SAtalk] New test proposal

2003-08-30 Thread David Dyer-Bennet
Matt Kettler <[EMAIL PROTECTED]> writes: > At 05:31 PM 8/30/03 +0200, Kai Schaetzl wrote: > > >why? > > Can you name a single nonspam mail sender who doesn't have a Date: > header in the message when he delivers it to the MTA? A friend of mine is using some sort of MUA on her Mac systems that d

Re: [SAtalk] OSIRUSOFT

2003-08-30 Thread Bob Apthorpe
Hi, On 29 Aug 2003 19:15:15 +0100 Yorkshire Dave <[EMAIL PROTECTED]> wrote: > On Sat, 2003-08-30 at 04:57, Dragoncrest wrote: > > >Quite. They got pummelled to death by a DDoS. See: > > > > Yeah, stupid pathetic cowardly spammers (I can think of some much > > more colorful choice words

Re: [SAtalk] hardware recomendations

2003-08-30 Thread dsr
On Fri, Aug 29, 2003 at 04:45:33PM -0400, Matt Kettler wrote: > At 03:15 PM 8/29/2003 -0400, Jon Fraley wrote: > > It > >will probably handle 3k to 5k messages daily. Does anyone have a > >recommendations on hardware. I have an old Pentium 166 that I thought > >about using. > > A p-166 strikes m

Re: [SAtalk] New test proposal

2003-08-30 Thread Matt Kettler
At 05:31 PM 8/30/03 +0200, Kai Schaetzl wrote: why? Can you name a single nonspam mail sender who doesn't have a Date: header in the message when he delivers it to the MTA? No message-id is somewhat common for mass mailings (spam or nonspam) but I've never seen a nonspam that was also missing a

Re: [SAtalk] -d --lint scores ?

2003-08-30 Thread Matt Kettler
At 12:31 PM 8/30/03 +0200, Kai Schaetzl wrote: I'm talking of a specific message, the one you use for "spamassassin -D --lint" when I specify no message to process. I don't know how it looks like, so I don't know if it should score as ham or spam. But there apparently must be a message you use for

Re: [SAtalk] Bayes does work manually but not with spamc

2003-08-30 Thread Matt Kettler
Your problem is that when you execute spamc from exim, you are telling it to use a home directory of /tmp. This isn't likely the same home directory you have when you execute spamassassin manually. The bayes db is probably being yanked from /tmp/.spamassassin as a result, since ~/ is now /tmp/.

[SAtalk] Anybody has a working rule for the pic dot gif spam?

2003-08-30 Thread Amnon
Looks like this schem is now being used by different spammers, not just the porn industry. I am using 2.55 Shalom Ya'll Amnon Nissan Deltaforce 919-852-2121 http://www.deltaforce.net Host, Computers 2K3 on 850 The Buzz (AM 850) in Raleigh NC Sundays 8-10am http://www.850thebuzz.com/compute.ht

Re: [SAtalk] New test proposal

2003-08-30 Thread Kai Schaetzl
Carlo Wood wrote on Sat, 30 Aug 2003 13:44:07 +0200: > I think there should be a test on the latter header entry > that adds extra points. > why? Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com IE-Center: http://ie5.de & http://msie.w

[SAtalk] Address in subject line

2003-08-30 Thread Kenneth Porter
I see a lot of spam in which the first token on the subject line is something like "ken," or "shiva,", and I've never seen ham that does that. Are there any rules in 2.60 to catch that pattern, in which a token from the recipient address shows up as a greeting in the subject line? -

Re: [SAtalk] sa-learn: Does --forget ignore the headers? (Attempt 2)

2003-08-30 Thread Carlo Wood
On Sat, Aug 30, 2003 at 01:45:05PM +0200, Carlo Wood wrote: > > Question: Will the Basesian filters be correctly > > adjusted, despite the change of headers? I figured it out. The answer is yes. It only looks at the Message-Id. -- Carlo Wood <[EMAIL PROTECTED]> ---

[SAtalk] Remove line

2003-08-30 Thread Jack Gostl
On 2.55, I've had a bit more spam get through lately, nothing serious but a trend. It looks like there has been some creativity on the part of spammers for the "remove" line. The spams usually have scores in the 4 to 5 range. I'm thinking of raising the BAYES_90 score. Its seems a pretty good mar

[SAtalk] New test proposal

2003-08-30 Thread Carlo Wood
A spam sneeked through. It contained this in the header: Date: Sat, 30 Aug 2003 04:20:56 +0300 (IDT) Date-warning: Date header was inserted by mxout2.netvision.net.il I think there should be a test on the latter header entry that adds extra points. -- Carlo Wood <[EMAIL PROTECTED]> --

[SAtalk] sa-learn: Does --forget ignore the headers? (Attempt 2)

2003-08-30 Thread Carlo Wood
Can someone please answer this mail that I posted a few days ago? On Fri, Aug 29, 2003 at 01:00:45AM +0200, Carlo Wood wrote: > I have the following setup: > > 1) Firewall receives mail, pipes it through >spamd and adds a header marking it as >spam. > 2) Firewall sends the mail through to

[SAtalk] Bayes does work manually but not with spamc

2003-08-30 Thread Martin Bretschneider
Hi SA-devs and user, I guess I figured out why Bayes do not work here on my system (Debian Unstable) with Exim 3-36 and SA 2.55. If I feed spamasssassin directly from the shell of my user account it uses Bayes but not in the chain fetchmail->exim->SA->exim->/var/spool/mail. Where ist he problem?

Re: [SAtalk] -d --lint scores ?

2003-08-30 Thread Kai Schaetzl
Matt Kettler wrote on Sat, 30 Aug 2003 00:11:35 -0400: > Well, a "ideal" bayes database training will always give you 0 for ham, and > 100 for spam. > I'm talking of a specific message, the one you use for "spamassassin -D --lint" when I specify no message to process. I don't know how it looks

[SAtalk] Spam discussion board

2003-08-30 Thread Andre Eisenbach
Hello SpamAssassins! I've recently installed SpamAssassin on my small server and must say I'm pretty much amazed so far! It works really well! Because of some hardware limitations I still use some DNSBL to keep SA's CPU usage down, but the combination works really well. During the installation I

[SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-30 Thread Malte S. Stretz
On Saturday 30 August 2003 06:05 CET Chris Barnes wrote: > I've got 2.60 installed from the cvs, but a version prior to rc1. I've > held off ungrading for now for 2 reasons: > > 1) the version I have seems to be working just fine > 2) the rc versions seem to have some bugs (to be expected - that's

Re: [SAtalk] internal domain mail getting blocked

2003-08-30 Thread Jari Fredriksson
Robin Witkop-Staub wrote: > I have instances where users try to email me a block of messages they > want blacklisted. The spam filter will see them all and tag the > message as SPAM. Is there a way I can tell spamassassin not to mark > internal mail as spam or make a filter giving internal users +

Re: [SAtalk] -d --lint scores ?

2003-08-30 Thread Matt Kettler
At 12:11 AM 8/30/2003 +0200, Kai Schaetzl wrote: I noted that I get quite different scores for spamassassin -D --lint on different machines depending on Bayes. On one system I get BAYES_10 (a well trained system with lots of mail in the db), on another system I get BAYES_70 (with only a few hundred

[SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-30 Thread Chris Barnes
I've got 2.60 installed from the cvs, but a version prior to rc1. I've held off ungrading for now for 2 reasons: 1) the version I have seems to be working just fine 2) the rc versions seem to have some bugs (to be expected - that's why they are "rc"). My question is, when the final release comes

[SAtalk] SA Proxy-SERVER (Not Desktop)

2003-08-30 Thread Natko Katicic
Hello All! I have a Linux Server Online and as a courtesy service to my friends and relatives I would like to offer spam filtering with SA. I wasn't able to find any hints in the docs or archives about setting a SA Server up without local mailboxes (i.e. as a proxy). Instead of polling the mailb

[SAtalk] Re: SpamAssassin 2.60 rc3 - lots of misses by SA

2003-08-30 Thread jpf
if you are running on an ISP which throttles your memory/CPU usage, sometimes SA will get killed...the complete lack of SA headers in your mail suggests this might be the case...here is a snippet from my .procmailrc which runs SA a second time if it didn't fire or got killed the first, very very ra

[SAtalk] Changing Bayes scoring

2003-08-30 Thread Sam C. Nicholson !!
Greetings, I'd like to increase the score for certain bayes confidence levels. My understanding is that I need to put one (or more) of these lines from /usr/locals/hare/spamassassin/23_bayes.cf: body BAYES_60 eval:check_bayes('0.60', '0.70') body BAYES_70 ev

Re: [SAtalk] DNS Timeout Issues

2003-08-30 Thread David Birnbaum
On Fri, 29 Aug 2003, Simon Byrnand wrote: > Generally the situation for us anyway is that we have fast DNS available > but individual blacklists may stop replying as osirusoft did... its not > common for the response time of all lists to be slow at once, so it looks > like the above scheme may wor

Re: [SAtalk] defining the min/max score per test

2003-08-30 Thread Tim B
Mark C wrote: Hi, I have spamassassin installed on my debian woody e-mail server, out of the box it works generally ok, except for a few false alerts, which is why this mail comes in, I wish to allow each use to setup their own user_prefs file, I have sucsessfully implimented this, but I'm having

Re: [SAtalk] Changing Bayes scoring

2003-08-30 Thread Jon Gabrielson
Is there a way to change this behavior? It seems to me that a high bayes score also shows that it is spam and it might be possible to grab a few new tokens from the spam which you otherwise wouldn't get. Jon. On Friday 29 August 2003 12:22 pm, Tom Meunier wrote: > Somebody already answered the s

[SAtalk] preventing blacklistes messages from impacting bayesian learning?

2003-08-30 Thread Britton
I want to blacklist debian-user, cause I get it in digest form, only I accidently sucscribed to the non-digest form and for some bloody reason can't get it to stop coming. Only I don't want the blacklisting to affect my bayesian knowledge base. Is there a way to do that, or do blacklists and whi

Re: [SAtalk] spamd & user_prefs

2003-08-30 Thread Louis LeBlanc
On 08/29/03 09:21 PM, Larry Gilson sat at the `puter and typed: > Hey Louis, > > Please forgive this reply. Your messages keep getting wrapped in a > text file as it comes through with an unknown content-type: > > Content-Type: text/plain; charset=unknown-8bit Sorry about that. Thanks for givi

RE: [SAtalk] spamd & user_prefs

2003-08-30 Thread Larry Gilson
Hey Louis, Please forgive this reply. Your messages keep getting wrapped in a text file as it comes through with an unknown content-type: Content-Type: text/plain; charset=unknown-8bit I did read the message even though it is not included here. So if I understand correctly, what you really wan

Re: [SAtalk] Wrong score for Message-ID

2003-08-30 Thread Justin Mason
Carlo Wood writes: >This message ID gets *severely* punished... >perhaps a bit TOO much. > >Message-Id: <[EMAIL PROTECTED]> > >MSGID_SPAMSIGN_ZEROES (4.3 points) Message-Id generated by spam tool (zeroes variant) >MSGID_OE_SPAM_4ZERO (4.3 points) Message-Id generated by spam tool (4-zeroes varia

Re: [SAtalk] report_safe_copy_headers still broken in RC3.

2003-08-30 Thread Larry Rosenman
Gak. I didn't realize y'all had changed things to **NOT** read /etc/mail/spamaassin/* for config files. When I symlink /usr/local/etc/mail/spamassassin/local.cf to /etc/mail/spamassassin/local.cf it works as advertised. PLEASE revert whatever change was made to NOT read /etc/mail/spamassassin

[SAtalk] PREFIX and SYSCONFDIR (was: SpamAssassin 2.60 rc3 released)

2003-08-30 Thread Malte S. Stretz
On Saturday 30 August 2003 00:31 CET Kai Schaetzl wrote: > Malte S. Stretz wrote on Fri, 29 Aug 2003 23:42:15 +0200: > > What does perl -V:prefix say? > > /usr > > So, this is dependant on the perl PREFIX path? That explains why others > get a different path although they don't use a specific PREFI

[SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-30 Thread Malte S. Stretz
On Saturday 30 August 2003 00:16 CET Simon Byrnand wrote: > > I don't like that behaviour, too, and will see what I can do about it > > Malte > > All I was attempting to do with the \n's was to change the X-Spam-Status > header to look like 2.55's - where there is a (folded) newline between > "requ

[SAtalk] Re: SpamAssassin 2.60 rc3 released

2003-08-30 Thread Malte S. Stretz
On Saturday 30 August 2003 01:19 CET Lucas Albers wrote: > I'm curious to know what sort of performance increase you should see > because of this. Using an network protocol (TCP) for communications on one machine generates quite some overhead. UNIX sockets don't have this overhead and are thus b

Re: [SAtalk] Wrong score for Message-ID

2003-08-30 Thread David Dyer-Bennet
Carlo Wood <[EMAIL PROTECTED]> writes: > This message ID gets *severely* punished... > perhaps a bit TOO much. > > Message-Id: <[EMAIL PROTECTED]> > > MSGID_SPAMSIGN_ZEROES (4.3 points) Message-Id generated by spam tool (zeroes > variant) > MSGID_OE_SPAM_4ZERO (4.3 points) Message-Id generate

Re: [SAtalk] Turning on Bayes

2003-08-30 Thread David Dyer-Bennet
Matt Kettler <[EMAIL PROTECTED]> writes on 29 August 2003 at 18:37:38 -0400 > At 03:13 PM 8/29/2003 -0500, David Dyer-Bennet wrote: > > >I notice that there are different scores for tests depending on "how" > >spamassassin is running, and that one of the differences is whether > >Bayes filter

[SAtalk] RE: Message-ID and Received Lines

2003-08-30 Thread Larry Gilson
Hi Martin, > -Original Message- > From: Martin Radford > At Fri Aug 29 20:36:31 2003, Larry Gilson wrote: > > > > Hi Carlo and Martin, > > > > I was wondering I could ask a huge favor of you both. Could you > > search your spam and ham history to see if there is a good > > correlatio