Re[2]: [SAtalk] Has anyone written rules for Sobig:F

2003-09-13 Thread Abigail Marshall
KK> There is currently no mechanism at all KK> that is part of the Internet which can lock out machines that KK> are dangerous or detrimental to the functions of the network. KK> There are no processes in place that identify users of infected KK> systems and keep them off the network. Actually, t

RE: [SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Bill Polhemus
Sorry, doesn't seem to work. I'm using SA 2.55, if that makes a difference. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jim Sent: Saturday, September 13, 2003 12:41 PM To: [EM

Re: [SAtalk] Skipping RBL checks for authenticated connections

2003-09-13 Thread Daniel Quinlan
"Christopher X. Candreva" <[EMAIL PROTECTED]> writes: > Before I submit a bug report on this I wanted to check my understanding. > > If I get what's going on, RBL checks such as NJABL_DIALUP and DYNABLOCK > are checked, and weigh in heavily when they are the last hop before local > machines, so

Re: [SAtalk] Installing Spam Assassin for site-wide handling

2003-09-13 Thread Kristian Koehntopp
On Sun, Sep 14, 2003 at 11:22:35AM +1000, Terry Allen wrote: > 1 Is it possible to install Spam Assassin for filtering & deleting > the spam without altering the existing sendmail configuration? Yes, there is. If your machine is already using procmail as the mailer for local delivery, it is enou

[SAtalk] Re: [SAtalk] Can´t learn spam mails with sa-learn

2003-09-13 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Bernd, Saturday, September 13, 2003, 5:34:11 PM, you wrote: BK> since I am not the only having this problem according to some other BK> newsgroup I would like to ask why the Bayes filter does not help. I'm not one of the most technically advan

Re: [SAtalk] Annouce: More rules for SA (Brazilian)

2003-09-13 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Daniel, Would you have any objection if we added your link to the "Other rules sites" section of http://www.exit0.us/ ? Bob Menschel Friday, September 12, 2003, 11:36:29 PM, you wrote: DL> Guys, DL> FYI, I've released a bunch of rules to de

Re: [SAtalk] a little newbie question

2003-09-13 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Sérgio, Saturday, September 13, 2003, 2:17:11 PM, you wrote: SMB> Hi SMB> Is it possible spamassassin eats an email or for sure just tag SMB> email ? I've never had SpamAssassin eat any email. SpamAssassin has no code within it to delete or dr

Solved: [SAtalk] Error from dcc-1.2.6

2003-09-13 Thread Steven W. Orr
On Saturday, Sep 13th 2003 at 22:39 -0400, quoth Steven W. Orr: =>I upgraded and now I have the following error message on every mail =>message: => =>dccproc[11141]: no valid DCC server hostnames => =>I did delete the old /var/dcc/map and copied in the new map.txt and then =>ran cdcc 'new map'.

Re: [SAtalk] Error from dcc-1.2.6

2003-09-13 Thread Theo Van Dinter
On Sat, Sep 13, 2003 at 10:39:27PM -0400, Steven W. Orr wrote: > I upgraded and now I have the following error message on every mail > message: > What else am I suppoed to do? does "dccproc -H < message" work? if not, you'll have to ask the DCC folks. if so, try a SA -D run and see what the outp

[SAtalk] Error from dcc-1.2.6

2003-09-13 Thread Steven W. Orr
I upgraded and now I have the following error message on every mail message: dccproc[11141]: no valid DCC server hostnames I did delete the old /var/dcc/map and copied in the new map.txt and then ran cdcc 'new map'. What else am I suppoed to do? TIA -- -Time flies like the wind. Fruit flies

Re: [SAtalk] Re: Load throttling with Procmail/Sendmail. [Was: Getting slammed with virri and spam]

2003-09-13 Thread Simon Byrnand
> On Thu, Sep 11, 2003 at 04:32:47PM +1200, Simon Byrnand wrote: >> Anybody running spamc from procmail with sendmail is vulnerable to >> having >> their server overloaded because of uncontrolled concurancy of local >> deliveries - despite the options mentioned above, sendmail just doesn't >> have

[SAtalk] Annouce: More rules for SA (Brazilian)

2003-09-13 Thread Daniel Lafraia
Guys, FYI, I've released a bunch of rules to detect Brazilian spams. This is just the beginning. Hopefully I'll get help from the community over here to make better rules. I'll try to release a new version every two weeks. The URL is www.lafraia.com.br/spambr/br_rules.cf Thanks -Daniel Lafraia

RE: [SAtalk] SA rc2-4 skipping certain messages

2003-09-13 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Daniel Quinlan wrote: > "Mike Loiterman" <[EMAIL PROTECTED]> writes: > >> I'm getting a growing number of messages that appear to have been >> skipped by SA. > > spamc skips large messages by default. That could be it. > > SpamAssassin doesn't ti

[SAtalk] Can´t learn spam mails with sa-learn

2003-09-13 Thread Bernd Kuhls
Hello, since I am not the only having this problem according to some other newsgroup I would like to ask why the Bayes filter does not help. Ok, the long story: Since yesterday I am bombarded with spam. Those mails look like bounces of mails I sent, but I didn´t. As To: adress is some random n

[SAtalk] mass-check failure: hit-frequencies, parse-rules-for-masses

2003-09-13 Thread Robert Menschel
I've reached the point where my email client isn't able to handle all of the rule matching analysis I'm asking of it. So I'm trying to get mass-check to work so I can analyze individual rules. Minor handicap: I'm a domain user on a shared virtual domain server. I don't have admin access to most o

Re: [SAtalk] Installing Spam Assassin for site-wide handling

2003-09-13 Thread Morris Jones
On Sun, 14 Sep 2003, Terry Allen wrote: > 1 Is it possible to install Spam Assassin for filtering & deleting > the spam without altering the existing sendmail configuration? If so, > could somoeone point me to some sort of wlakthrough or eail me with > some details please. Yes. Sendmail is pr

[SAtalk] Installing Spam Assassin for site-wide handling

2003-09-13 Thread Terry Allen
Hi there, I have yet to download Spam Assassin, but I am seriously looking at it & wonder if anyone would mind replying to this, taking into account the following information. I am running a low volume Mac OSX (client version, not server), machine which runs server applications from Tenon in

[SAtalk] Seed site without another site's Bayes database?

2003-09-13 Thread Peter Kiem
Hi, After a week of collecting spams and hams my Bayes database has finally activated in SpamAssassin :) I have a customer site which I have also installed SA but their auto-learn is picking up spam at a very slow rate. Are there any problems with copying my Bayes DB from my server to theirs to

Re: [SAtalk] Running Mailman 2.1.2 with Spamassassin 2.55 and Mimedefang. 2.36

2003-09-13 Thread Tony Hoyle
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Michael W. Cocke wrote: | I think the odds are against it being either of these 2 programs, but | I'm losing what's left of my mind Mailman won't send any | mail No error messages, logs look ok, and it doesn't LOOK like | mimedefang or spamas

[SAtalk] a little newbie question

2003-09-13 Thread Sérgio Monteiro Basto
Hi Is it possible spamassassin eats an email or for sure just tag email ? thanks -- SérgioMB email: [EMAIL PROTECTED] Who gives me one shell, give me everything. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http:

Re: [SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Theo Van Dinter
On Sat, Sep 13, 2003 at 12:55:27PM -0500, Bill Polhemus wrote: > I run SA 2.55. > I'd like both "learned" and "scanned", if possible. > > I tried the check_bayes_db script, fwiw, and saw nothing but a long, long > list of words that (apparently) have been tokenized in the database. yeah. look at

Re: [SAtalk] 2.60 RC4 deletes local.cf

2003-09-13 Thread Simon Byrnand
> Just for a data point, rc4 did not overwrite local.cf on my linux > machine. "perl Makefile.PL; make; make install" Nor mine... Regards, Simon --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

RE: [SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Bill Polhemus
I run SA 2.55. I'd like both "learned" and "scanned", if possible. I tried the check_bayes_db script, fwiw, and saw nothing but a long, long list of words that (apparently) have been tokenized in the database. Is there any way to get more information (or a more readable report) than that? Will

Re: [SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Jim
On Sat, Sep 13, 2003 at 11:49:43AM -0500, Bill Polhemus wrote: > Is there a script available to tell me simply how many emails I have > processed through "SA-LEARN?" Do you mean "processed through Bayes?" > I would just like to know how many SPAM and > HAM messages have passed through the data

Re: [SAtalk] Has anyone written rules for Sobig:F

2003-09-13 Thread Adam D. Barratt
On Sat, 2003-09-13 at 17:54, Kristian Koehntopp wrote: > On Thu, Sep 11, 2003 at 04:36:02PM -0400, Steven W. Orr wrote: > > that I can just add? > > The point is moot. Sobig.F expired on 10-Sep-2003, due to an > internal timebomb. The timebomb appears to be somewhat of a damp squib. Our mail ser

Re: [SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Theo Van Dinter
On Sat, Sep 13, 2003 at 11:49:43AM -0500, Bill Polhemus wrote: > Is there a script available to tell me simply how many emails I have > processed through "SA-LEARN?" I would just like to know how many SPAM and > HAM messages have passed through the database. That you've scanned, or that you've l

Re: [SAtalk] Has anyone written rules for Sobig:F

2003-09-13 Thread Kristian Koehntopp
On Fri, Sep 12, 2003 at 04:34:40PM -0700, Abigail Marshall wrote: > 2. SobigF expired on September 10th. There may be a few > errant worms floating around from computers that have their > dates wrong, but you probably won't see many. You won't see any. Earlier version of Sobig did use local clocks

[SAtalk] TESTING MY ACCOUNT

2003-09-13 Thread landy
I SEND AN EMAIL and it bounce b/c i used a blacklist expression just veryfying my email did not get blacklisted --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf

Re: [SAtalk] Has anyone written rules for Sobig:F

2003-09-13 Thread Kristian Koehntopp
On Thu, Sep 11, 2003 at 04:36:02PM -0400, Steven W. Orr wrote: > that I can just add? The point is moot. Sobig.F expired on 10-Sep-2003, due to an internal timebomb. That being said, SpamAssassin-2.55 caught Sobig.F just fine for me, no local tuning required. See http://vvv.koehntopp.de/rrd/kri

[SAtalk] Getting Some Bayesian Statistics

2003-09-13 Thread Bill Polhemus
Is there a script available to tell me simply how many emails I have processed through "SA-LEARN?" I would just like to know how many SPAM and HAM messages have passed through the database. --- This sf.net email is sponsored by:ThinkGeek Welc

Re: [SAtalk] Re: Load throttling with Procmail/Sendmail. [Was: Ge tting slammed with virri and spam]

2003-09-13 Thread Jim
On Sat, Sep 13, 2003 at 09:41:26AM -0400, Larry Gilson wrote: > What is your rule of thumb for the Postfix max process limit and the number > of spamc max children? I started with 5 and pushed it up from there when it appeared the machine could handle it. 5 was a very cautious number; I set it so

RE: [SAtalk] Re: [SA-Announce] SpamAssassin 2.60 rc4 released

2003-09-13 Thread Bill Polhemus
I'm curious. Can you not just use "rpmbuild --rebuild" on the .src.rpm alone, and not worry about the .spec file? That's what I do, and it seems to work okay. William L. Polhemus, Jr. P.E. Polhemus Engineering Company Katy, Texas USA -Original Message- From: [EMAIL PROTECTED] [mailto:[EM

Re: [SAtalk] Rule for no reverse DNS

2003-09-13 Thread Kai Schaetzl
Michael W. Cocke wrote on Fri, 12 Sep 2003 12:52:09 -0400: > they won't > accept messages from my domain because I use dyndns and not a static > IP. > No problem, use the smarthost given by your provider. That's what it's for. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive In

RE: [SAtalk] Re: Load throttling with Procmail/Sendmail. [Was: Ge tting slammed with virri and spam]

2003-09-13 Thread Larry Gilson
Hi Jim, > -Original Message- > From: Jim > I actually do use the -m switch, but on top of that I use a > concurrency limit on the spamc transport (I am using > Postfix). So Postfix will never launch more than "n" copies > of spamc, and will trickle the mails out of the queue when >

[SAtalk] Re: SA Won't Update from rc2 to rc4

2003-09-13 Thread Malte S. Stretz
On Friday 12 September 2003 17:56 CET [EMAIL PROTECTED] wrote: > Malte, I'm not sure if I ever got a response back to you after this, but > I sent a message back to list saying that I couldn't UNINST=1 like you > suggested. No, sorry I didn't answer. I tried to find any logic in that but couldn't.

Re: [SAtalk] Editing scores

2003-09-13 Thread Alicia Forsythe
Excellent catch. Thank you. I still think that score is a little high for a subject having spaces. Can I configure that test in local.cf to be lower? Any other way without changing 50_scores? >>> Matt Kettler <[EMAIL PROTECTED]> 9/11/2003 2:19:22 PM >>> At 01:07 PM 9/11/2003 -0400, Alicia Fors

[SAtalk] OS X / Post.Office - New User Help

2003-09-13 Thread Dan Tappin
Hello All, I am a new Spam Assassin user via Tenon Intersystems Post.Office mail server. Tenon has release a Spam Assassin plug-in for their OS X based mail server. I have Spam Assassin up and running and trapping spam via Post.Office. The problem is that I can't seem to get the 'always_add_hea

[SAtalk] Re: 2.60rc4: overwrite local.cf

2003-09-13 Thread Malte S. Stretz
On Friday 12 September 2003 21:12 CET German Staltari wrote: > Hi list, i would like to warn about the overwriting of the local.cf file > when you do a make install. Hopefully i have a backup of the file :). Could you please send me the generated Makefile (should be in your source directory) to m

[SAtalk] Re: 2.60 RC4 deletes local.cf

2003-09-13 Thread Malte S. Stretz
On Saturday 13 September 2003 00:17 CET Mike Loiterman wrote: > Be careful! I just upgraded to 2.60rc4 and my > /etc/mail/spamassassin/local.cf got blown away. Could you please send me the generated Makefile (should be in your source directory) to my e-mail address? Thanks, Malte ---

Re: [SAtalk] Rule for no reverse DNS

2003-09-13 Thread Jim
On Thu, Sep 11, 2003 at 10:20:49AM -0400, Covington, Chris wrote: > It can't be that specific. There must be some way such as a header > regexp that searches for "unknown" or the lack of a DNS name: Well, we can already look up Received IPs in RBLs, so it can't be much harder to just do a reverse

[SAtalk] user_prefs

2003-09-13 Thread Alan Fullmer
I am having difficulty, and was wondering if anyone can shed some light on the subject.   I can't get spam assassin to read any user_prefs file.   it works with the local.cf just fine.    is there something i've missed?  

Re: [SAtalk] Trying to install DB_File from CPAN

2003-09-13 Thread David B Funk
On Fri, 12 Sep 2003, AWShirley wrote: > I'm trying to install DB_File from CPAN so I can use Bayes, but the install fails. > I get these error messages: > > version.c:30:16: db.h: No such file or directory > make: *** [version.o] Error 1 > /usr/bin/make -- NOT OK > Running make test > Can't

Re: [SAtalk] 2.60 RC4 deletes local.cf

2003-09-13 Thread Morris Jones
Just for a data point, rc4 did not overwrite local.cf on my linux machine. "perl Makefile.PL; make; make install" Mojo On 12 Sep 2003, Daniel Quinlan wrote: > "Mike Loiterman" <[EMAIL PROTECTED]> writes: > > > Be careful! I just upgraded to 2.60rc4 and my > > /etc/mail/spamassassin/local.cf g

Re[3]: [SAtalk] No BAYES_* ?

2003-09-13 Thread Abigail Marshall
Hello David, Friday, September 12, 2003, 11:04:28 AM, you wrote: DBF> On Thu, 11 Sep 2003, Abigail Marshall wrote: >> >> >> I don't know but I have the same problem. It seems to >> happen when my bayes_toks file reaches about 5k. >> >> So far, I've lost the bayes database 3 times. If I monitor

[SAtalk] Skipping RBL checks for authenticated connections

2003-09-13 Thread Christopher X. Candreva
Before I submit a bug report on this I wanted to check my understanding. If I get what's going on, RBL checks such as NJABL_DIALUP and DYNABLOCK are checked, and weigh in heavily when they are the last hop before local machines, so even if a dynamicly listed IP is in the Received, it shouldn't t

Re: [SAtalk] SA rc2-4 skipping certain messages

2003-09-13 Thread Daniel Quinlan
"Mike Loiterman" <[EMAIL PROTECTED]> writes: > I'm getting a growing number of messages that appear to have been > skipped by SA. spamc skips large messages by default. That could be it. SpamAssassin doesn't time itself out at all. Daniel -

[SAtalk] Has anyone written rules for Sobig:F

2003-09-13 Thread Steven W. Orr
that I can just add? TIA -- -Time flies like the wind. Fruit flies like a banana. Stranger things have - -happened but none stranger than this. Does your driver's license say Organ -Donor?Black holes are where God divided by zero. Listen to me! We are all- -individuals! What if this weren't a hy

[SAtalk] FW: Rules for bounce mail Sobig

2003-09-13 Thread Jean-Francois Guilmard
Hey guys, i'm a newbie using spamassassin with Qmail. It works perfectly because the job of the previous administrator was well done ... but nowadays Sobig is generating a lot of bounce mails ... So i found this page giving some rules to add to spamassassin: http://www.exit0.us/index.php/VirusBou

[SAtalk] Spamd erorrs

2003-09-13 Thread TUNC ERESEN
Hello All I get following errors when I run Spamd? Any ideas... [admin admin]$ spamd Could not create INET socket: Permission denied IO::Socket::INET: Permission denied Best Regards O. TUNC ERESEN ISP & Security Consultant Mobile: (44)07785 363 481 17 OAK ROAD, BRACKLEY, NORTHANTS, UK, NN