[SAtalk] spamassassin database moved with 2.60

2003-10-20 Thread Forrest Aldrich
I had been toiling with an issue about /var/spool/spamassassin no having properly updated files -- then I discovered that for some reason, the file is now being written to /tmp/.spamassassin as user "nobody". I didn't make any configuration changes for this -- and am a little puzzled. Perhaps

RE: [SAtalk] filter documentation

2003-10-20 Thread Yackley, Matt
Michael, Check through these two sites, they contain a *lot* of custom rules. http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm (be sure to try out evilrule.cf & popcorn/backhair/weeds -- Thanks Chris & Jennifer!) http://w

RE: [SAtalk] My first question here[SA & DCC]

2003-10-20 Thread Larry Gilson
Hi Marco, > -Original Message- > From: Marco Calistri [mailto:[EMAIL PROTECTED] > Sent: Monday, October 20, 2003 4:19 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] My first question here[SA & DCC] > > > Hello, first of all I want to make my compliments to the > developers that are spe

Re: [SAtalk] My first question here[SA & DCC]

2003-10-20 Thread Matt Kettler
At 10:19 PM 10/20/03 +0200, Marco Calistri wrote: Hello, first of all I want to make my compliments to the developers that are spending their time to fight the SPAM and of course, among these thanks to SA Team. My first question (the first of a long series...) is: Well, my first comment, before I g

RE: [SAtalk] filter documentation

2003-10-20 Thread Larry Gilson
Hi Michael, > -Original Message- > From: Michael Balamuth [mailto:[EMAIL PROTECTED] > Sent: Monday, October 20, 2003 3:27 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] filter documentation > > > Just wondering if there is any specific documentation on how to write > additional filters

Re: [SAtalk] Re: Swap Space

2003-10-20 Thread David B Funk
On Tue, 21 Oct 2003, Simon Byrnand wrote: > Since I use sendmail, which unfortunately doesn't have a proper way to > limit local delivery concurancy, I'm now using a combination approach - I > use -m 15, and return EX_TEMPFAIL for more than 40 simultaneous local > delivery processes. When sendmai

Re: [SAtalk] [OT] What is next step?

2003-10-20 Thread Roger Merchberger
At 15:37 10/20/2003 -0400, Chris Santerre wrote: [snip] What is the next step? We have all posted stats that prove that over 50% of email is spam. Now that we can tag or block (to user), it doesn't stop the traffic. I still have 50% traffic on the server as useless. What do we do? Get rid of SMTP.

Re: [SAtalk] [OT] What is next step?

2003-10-20 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Chris Santerre writes: >We have all posted stats that prove that over 50% of email is spam. Now that >we can tag or block (to user), it doesn't stop the traffic. I still have 50% >traffic on the server as useless. What do we do? I'm serious about this

[SAtalk] SA header and scoring inconsistent

2003-10-20 Thread newsletters-droidmcse
Hey SA Gang, I've only been using SA for about 3-4 weeks and I keep turning additional spam checks to see see how things go. What i've got going on is messages that get marked in the subject as SPAM, the real email gets put into an attachment and the scoring summary as the main message.

Re: [SAtalk] [OT] What is next step?

2003-10-20 Thread Alan Hodgson
On Mon, Oct 20, 2003 at 03:37:46PM -0400, Chris Santerre wrote: > Lets say I can track the spammer to the source. What avenue do we have to > stop them? Should I work with local legislation next? Don't flame me on this > question, but should ISPs be held more accountable? Like Comcast? (Should be >

Re: [SAtalk] Re: Swap Space

2003-10-20 Thread Simon Byrnand
At 20:43 20/10/2003 -0500, David B Funk wrote: On Tue, 21 Oct 2003, Simon Byrnand wrote: > Since I use sendmail, which unfortunately doesn't have a proper way to > limit local delivery concurancy, I'm now using a combination approach - I > use -m 15, and return EX_TEMPFAIL for more than 40 simulta

[SAtalk] filter documentation

2003-10-20 Thread Michael Balamuth
Just wondering if there is any specific documentation on how to write additional filters for SA? Short of reading the source, I haven't found anything on the internals. Thanks, Michael Balamuth [EMAIL PROTECTED] --- This SF.net email is spons

[SAtalk] Check whitelist

2003-10-20 Thread Jim Knuth
Hallo SA-List, I set up this question already once. No answer. :-( If I enter server:~/tools# ./check_whitelist | grep [EMAIL PROTECTED] comes Cannot open file /root/.spamassassin/auto-whitelist: Datei oder Verzeichnis nicht gefunden I use SA 2.60 The permissions are ok. (777) The folder .spam

[SAtalk] My first question here[SA & DCC]

2003-10-20 Thread Marco Calistri
Hello, first of all I want to make my compliments to the developers that are spending their time to fight the SPAM and of course, among these thanks to SA Team. My first question (the first of a long series...) is: I compiled/installed SA 2.60 with Razor2, then by reading about DCC, I compiled/in

Re: [SAtalk] Re: Swap Space

2003-10-20 Thread Simon Byrnand
At 21:57 19/10/2003 -0500, Robert A. Hayden wrote: I'm wondering if maybe this should be default on new versions of SA? Set it by default for, say 25. The user can then set it higher or lower as needed, or to "0" for unlimited. Just a thought? Arguably its a fault of the MTA for allowing an unlim

Re: [SAtalk] [OT] What is next step?

2003-10-20 Thread Martin Schroeder
On 2003-10-20 15:37:46 -0400, Chris Santerre wrote: > Lets say I can track the spammer to the source. What avenue do we have to Forget it. The systems sending the mail are trojaned systems (e.g. on cable modems). > stop them? Should I work with local legislation next? Don't flame me on this The

RE: [SAtalk] child spamds sitting around forever

2003-10-20 Thread Simon Byrnand
At 09:39 20/10/2003 -0500, Dallas L. Engelken wrote: > -Original Message- > From: Daniel M. Drucker [mailto:[EMAIL PROTECTED] > Sent: Saturday, October 18, 2003 2:24 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] child spamds sitting around forever > > > (Running 2.60) > I'm having a proble

RE: [SAtalk] Sendmail STMP & NDR

2003-10-20 Thread Ian Douglas
> We are having a problem with our backend server filling up the root mailbox > with NDRs of users that are no longer with the company and I am trying to get > my brain wrapped around the whole SMTP process. If the postmaster account is filling up with messages about trying to notify the original

Re: [SAtalk] upgrade to 2.60 broke SA

2003-10-20 Thread Matt Kettler
At 01:04 PM 10/19/2003, Masoud Pajoh wrote: I was running SA 2.5 with kmail and all was well, then I upgraded to version 2.60. Now, SA stopped pocessing incoming mail all togther. How can I correct this. Well, what exactly do you mean by "stopped processing incoming mail?" Do you mean that the me

RE: [SAtalk] Popcorn, Backhair, and Weeds

2003-10-20 Thread Mike Kuentz (2)
Little behind in my reading here, so not exactly sure if this subject matches the original discussion? Textpad rocks! Unzip the attached syntax file into your TextPad 4\System directory. Make a new document class for local.cf/user_prefs files and enable syntax highlighting. Specify that it shoul

RE: [SAtalk] Popcorn, Backhair, and Weeds

2003-10-20 Thread Larry Gilson
Hi Mike, This is great! Thanks! --Larry > -Original Message- > From: Mike Kuentz (2) [mailto:[EMAIL PROTECTED] > Sent: Monday, October 20, 2003 3:14 PM > To: Larry Gilson; Chris Santerre > Cc: SA > Subject: RE: [SAtalk] Popcorn, Backhair, and Weeds > > > Little behind in my reading

[SAtalk] spamd_hup failed test on 2.60 install

2003-10-20 Thread Nigel Wade
Hi, I'm getting this error when I try to install SA 2.60: t/spamd_hup.ok 6/8 Not found: flag = X-Spam-Flag: YES t/spamd_hup.FAILED test 8 Failed 1/8 tests, 87.50% okay I've looked at the solutions suggested by bug 2505 related to spamd not starting up quick enough, b

[SAtalk] [OT] What is next step?

2003-10-20 Thread Chris Santerre
I block about 98% of the spam to my users. Many SA users at other companies simply mark it and deliver. Lets say for sake of argument that we can sustain a successful rate of tagging or blocking 90% of spam. What is the next step? We have all posted stats that prove that over 50% of email is spa

Re: [SAtalk] Sendmail STMP & NDR

2003-10-20 Thread mikea
On Mon, Oct 20, 2003 at 02:01:49PM -0500, Mike Carlson wrote: > This is a bit OT, but I figured I could get an answer here. > > We are having a problem with our backend server filling up the root mailbox > with NDRs of users that are no longer with the company and I am trying to get > my brain wr

RE: [SAtalk] child spamds sitting around forever

2003-10-20 Thread Dallas L. Engelken
> -Original Message- > From: Daniel M. Drucker [mailto:[EMAIL PROTECTED] > Sent: Saturday, October 18, 2003 2:24 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] child spamds sitting around forever > > > (Running 2.60) > I'm having a problem where sometimes I end up with dozens of > spamd

Re: [SAtalk] discarding mail

2003-10-20 Thread AltGrendel
On Fri, 2003-10-17 at 12:54, Jeffrey Schilperoord wrote: > How do i setup spamasassin to delete all mail tagged as spam? Or move > it to a dir? > I would check out http://www.exit0.us/index.php/So%20you%20want%20to%20%27delete%27%20all%20your%20spam%21 -- AltGrendel <[EMAIL PROTECTED]> ---

Re: [SAtalk] Forged From addresses and whitelist rule

2003-10-20 Thread Matt Kettler
At 11:11 AM 10/20/2003, James Herschel wrote: I've got an odd situation where I've received spam from a (forged) valid address in my own domain. Problem is that the headers are clearly forged as the IP for my mailserver is incorrect, but the whitelist rule for my domain is being applied. Yeah, whi

[SAtalk] Sendmail STMP & NDR

2003-10-20 Thread Mike Carlson
This is a bit OT, but I figured I could get an answer here. We are having a problem with our backend server filling up the root mailbox with NDRs of users that are no longer with the company and I am trying to get my brain wrapped around the whole SMTP process. When sendmail relays a messages t

[SAtalk] milter timeout

2003-10-20 Thread Alan J Fitton
Hi, I've recently enabled DCC (no other network tests) and installed Net::DNS. This made me suspicious that network tests were the cause for these errors. I just set dns_available to no in case it was. Is there anything I can actually do to remedy this problem? I would like to use some dnsrbl's.

Re: [SAtalk] Forged From addresses and whitelist rule

2003-10-20 Thread Fred I-IS.COM
Hello, The option you are looking for is called: whitelist_from_rcvd It's in the doc's, I'm not sure the exact parameters. Frederic Tarasevicius Internet Information Services, Inc. James Herschel wrote: > Hello, > > I've got an odd situation where I've received spam from a (forged) > valid

RE: [SAtalk] evilrules.cf including in local.cf?

2003-10-20 Thread AltGrendel
On Wed, 2003-10-15 at 16:00, Chris Santerre wrote: > No problem. The idea that I'm trying to start is to take "like" rules > (popcorn and evilrules) and put them in seperate cf files. This way you > simply drop them into your /etc/mail/spamassassin dir and restart spamd. > Nothing else is needed,

[SAtalk] Not Flagging Spam

2003-10-20 Thread Mike Carlson
When I try to send a test message it processes it for a few seconds and then sends the email unflagged. I get this error in /var/log/maillog: Oct 20 09:22:05 hades sm-mta[32140]: h9KEI44d032140: Milter (spamassassin): timeout before data read Oct 20 09:22:05 hades sm-mta[32140]: h9KEI44d032140: M

RE: [SAtalk] Forged From addresses and whitelist rule

2003-10-20 Thread Chris Santerre
This is an annoying little spammer trick. You simply need to create 2 meta rule. If it is from your whitelisted email but doesn't contain your server IP address in the header, then add +103 points. That will counter their little trick. I will try to write something for the wiki later this week.

[SAtalk] sa-learn help

2003-10-20 Thread Barry Bocaner
Hello, all. I've just upgraded from 2.43 to 2.60 and am excited about getting the bayesian filtering working. I (stupidly) deleted around 3000 spams from my "trash" folder last week without thinking about it, so I still need to save up to reach the 200 threshold. I have some questions about usin

Re: [SAtalk] Re: Re: adding SPAM hits score to headers

2003-10-20 Thread Keith C. Ivey
Nancy McGough <[EMAIL PROTECTED]> wrote: > * This file had permission 444 and I changed it to 644 to > edit it. Is there any problem leaving it 644? Procmail > has problems with some permissions so I'm just wondering > if SA does too. > > * Is there any problem if I leave a file named > P

[SAtalk] Forged From addresses and whitelist rule

2003-10-20 Thread James Herschel
Hello, I've got an odd situation where I've received spam from a (forged) valid address in my own domain. Problem is that the headers are clearly forged as the IP for my mailserver is incorrect, but the whitelist rule for my domain is being applied. Is there a setting where I can tell spamassass

Re: [SAtalk] socre in local.cf

2003-10-20 Thread Theo Van Dinter
On Mon, Oct 20, 2003 at 09:34:07AM -0400, Jon Fraley wrote: > I have restarted spamd. It seems that these checks are still getting > scored with their default. This was just sent to me by one of my users. > What could be wrong? The mail was received before you made the change? I'd run with -D a

Re: [SAtalk] SA and Mailscanner

2003-10-20 Thread Lindsay Snider
On Friday 17 October 2003 14:34, Matt Kettler wrote: > At 01:29 PM 10/17/03 -0400, Jon Fraley wrote: > > >From looking at some posts, it looks like Mailscanner just looks for a > > > >score from SA. Does this mean that the message does not get re-written > >as an attachment with the report if it i

[SAtalk] socre in local.cf

2003-10-20 Thread Jon Fraley
I have set the following in my local.cf: score NO_RDNS_DOTCOM_HELO 3.1 score FAKE_HELO_AOL 1.4 I have restarted spamd. It seems that these checks are still getting scored with their default. This was just sent to me by one of my users. 4.1 NO_RDNS_DOTCOM_HELOHost HELO'd a

Re: [SAtalk] LOTS of mail being tagged wrong

2003-10-20 Thread HÃ¥kon Nilsen \(Exinet AS\)
I've been using HAM a lot now, so I don't think I have any mails from these users left to give out tests. They all go through clean, because sa-learn identifies them as 'friendly'. Though, I'll try getting some results posted for you if some mails are still being blocked. I'm using my own little

[SAtalk] Re: Re: adding SPAM hits score to headers

2003-10-20 Thread Nancy McGough
On 19 Oct 2003 Keith C. Ivey ([EMAIL PROTECTED]) wrote: > Nancy McGough <[EMAIL PROTECTED]> wrote: > > > I have a related question: How can I have _HITS_ display only > > one digit after the decimal point. For example, instead of 8.42 > > just display 8.4? It's fine if I need to edit the code and >