Re: [SAtalk] SpamAss is tagging my own emails

Matt Kettler wrote: disable this rule. kill it. Couldn't he just whitelist his Web server? Or maybe a custom rule that tacks some negative points onto the score? --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like

RE: [SAtalk] Moving SPAM to a separate Mailbox

Yes. In fact, I have a .procmailrc file that uses the ${HOME} variable among other "generics", and can be put in the HOME directory of any user. That way the user can also add their own recipes if they like. Oh, and I also have a /etc/procmail file that has some "site-wide" recipes (it adds stuff

RE: [SAtalk] 0 messages

Hi, Mark. These aren't messages that you've already fed to the Bayesian classifier, are they? Once it learns a message feeding it through again wont cause it to learn it again. Brian -Original Message- From: Mark Beckwith [mailto:[EMAIL PROTECTED] Sent: Monday, October 27, 2003 9:26 PM

Re[2]: [SAtalk] Filtering mailsl without text

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Keith, Monday, October 27, 2003, 5:03:57 AM, you wrote: KCI> Robert Menschel <[EMAIL PROTECTED]> wrote: >> # RM rules to identify a completely empty HTML email >> header RM_hc_HTML Content-Type =~ /text\/html/ >> describe RM_hc_HTML

[SAtalk] 0 messages

Hello, I've done my due diligence but can't figure this out: No matter what I do, I get something like: ~/Mail >sa-learn --spam --mbox spam Learned from 0 message(s) (1927 message(s) examined). ~/Mail >sa-learn --ham --mbox /var/spool/mail/mark Learned from 0 message(s) (111 message(s) examined)

Re: [SAtalk] spamassassin on solaris9 intel based

On 2003-10-27 15:47:08 -0500, Dominique Bagnato wrote: > I would like to know how could I install spamassassin on a Sun Solaris9 intel > machine. You have read INSTALL? Best regards Martin -- Martin Schröder, [EMAIL PROTECTED] ArtCom GmbH, Lise-Meitner-Str 5, 28359 Breme

[SAtalk] SpamAssassin thinks there's insufficient ham

I'm seeing the following messages when running "spamassassin -D -t < sample-spam.txt". I've been feeding unique ham to sa-learn for a while now but each time SpamAssassin is telling me that it's at 156. I am feeding the ham to the correct Bayes database and each time sa-learn does tell me that it

[SAtalk] spamassassin on solaris9 intel based

I would like to know how could I install spamassassin on a Sun Solaris9 intel machine. Which version of spamassassin should I use. Thank you for your help. -- Dominique Bagnato - Head of the Technology Department.French International School - Bethesda, MD. USATel:301 530 8260 Ext:279 - ht

RE: [SAtalk] SpamAss is tagging my own emails

> Rather than reducing the values of those scores, why don't you: > 1) Have outgoing email not get checked by SA (what's the point of that > anyway?) It keeps your own users in line by dumping any spam before they send it through your box. Great for trapping any open relay issues as well, I'd thin

RE: [SAtalk] SpamAss is tagging my own emails

Rather than reducing the values of those scores, why don't you: 1) Have outgoing email not get checked by SA (what's the point of that anyway?) or Read the FAQ: 2) Create a rule subtracting 50 points for a message received from your webserver. http://spamassassin.taint.org/faq/index.cgi?req=s

Re: [SAtalk] symbols and punctuation in subject

At Mon Oct 27 16:12:10 2003, thomas.w wrote: > > One of my users gets a ton of spam with subjects like > > BO'0S-T` "D*I,C-K' ;S"I'Z*E-'_`buzsdkbsc > > (sorry) > > But the extra characters in the subject don't seem to trigger any particular test. > > I looked at the list of tests and didnt

[SAtalk] spamassassin on solaris9 intel based

I would like to know how could I install spamassassin on a Sun Solaris9 intel machine. Which version of spamassassin should I use.   Thank you for your help.   -- Dominique Bagnato - Head of the Technology Department.French International School - Bethesda, MD. USATel:301 530 8260 Ext:279 - h

[SAtalk] sa-learn web UI?

Hi all, We'd like to install a web UI to sa-learn to allow users to train the Bayesnian filter(auto-learning is not proving good enough)- but I have been unable to find anything after a good 20 minutes with google. All I came up with was this: https://www.cs.caltech.edu/cgi-bin/spam/sa-learn.

[SAtalk] Disable FORGED_MUA_IMS tests

Hello, I have googeled and read readme's for info where I can turn of checks for FORGED_MUA_IMS, but no luck. Does anyone know where I can specify this? I tried putting forged_mua_ims 0 in /etc/mail/spamassassin/local.cf but no luck. TIA -wilma- __

[SAtalk] Spamd (2.60) continuously dying

(Please cc me on any replies - I am not currently subscribed to the list) I've been running spamassassin/spamd at my site quite happily for quite a while. Recently, the load on my one incoming smtp server has gotten quite high during peak delivery times from spamd processes. I already have a hand

RE: [SAtalk] Moving SPAM to a separate Mailbox

The .procmailrc "rule" to send mail determined by SA to be spam is pretty easy - :0: * ^X-Spam-Status: Yes /home/user/Mail/spam In other words, if the X-Spam-Status header (added by SA) is "Yes", then the mail is delivered to the "spam" mailbox specified in the path (your path my of course be di

Re: R: [SAtalk] Moving SPAM to a separate Mailbox

You should be able to create a /etc/procmailrc file that will get sourced before the user's ~/.procmailrc On Mon, 27 Oct 2003, Francesco wrote: > Ok, > > can i set a .procmailrc file for every users of a domain, in order to set > every message to be passed by procmail?? > > Thank you again, best

[SAtalk] bayes_toks file size keeps growing, normal?

I have installed and been using SpamAssassin 2.60 for several weeks now. I noticed that the bayes files continue to grow by a meg or so every few weeks. Is this normal? Is there any sort of house cleaning to do with these files? Cause at this rate, if they continue to grow they will exceed web

[SAtalk] symbols and punctuation in subject

One of my users gets a ton of spam with subjects like BO'0S-T` "D*I,C-K' ;S"I'Z*E-'_`buzsdkbsc (sorry) But the extra characters in the subject don't seem to trigger any particular test. I looked at the list of tests and didnt see anything that addressed it. What if there were a test that

RE: [SAtalk] SpamAss is tagging my own emails

There should be something in the headers of the messages from your own e-commerce system that you can use to recognize those messages. Put a procmail recipe in to route them directly through to delivery without even feeding them to spamassassin I might be tempted to look for the ip address of my w

RE: [SAtalk] symbols and punctuation in subject

> > One of my users gets a ton of spam with subjects like > > BO'0S-T` "D*I,C-K' ;S"I'Z*E-'_`buzsdkbsc > > (sorry) > > But the extra characters in the subject don't seem to trigger > any particular test. > We have some rules for obfuscation, but I'm seeing a lot of things li.ke th.is, a

[SAtalk] Re: [OT] duplicate messages

I hadn't noticed until you pointed out, but yes, I'm seeing it too. On Mon, 27 Oct 2003, Colin A. Bartlett wrote: > Anyone else besides me getting messages on this list 3, 4, 5, 10 times each? > > I got "Synchronising SA on different servers" 4 times this morning. > And I've gotten Bill Polhemus

Re: [SAtalk] Disable FORGED_MUA_IMS tests

At Mon Oct 27 18:15:15 2003, wilma wrote: > > Hello, I'm running SA 2.60 and spamass-milter 2.0 on a RH8 mail gateway. > I have googeled and read readme's for info where I can turn of checks for > FORGED_MUA_IMS, but no luck. > Does anyone know where I can specify this? > I tried putting > forge

[SAtalk] scan time rounded

Hi list, I have a couple of boxes with SA 2.60 installed. All this boxes are RedHat 8, but one with Red Hat 9. All configured the same way and updated using RedHat up2date service. The problem is that the scan time entry logs in the RedHat 8 servers is fine(eg. 0.2,0.5,0.8,1.2 seconds,etc. ), b

Re: [SAtalk] Disable FORGED_MUA_IMS tests

Starting with SA 2.6, the local.cf file should be located under: /perl/etc/mail/spamassassin/local.cf It's possible your SA is not seeing the changes you have made. You can verify this by running spamassassin --lint -d and check the output. You should always use ALL CAPS for the test names. Use:

Re: [SAtalk] SpamAss is tagging my own emails

At 01:14 PM 10/27/2003, Mad Martian wrote: FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers [Any idea why this happens? The person who placed the order has a yahoo email address. Is there risk in eliminating this score?] This rule fires off anytime an email has a From: addr

RE: [SAtalk] SpamAss is tagging my own emails

Thanks. You hit that one on the head. I need the address to stay as it is, but the default score is not too high. The MSGID_FROM_MTA_SHORT score was set to 3 by default, so that's the one I need to deal with most. -Original Message- From: Colin A. Bartlett [mailto:[EMAIL PROTECTED] Sent:

[SAtalk] RE: [AMaViS-user] Amavisd-new and logging untrusted relays...

> Median sounds like a better idea than average, for sure. > Perhaps to be conservative both will have to be over a > certain threshold. Actually, perhaps it would be best to only turn off SMTP from servers from which *no* legitimate mail was delivered (in the last X amount of time). This is e

RE: [SAtalk] SpamAss is tagging my own emails

Thanks for the info. I will forward the second part to the Merchant Order Form folks and cut the score down to 1.5 for now. -Mike -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Monday, October 27, 2003 11:29 AM To: Mad Martian; [EMAIL PROTECTED] Subject: Re: [SAtal

[SAtalk] RE: [AMaViS-user] Amavisd-new and logging untrusted relays...

> | - The "action" routine would run through the hashes and > compute the average > | spam levels for each IP, ... > |... > | I guess I need to sort out what a good criteria would be > for action. Would > | average spam level be an adequate way to determine a "bad" IP? ... > > Don't use 'average

RE: [SAtalk] SpamAss is tagging my own emails

Mad Martian Sent: Monday, October 27, 2003 1:14 PM > FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' > headers > [Any idea why this happens? The person who placed the order has a yahoo > email address. Is there risk in eliminating this score?] Your ecommerce system is probably s

[SAtalk] Disable FORGED_MUA_IMS tests

Hello, I'm running SA 2.60 and spamass-milter 2.0 on a RH8 mail gateway. I have googeled and read readme's for info where I can turn of checks for FORGED_MUA_IMS, but no luck. Does anyone know where I can specify this? I tried putting forged_mua_ims 0 in /etc/mail/spamassassin/local.cf but no luck.

Re: [SAtalk] Final-Recipient: rfc822; unknown

Walter wrote: > I get every day 700 emails generated on my system by the mail-deamon > saying: > from: Mail Delivery System > subject:Undelivered Mail Returned to Sender [snip] > How can I stop this? I checked already my log files and I see that it > comes from the apache deamon Check your web d

RE: [SAtalk] Newbie

My e-mail provider uses Spam Assassin. Lately I have been getting about a thousand e-mails telling me to patch my Windows. I use MailWasher to delete these, as if I leave on vacation my in box gets too large for Outlook to handle. I let my provider know an they bumped Spam Assassin up to lev

Re: [SAtalk] [RD] Trojaned machines

On Thu, Oct 23, 2003 at 10:41:25AM -0400, Chris Santerre wrote: > Why are some URI rules written normally like this: > uri name /regex/ > and others: > uri name m{regex} > uri name [EMAIL PROTECTED]@ > What is up with the m's? They're equivalent. Have a look in, f'rex, _Programming Perl_ or _Pe

R: [SAtalk] Moving SPAM to a separate Mailbox

Ok, can i set a .procmailrc file for every users of a domain, in order to set every message to be passed by procmail?? Thank you again, best regards! Francesco --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like w

[SAtalk] sa-2.60+pyzor = Insecure directory in $ENV{PATH}

I installed sa-2.60 on Redhat9, and also installed pyzor. I can't seem to fix this, any hints please? I am normalling running sa via maildrop. I tried putting this in my .mailfilter: DEFAULT="inbox" PATH="/bin:/usr/bin" but it didn't help. Here's what happens if I manually run sa: spamassas

[SAtalk] SpamAss is tagging my own emails

I am trying to understand why SpamAss is tagging orders sent to me from my own web site as spam. I am using the shopping cart software "Merchant Order Form" and about 1 in 10 orders gets marked as spam, depending on what they have ordered! I found that those not getting marked as spam are close to

RE: [SAtalk] Newbie

At 10:08 AM 10/27/2003, Dan Kohn wrote: This should be a FAQ: Q. How do I get SpamAssassin to mark as spam all Window patch emails that include an executable? A. Add the following line to your user-prefs (normally ~/.spamassassin/user_prefs): score MICROSOFT_EXECUTABLE 10 - dan And it

RE: [SAtalk] Newbie

Yes, though while my server-side virus scanner removes the attachment before my client-side scanner can even see it, the email still gets through unless I increase the score for that rule. - dan -- Dan Kohn -Original Message-

Re: [SAtalk] Newbie

On Mon, 27 Oct 2003 15:05:12 - "Giles Coochey" <[EMAIL PROTECTED]> wrote: > Those emails are Viruses, not Spam - why not get some Anti Virus > Software? 1) AV software generally costs money. 2) You wipe out over 90% of the virus threat with negligible FPs by rejecting all Windows executables

Re: [SAtalk] Re: Re: [OT] What is next step?

> "JM" == Justin Mason <[EMAIL PROTECTED]> writes: JM> Also note: some spamware will skip any addresses that contain any JM> of these strings: JM> spam JM> abuse JM> postmaster JM> .gov JM> ftc my abuse@ and postmaster@ addresses would hope that more would skip them. :-(

RE: [SAtalk] I wish I wasn't discarding high scorers

LOL. Create a rule that says anything over 100 goes to you! :-) > > I use SA with amavis-new, and have set the latter to discard anything > that scores over 15. I wish I hadn't done that, my amavis log > tells me > that mail from [EMAIL PROTECTED] was discarded after > scoring 127.509. I'm i

RE: [SAtalk] Evilrules false-positives

> > G_WWW_C1TRACKING_COM hits mainly YahooGroups postings, since > it shows up in > the ads that Yahoo attaches. > G_PICS_EBAYSTATIC_COM hits eBay listing confirmations, outbid > notices, > invoices, etc. - and as near as I can tell, nothing else. > This makes me > wonder how it ended up o

[SAtalk] Educated opinions please.

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I would appreciate opinions and comments on our AntiSpam/AntiVirus plan. Our current config is: One machine with MX records for cmich.edu domain runs LSOFT's LSMTP and routes all cmich.edu mail (except for list mail) to a machine that does a

RE: [SAtalk] Change default

Andrea, please read the documentation before asking questions on this list. P.S. What you want is: score FORGED_YAHOO_RCVD 10 - dan -- Dan Kohn -

Re: [SAtalk] I wish I wasn't discarding high scorers

> "KG" == Ken Gordon <[EMAIL PROTECTED]> writes: KG> I use SA with amavis-new, and have set the latter to discard anything KG> that scores over 15. I wish I hadn't done that, my amavis log tells me KG> that mail from [EMAIL PROTECTED] was discarded after KG> scoring 127.509. I'm impressed and

RE: [SAtalk] Newbie

Those emails are Viruses, not Spam - why not get some Anti Virus Software? -Original Message- From: Howard Brazee [mailto:[EMAIL PROTECTED] Sent: 27 October 2003 14:08 To: [EMAIL PROTECTED] Subject: [SAtalk] Newbie My e-mail provider uses Spam Assassin. Lately I have been getting abo

RE: [SAtalk] Newbie

This should be a FAQ: Q. How do I get SpamAssassin to mark as spam all Window patch emails that include an executable? A. Add the following line to your user-prefs (normally ~/.spamassassin/user_prefs): score MICROSOFT_EXECUTABLE 10 - dan -- Dan Kohn

Re: [SAtalk] Synchronising SA on different servers

Johann Spies wrote: +*1ADBMt-00024Y-00*obt1AWUAynY* X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on maties1.sun.ac.za X-Spam-DCC: : X-Spam-Status: No, hits=6.8 required=8.0 tests=BAYES_90,NO_REAL_NAME, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_SORBS autolearn=no version=2.60

Re: [SAtalk] Moving SPAM to a separate Mailbox

--On Monday, October 27, 2003 12:17 PM +0100 Francesco <[EMAIL PROTECTED]> wrote: Hello, i am currently using QMAIL + Vpopmail + Spamassin (SpamAssassin join qmail modifing the qmail-queue file); all SPAM messages are tagged and *** SPAM *** is added before the original subject line. Well, now

[SAtalk] Newbie

My e-mail provider uses Spam Assassin. Lately I have been getting about a thousand e-mails telling me to patch my Windows. I use MailWasher to delete these, as if I leave on vacation my in box gets too large for Outlook to handle. I let my provider know an they bumped Spam Assassin up to lev

[SAtalk] [OT] duplicate messages

Anyone else besides me getting messages on this list 3, 4, 5, 10 times each? I got "Synchronising SA on different servers" 4 times this morning. And I've gotten Bill Polhemus's reply to "help with sa-learn" 5 times over the past 3 days. What gives? SF I suppose? Not complaining just inquiring. c

Re: [SAtalk] Moving SPAM to a separate Mailbox

Hallo Francesco, > Well, now i would like to know how to automatically move all SPAM > recognized by SpamAssassin in a separate mailbox (as example: > [EMAIL PROTECTED]), possibly without using Procmail... > > Could you help me please?? You can do that with procmail. I use this recipe in my ~

Re: [SAtalk] Filtering mailsl without text

Robert Menschel <[EMAIL PROTECTED]> wrote: > # RM rules to identify a completely empty HTML email > header RM_hc_HTML Content-Type =~ /text\/html/ > describe RM_hc_HTML Email is text/html format > scoreRM_hc_HTML 0.001 That seems to be pretty similar to the existing MIME_HTML

[SAtalk] Moving SPAM to a separate Mailbox

Hello, i am currently using QMAIL + Vpopmail + Spamassin (SpamAssassin join qmail modifing the qmail-queue file); all SPAM messages are tagged and *** SPAM *** is added before the original subject line. Well, now i would like to know how to automatically move all SPAM recognized by SpamAssassin i

[SAtalk] Synchronising SA on different servers

I have Spamassassin on three servers which act as the mail gateway for our campus. They started out on the same bayes-database and I use exactly the same /etc/mail/spamassassin/local.cf on all three of them. This morning I saw the following differences on the same message that came through two of