[SAtalk] Habeas test

It seems that spamassassin 2.60 requires all 9 Habeas fields to be included, in order, in the header of an email, for it to recognize the Habeas mark. While contacting Habeas support about a semi-related issue, I was informed that spamassassin should only be testing for 'X-Habeas-SWE-3: like Habea

Re: [SAtalk] DB_File

On Mon, 8 Dec 2003, Jack Gostl wrote: > > My bet is that your Bayes database got trashed. > > Possible, but which database? We have many users all with their own? Also, > if its a trashed Bayes db, why does the message go away when I restart > spamd? Which ever database it was looking at when it

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

Your postfix isn't stripping them right? I use amavisd-new and it works like a charm. I do have $sa_tag_level_deflt set to -999, so it adds headers to every email, but $sa_tag2_level_deflt and $sa_kill_level_deflt are set to 7. I think the default for just $sa_tag is 0, so a plain test message

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

Vivek Khera wrote: "j" == jnichols <[EMAIL PROTECTED]> writes: 2. in your spamassassin local.cf file, make sure you have: report_safe 0 report_header 1 j> Done. I even removed all of the other .cf files to be safe Well, that's not gonna do much, since amavis doesn't use these parameters. Thi

Re[2]: [SAtalk] Spam that got through question

At 07:45 PM 12/8/03 -0800, Robert Menschel wrote: MK> That's definitely bayes poison. Well, it's definitely an attempt at bayes poison, and/or a checksum poison. I used to treat it as bayes poison, and keep those out of my bayes database. I no longer bother. To me it's become bayes fodder. Well, g

Re: [SAtalk] DB_File

On Mon, Dec 08, 2003 at 10:52:17PM -0500, Jack Gostl wrote: > Possible, but which database? We have many users all with their own? Also, > if its a trashed Bayes db, why does the message go away when I restart > spamd? If you just went to 2.60, and you weren't using DB_File before, you need to run

Re: [SAtalk] DB_File

On Mon, 8 Dec 2003, David B Funk wrote: > On Mon, 8 Dec 2003, Jack Gostl wrote: > > > > > My logs are flooded with the following message: > > > > Dec 8 16:55:39 argos spamd[83414]: Use of uninitialized value in numeric > > eq (==) at /usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesSt

Re: [SAtalk] (no subject)

On Mon, 8 Dec 2003 [EMAIL PROTECTED] wrote: > We've got SA 2.60 running on a Solaris 8 box with SunONE Messaging > Server. It is doing spam scanning for all our users (~7000). In > order to keep the system as speedy as possible, I've configured the > bayes journal to sit on /tmp which is a memor

Re[2]: [SAtalk] Spam that got through question

Hello Matt, Sunday, December 7, 2003, 8:46:16 PM, you wrote: MK> At 07:15 PM 12/7/03 -0800, Scott Harris wrote: >>The spam attached has the following random words at the bottom: >> >>automata childhood reflectance trevelyan tile captious hollingsworth >>cornstarch chinaman chicanery >> >>Is this

Re: [SAtalk] another SpamAssassin ???

At 09:17 PM 12/8/03 -0600, JRiley wrote: The very same. However, I didnt know the name SpamAssassin was trademarked.. -JR Yep, it was trademarked by Deersoft, and now owned by McAfee following their acquisition of Deersoft. IIRC. --- This SF.

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

> "j" == jnichols <[EMAIL PROTECTED]> writes: >> 2. in your spamassassin local.cf file, make sure you have: >> report_safe 0 >> report_header 1 j> Done. I even removed all of the other .cf files to be safe Well, that's not gonna do much, since amavis doesn't use these parameters. This is o

Re: [SAtalk] another spamAssassin ???

The very same. However, I didnt know the name SpamAssassin was trademarked.. -JR - Original Message - From: gentian To: [EMAIL PROTECTED] Sent: Monday, December 08, 2003 10:08 AM Subject: [SAtalk] another spamAssassin ??? Is this SpamAssassin™ the same as

Re: [SAtalk] DB_File

On Mon, 8 Dec 2003, Jack Gostl wrote: > > My logs are flooded with the following message: > > Dec 8 16:55:39 argos spamd[83414]: Use of uninitialized value in numeric > eq (==) at /usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesStore.pm > line 1437. > > This is intermittent and starte

RE: [SAtalk] Re: Generic V-whatever drug with no GV rule hits (fw d)

On Mon, 2003-12-08 at 18:14, [EMAIL PROTECTED] wrote: > There's a lot of possibilities: > /V.?i.?a.?g.?r.?a/i will catch things like viagrra > > /(V|\\/)(i|1|l)(a|\@)gr(a|\@)/i will catch leet-isms like \/[EMAIL PROTECTED]@ > (off-hand > I don't know the leet-ish for "g" or "r" > > When these st

[SAtalk] DB_File

My logs are flooded with the following message: Dec 8 16:55:39 argos spamd[83414]: Use of uninitialized value in numeric eq (==) at /usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/BayesStore.pm line 1437. This is intermittent and started some time after I tried to update my db libs to th

[SAtalk] Re: Generic V-whatever drug with no GV rule hits (fwd)

On 8 Dec 2003, Scott A Crosby wrote: > On Mon, 08 Dec 2003 16:43:15 -0500, Matt Kettler <[EMAIL PROTECTED]> writes: > > > Or *, to catch more than one obfuscating character.. > > > > ie: V...i..a.gr..a > > > > As I suggested in my email, there's lots of combinations that spammers > > can do to avo

RE: [SAtalk] Re: Generic V-whatever drug with no GV rule hits (fw d)

There's a lot of possibilities: /V.?i.?a.?g.?r.?a/i will catch things like viagrra /(V|\\/)(i|1|l)(a|\@)gr(a|\@)/i will catch leet-isms like \/[EMAIL PROTECTED]@ (off-hand I don't know the leet-ish for "g" or "r" When these start to get really broad though there is the potential for false positi

[SAtalk] Russian Spam!

Hi, i am running MailScanner and SpamAssasin together and so far it has been doing a great work on identifying spam.. but recently we have been getting some spam in russian.. is there any rules we can add to avoid these messages because SpamAssassin is not detecting them as spam. any help is apric

[SAtalk] Re: Generic V-whatever drug with no GV rule hits (fwd)

On Mon, 08 Dec 2003 16:43:15 -0500, Matt Kettler <[EMAIL PROTECTED]> writes: > At 04:33 PM 12/8/2003, David B Funk wrote: > >Small enhancement suggestion, modify each one of those '\W' with '?' > >thus making successive obfuscating characters optional. With your > >rule there -must- be an obfuscat

Re: [SAtalk] Number of Ham and Spam in Bayesian DB

On December 08, 2003 05:40 pm, Matt Barton wrote: > Hello > > It appears that I can easily see the number of Spam in our Bayes database > by issuing -D and --rebuild to sa-learn. It shows up like this. > > debug: bayes: Not available for scanning, only 603 spam(s) in Bayes DB < > 1000 > How d

Re: [SAtalk] Re: Re: BIG HUGE EVIL RULE NEWS!!!!

Jacob S. wrote: Ok, I'll bite the bait from the flamewar... When you want a text editor that powerful, why don't you download Vim for Windows? It's open source *and* free, unlike shareware/nagware. (Still does syntax highlighting, search and replace and way more than I can remember.) http://www.vim

Re: [SAtalk] Re: Re: BIG HUGE EVIL RULE NEWS!!!!

On Mon, 08 Dec 2003 15:49:55 -0600 Rich Puhek <[EMAIL PROTECTED]> wrote: > Chris Barnes wrote: > > Scott Harris <[EMAIL PROTECTED]> wrote: > > > >>Ahh, I bet ya'll are NotePad experts as well! > > > > > > UltraEdit. It converts the "unix to Dos" format automatically. > > ;-) > > > > Best $

[SAtalk] Number of Ham and Spam in Bayesian DB

Hello It appears that I can easily see the number of Spam in our Bayes database by issuing -D and --rebuild to sa-learn. It shows up like this. debug: bayes: Not available for scanning, only 603 spam(s) in Bayes DB < 1000 How does one know how many "ham(s)" are in the Bayes database? Please s

Re: bayes database backup [was: Re: [SAtalk] (no subject)]

On Mon, Dec 08, 2003 at 01:58:47PM -0600, [EMAIL PROTECTED] wrote: > So rather than backing up all three files, I just need to back up the > bayes_toks file periodicly. And I could use a file lock for this > purpose, as you confirmed below. Arguably you should backup seen as well, it has the mess

Re: [SAtalk] Re: New spammer trick (HTML tables)?

On Mon, 8 Dec 2003, Justin Mason wrote: > A good test to catch this would be the use of "too many" TD tags; > it's pretty simple to spot that way. I don't think we have one > yet, though, since this is still a very rare pattern. I've got an experimental abstracted simple "word counter" as

[SAtalk] Is sa-learn learning? - Now it is!

I'm overwhelmed by the help I've gotten on this issue! Thanks to all who responded. I had asked about the meaning of the message "Learned from 0 message(s) (12 message(s) examined)". As several people told me, the issue was that I was missing the module perl-DB_File. I downloaded the RPM (perl-DB_

[SAtalk] RE: filtering spam tagged email before hitting exchange 2000

We do this as a service for some clients. Depending on size of your exchange it's many times free othe than $100 setup/config fee. As to deleting - we actually bounce all rejected spam so if a sender is real they will know your user didn't get it. We also recommend you firewall or restrict ip ac

Re: [SAtalk] Weird Word patch

At Mon Dec 8 16:49:46 2003, Matt Kettler wrote: > No, any line with a comma or period sandwiched between two alpha's would > hit.. no spaces allowed, no end-of-line's allowed in between. (sa does > remove EOLs from body text, but I believe they are replaced by spaces. > Otherwise rules wouldn'

Re: [SAtalk] Re: Re: BIG HUGE EVIL RULE NEWS!!!!

Chris Barnes wrote: Scott Harris <[EMAIL PROTECTED]> wrote: Ahh, I bet ya'll are NotePad experts as well! UltraEdit. It converts the "unix to Dos" format automatically. ;-) Plus has a superb syntax highlighting feature that's fully customizable. Also does column mode (rarely needed, but when

Re: [SAtalk] Is sa-learn learning?

At Mon Dec 8 20:57:06 2003, Steven P. Auerbach wrote: > Some questions: > 1 - What does "Learned from 0 message(s)" mean? My interpretation is > that spamassassin already classified these messages as spam, so it did > not alter its rules. But, I told it the messages are spam, so why didn't > it l

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

At 04:33 PM 12/8/2003, David B Funk wrote: Small enhancement suggestion, modify each one of those '\W' with '?' thus making successive obfuscating characters optional. With your rule there -must- be an obfuscating between each regular character, with the '?', it will catch all permutations of norma

Re: [SAtalk] Is sa-learn learning?

At 03:57 PM 12/8/2003, Steven P. Auerbach wrote: 1 - What does "Learned from 0 message(s)" mean? It means no learning happened. Your interpretation is ONE possibility, but it's the wrong one.. it didn't learn because you don't have DB_File, thus it's impossible for bayes to store data. Since baye

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

On Mon, 8 Dec 2003, Matt Kettler wrote: > At 10:54 AM 12/8/2003, Christopher X. Candreva wrote: > > >I just opened a Bugzilla report for this: > > > >http://bugzilla.spamassassin.org/show_bug.cgi?id=2817 > >(SA 2.60, Solaris, perl 5.6.1) > > For the moment, I'd suggest a rule like this one that I

Re: [SAtalk] amavisd-new & spamassassin = no headers. Ugh!

> I'm using Postfix + amavisd-new + clamav + spamassassin and it's working > great, including adding the headers. Here's some things to check: > 1. in amavisd.conf, set $sa_spam_modifies_subj = 0. The default is to > modify the subject, and I'm not sure if this is mutually exclusive > w

[SAtalk] Is sa-learn learning?

Several people have asked about how to tell if sa-learn is learning, or not, and I have the same question (which does not seem to have been definitively answered in this list). Here is my setup, which appears to be similar to that of others. I manually put email which I declare to be spam, but wh

Re: [SAtalk] script to convert outlook .msg files

Barry Porter sent me a link to the following (we were discussing this off list): http://www.xs4all.nl/~mvz/software/msgconvert.pl This appears to be what I need Terry Terry Milnes wrote: I am looking for a script that can convert the .msg file that is created when you copy an outlook

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

At 02:59 PM 12/8/2003, Christopher X. Candreva wrote: > body LOCAL_GAPPY_VIAG /\bV\Wi\Wa\Wg\Wr\Wa\b/i > score LOCAL_OBFU_VIAG 1.0 Shouldn't the two descriptions match ? :-) ACK!.. that's what I get for re-naming a rule.. :) --

Re: [SAtalk] (no subject)

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Mon, Dec 08, 2003 at 01:11:06PM -0600, [EMAIL PROTECTED] wrote: > > I'd like to back up the journal periodicly to disk. Right now I have > > There's really no point to that. Just sync the journal to the DB. > > > searc

Re: [SAtalk] Delete mail with a score above n

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rich Puhek writes: >Bob Apthorpe wrote: >> On Thu, 04 Dec 2003 10:59:13 -0800 Mike D <[EMAIL PROTECTED]> wrote: >> >> >>>Does anyone know how to config spamassassin to delete messages with a score >>>above a certain threshold? >> >> >> This questi

Re: [SAtalk] Re: New spammer trick (HTML tables)?

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Scott A Crosby writes: >On 08 Dec 2003 11:00:22 +0200, [EMAIL PROTECTED] writes: > >> On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> >> posted to spamassassin-talk: > >> It would be good to have a rule to match the general pattern.

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

On Mon, 8 Dec 2003, Matt Kettler wrote: > body LOCAL_GAPPY_VIAG /\bV\Wi\Wa\Wg\Wr\Wa\b/i > score LOCAL_OBFU_VIAG 1.0 Shouldn't the two descriptions match ? :-) This was my version: bodyOBFU_V /V\s+[i1l]\s+a\s+g\s+r\s+a/i describeOBFU_V Contains obfuscat

bayes database backup [was: Re: [SAtalk] (no subject)]

On Mon, 8 Dec 2003, Theo Van Dinter wrote: > On Mon, Dec 08, 2003 at 01:11:06PM -0600, [EMAIL PROTECTED] wrote: > > I'd like to back up the journal periodicly to disk. Right now I have > > There's really no point to that. Just sync the journal to the DB. Ok, then I guess I have a faulty underst

[SAtalk] script to convert outlook .msg files

I am looking for a script that can convert the .msg file that is created when you copy an outlook message to a folder (out of the .pst tree) into text or some other usable format. Presently when I look at the file, the headers appear intact as does the content, it is however full of other extra

Re: [SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

At 10:54 AM 12/8/2003, Christopher X. Candreva wrote: I just opened a Bugzilla report for this: http://bugzilla.spamassassin.org/show_bug.cgi?id=2817 (SA 2.60, Solaris, perl 5.6.1) For the moment, I'd suggest a rule like this one that I just cooked up: body LOCAL_GAPPY_VIAG /\bV\Wi\Wa\

Re: [SAtalk] Re: Delete mail with a score above n

On December 08, 2003 02:02 pm, Chris Barnes wrote: > Mike D <[EMAIL PROTECTED]> wrote: > > > Does anyone know how to config spamassassin to delete messages with a > > score above a certain threshold? > > > Surely the answer is to post the same question 3 times. And posting in html is just adding

Re: [SAtalk] (no subject)

On Mon, Dec 08, 2003 at 01:11:06PM -0600, [EMAIL PROTECTED] wrote: > I'd like to back up the journal periodicly to disk. Right now I have There's really no point to that. Just sync the journal to the DB. > searching through the archives and docs, I've not found anything > regarding this issue.

[SAtalk] Re: Re: BIG HUGE EVIL RULE NEWS!!!!

Scott Harris <[EMAIL PROTECTED]> wrote: > Ahh, I bet ya'll are NotePad experts as well! UltraEdit. It converts the "unix to Dos" format automatically. ;-) -- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Chris Barnes AOL IM: CNBa

RE: [SAtalk] Weird Word patch

And forgive me for beating this to a pulp, but... The original double foreach loop looks to have split for each $line on all the ' ' (spaces) to create a word list, not a line list. Which should catch the number of that words that meet this obfu rule not lines. Lastly, given that you say eval c

[SAtalk] (no subject)

We've got SA 2.60 running on a Solaris 8 box with SunONE Messaging Server. It is doing spam scanning for all our users (~7000). In order to keep the system as speedy as possible, I've configured the bayes journal to sit on /tmp which is a memory file system. I'd like to back up the journal perio

[SAtalk] Re: Delete mail with a score above n

Mike D <[EMAIL PROTECTED]> wrote: > Does anyone know how to config spamassassin to delete messages with a > score above a certain threshold? Surely the answer is to post the same question 3 times. -- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Chris Barnes

[SAtalk] Re: Delete mail with a score above n

Bob Apthorpe <[EMAIL PROTECTED]> wrote: > Answers generally focus on: > > a) procmail Right. > b) how SpamAssassin only tags but doesn't delete mail, and Right. > c) how automatically deleting mail is probably a really bad idea He said "automatically delete OVER a certain score". Imho, there

RE: [SAtalk] Delete mail with a score above n

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Bob > Apthorpe > Sent: Monday, December 08, 2003 9:45 AM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Delete mail with a score above n > > > On Mon, 8 Dec 2003 12:25:56 -0500 "Bill" > <[EMAIL PROTECTED

RE: [SAtalk] bigevil.cf + rsync? - Windows version - sort of

Try here for a wget and a recode for Windows http://unxutils.sourceforge.net/ Here is a place for some Windows versions of fetchmail, etc. http://sourceforge.net/projects/unixmail-w32/ |-Original Message- |From: Barry Porter [mailto:[EMAIL PROTECTED] |Sent: Sunday, December 07, 2003 0

Re: [SAtalk] Order of precedence in rule sets?

At 12:21 PM 12/8/2003, mairhtin wrote: I have an oddity occuring. In my site-wide (local.cf) rules, I have some custom rules, but none concerning dell.com . I want one user to always get any mail from dell.com, but if other users get mail from that domain (or one spoofed to look like it) I want

Re: [SAtalk] Delete mail with a score above n

On Mon, 8 Dec 2003 12:25:56 -0500 "Bill" <[EMAIL PROTECTED]> wrote: > IMHO, the best way to handle html mail is bit-bucket the message and send a > note to the sender that html messages are not accepted by the server and > include a link on how to kill html in their mailer. ... except that most s

RE: [SAtalk] Delete mail with a score above n

Title: Message Please search the archives or RTFM, this subjesct has been covered dozens of times. -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mike DSent: Monday, December 08, 2003 12:09 PMTo: [EMAIL PROTECTED]Subject: [SAtalk] Del

RE: [SAtalk] Delete mail with a score above n

IMHO, the best way to handle html mail is bit-bucket the message and send a note to the sender that html messages are not accepted by the server and include a link on how to kill html in their mailer. --- This SF.net email is sponsored by: IBM

RE: [SAtalk] Negative score redux

> From: Matt Kettler > Sent: Monday, December 08, 2003 7:55 AM [...] > If you're doing a procmail/MDA type delivery, you can make accounts for > each user and start passing -u to spamc, and have the > all_spam_to's in each user's home directory. > > Other than that, there's not much you can do. I

[SAtalk] Order of precedence in rule sets?

Hello, I have an oddity occuring. In my site-wide (local.cf) rules, I have some custom rules, but none concerning dell.com . I want one user to always get any mail from dell.com, but if other users get mail from that domain (or one spoofed to look like it) I want the general rules and learnin

Re: [SAtalk] Delete mail with a score above n

Please check the FAQ or search the archives before you post questions to lists; this is a question that gets asked every couple of days, and the answer has been posted here and in the FAQ several times. If you're using procmail for local delivery, you can see another How-To here: http://thatitguy

[SAtalk] Delete mail with a score above n

Does anyone know how to config spamassassin to delete messages with a score above a certain threshold?Thanks! - MDMike DunlopAWN, Inc.// www.awn.com[ e ] [EMAIL PROTECTED][ p ] 323.606.4237Mike DunlopWe

Re: [SAtalk] Delete mail with a score above n

Bob Apthorpe wrote: On Thu, 04 Dec 2003 10:59:13 -0800 Mike D <[EMAIL PROTECTED]> wrote: Does anyone know how to config spamassassin to delete messages with a score above a certain threshold? This question gets asked every 3-5 days and really ought to be in the FAQ. Agreed, and it should pro

[SAtalk] Re: New spammer trick (HTML tables)?

On Mon, 8 Dec 2003 10:23:25 -0500, Pedro Sam <[EMAIL PROTECTED]> writes: > > Personally, I think the fundamental problem is HTML. HTML is too > > powerful of a display language to be filtered, and thats before > > JavaScript is added into the mix. Just look at the URL above. Almost > > all of thos

RE: [SAtalk] Weird Word patch

At 11:22 AM 12/8/2003, Mike Kuentz (2) wrote: Eval's return true/false if I'm not mistaken. Yes, they do.. But I suspect perl is like C, where any nonzero return value is "true". So it's less useful than it appears to return a count, but not harmful. It's probably better style to do what most of

Re: [SAtalk] What user to run SA-LEARN as ?

At 11:07 AM 12/8/2003, Vee Persaud wrote: I read the FAQ and saw something about using a different user to run sa-learn and that it might cause issues WRT to Bayes. Is this correct ? Yes, this is correct, unless you over-ride the bayes_path and file mode. I'm running sa-learn as "root" and spamd

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

> -Original Message- > From: Ralf Hildebrandt > Sent: Monday, December 08, 2003 6:52 AM [...] > > Use Postfix+amavisd-new+SpamAssassin -- and user D_DISCARD to drop the > spam on the gateway. What are the pros/cons of using sendmail+MIMEDefang+SA versus Postfix+amavisd-new+SpamAssassin?

Re: [SAtalk] another spamAssassin ???

At 11:08 AM 12/8/2003, gentian wrote: Is this SpamAssassin™ the same as this spamassassin here ? http://www.no-spam-today.com/?banner=GoogleNSTX2 The title of the page makes it pretty clear they are a windows installer for the open-source SA. The

RE: [SAtalk] Weird Word patch

I may be mistaken, but that would be any WORD that had: Any number of letters followed by punctuation followed by any number of more letters. Not very familiar with eval or it's return, but the regex looks right. I.E. counting number of occurrances of things like this... This,that th*at th&at

RE: [SAtalk] Weird Word patch

how would you use this? Eval's return true/false if I'm not mistaken. So any line with a comma or period would hit. Mike > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Brendan Burns > Sent: Wednesday, December 03, 2003 1:09 PM > To: [EMAIL PR

[SAtalk] SA timeout

Hi, I just set up a mailgateway with amavisd-new (20030616-p6) and SA (2.60). Unfortunately SA runs into some timeout every few minutes: * Dec 8 17:03:25 scanhub01 amavis[29257]: (29257-01-77) SA TIMED OUT, backtrace: at /usr/lib/perl5/5.8.0/i586-linux-thread-multi/IO/Selec

[SAtalk] another spamAssassin ???

Is this SpamAssassin™ the same as this spamassassin here ?   http://www.no-spam-today.com/?banner=GoogleNSTX2

[SAtalk] What user to run SA-LEARN as ?

I read the FAQ and saw something about using a different user to run sa-learn and that it might cause issues WRT to Bayes. Is this correct ? I'm running sa-learn as "root" and spamd as "spamd" (UID 196). --- This SF.net email is sponsored by

[SAtalk] Generic V-whatever drug with no GV rule hits (fwd)

I just opened a Bugzilla report for this: http://bugzilla.spamassassin.org/show_bug.cgi?id=2817 (SA 2.60, Solaris, perl 5.6.1) Funny thing is, the first line of the body was had the V word with spaces between each letter, yet it didn't hit any v-whatever rules. I would think simple spaceing of t

Re: [SAtalk] Negative score redux

At 10:02 AM 12/8/03 -0500, Owen Becker wrote: I have several users who are in all_spam_to in local.cf. It looks like spamassassin is giving negative scores to spam for other users when someone in all_spam_to is included in the headers. Anyone know of any quick fixes? Quick fixes, maybe, maybe not

[SAtalk] SA for mail gateway

Hi, Could anyone know how to set SA for a mail gateway? I have setup SA on a mail server, it is filtering mails for all users having inboxes on the same machine. The same mail server is a relay for some other accounts for which filtering is not happening. Any help would be appreciated. Thanks

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Ralf Hildebrandt > Sent: Monday, December 08, 2003 8:52 AM > To: gentian > Cc: [EMAIL PROTECTED]; Thomas Kinghorn > Subject: Re: [SAtalk] filtering spam tagged email before > hitting exchange 200

RE: [SAtalk] Re: DCC incidence

On my site DCC hits approximately 20% of False Positives also (that is, of the 1-2% of false positives, 20% have Razor hits), so don't give it too much weight. Razor2 is the worse for that (50% of false positives)... but I've weighted my scoring accordingly. Chris -

Re: [SAtalk] Re: New spammer trick (HTML tables)?

On December 08, 2003 09:55 am, Scott A Crosby wrote: > On 08 Dec 2003 11:00:22 +0200, [EMAIL PROTECTED] writes: > > > > On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> > > posted to spamassassin-talk: > > > > > It would be good to have a rule to match the general pattern. It's >

Re: [SAtalk] filtering spam tagged email before hitting exchange 2000

Title: Message The idea is that i am getting huge amounts of spam that are causing my email server to respond very slow. It actually fills up the SMTP queue. So i might leave the score high and leave some spam to go through but at least decresease some load to Exchange. by filtering some of

[SAtalk] Negative score redux

I have several users who are in all_spam_to in local.cf. It looks like spamassassin is giving negative scores to spam for other users when someone in all_spam_to is included in the headers. Anyone know of any quick fixes? Thanks, Owen --- This

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

Use amavisd-new and configure emails over a certain tag level to be redirected to a spam mailbox (in a mail-enabled public folder, for instance). Chris From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of gentianSent: Monday, December 08, 2003 8:50 AMTo: [EMAIL PROTECTED]Subjec

[SAtalk] Re: New spammer trick (HTML tables)?

On 08 Dec 2003 11:00:22 +0200, [EMAIL PROTECTED] writes: > On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> > posted to spamassassin-talk: > It would be good to have a rule to match the general pattern. It's > probably too much work to generate that sort of email by hand so > cha

Re: [SAtalk] filtering spam tagged email before hitting exchange 2000

* gentian <[EMAIL PROTECTED]>: > I will be using Fedora or Redhat Enterprise, one of two. > I am very new to spamassassin and i want to setup a gateway for > external spam and then i want to relay mail from spamassassin to > Exchange 2000. I read that spamassassin just tags the mail,

Re: [SAtalk] filtering spam tagged email before hitting exchange 2000

I will be using Fedora or Redhat Enterprise, one of two.     - Original Message - From: Thomas Kinghorn To: 'gentian' Sent: Monday, December 08, 2003 9:02 AM Subject: RE: [SAtalk] filtering spam tagged email before hitting exchange 2000 What platform and M

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

Title: Message It would be easy to set up a procmail rule to move all tagged spam into a folder on the SA machine however this is a very dangerous thing to do as falsely tagged mail (FP) will never be delivered and the recipient has no way to recover the mail. It is much better to just tag t

RE: [SAtalk] filtering spam tagged email before hitting exchange 2000

Hi Yes, there is. You can do that with Postfix regexp in header_checks: /X-Spam-Flag: Yes/ DISCARD HTH Philipp From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of gentian Sent: Montag, 8. Dezember 2003 14:50 To: [EMAIL PROT

[SAtalk] filtering spam tagged email before hitting exchange 2000

Hi list,   I am very new to spamassassin and i want to setup a gateway for external spam and then i want to relay mail from spamassassin to Exchange 2000. I read that spamassassin just tags the mail, doesn'filter it and i should filter it on Exhange 2000 and that was done by some other tools.

RE: [SAtalk] Adding another RBL

On Sun, 7 Dec 2003, Richard Bewley wrote: > Hmm, it looks as though this would be the problem: > > debug: is Net::DNS::Resolver available? no > debug: is DNS available? 0 Yup. If you're trying to run a DNS-based RBL, that'll stop you in your tracks. > Now, the next question, how do I go

[SAtalk] False Negatives increasing in number?

Hey, has anyone else seen false negatives increase in number over the last weeks? Although I think I have a pretty well-fed bayes database, I still get about one to three false negatives a day. This wouldn't normally interest me, but those mails are pretty dumb spam that _should_ be caught. Th

[SAtalk] Re: One persistent spammer defeating SA.

On Sun, 07 Dec 2003 17:19:26 -0500, Bryan Hoover <[EMAIL PROTECTED]> posted to spamassassin-talk: > Robert Nicholson wrote: >> Reply-To: <[EMAIL PROTECTED]> >> <[EMAIL PROTECTED]> >> Do we have a way of dealing with the spammer who's Reply-To's always >> look the same? > Oh, but it's

[SAtalk] Re: New spammer trick (HTML tables)?

On 06 Dec 2003 17:21:54 -0600, Scott A Crosby <[EMAIL PROTECTED]> posted to spamassassin-talk: > On Sat, 6 Dec 2003 22:04:15 + (GMT), Martin Radford > <[EMAIL PROTECTED]> writes: >> I don't know how new this trick is, but I've not seen it before -- the >> spammer is using HTML tables to bre

[SAtalk] Re: Mailer daemon mail in whitelist

On Sat, 06 Dec 2003 11:07:12 -0800, mairhtin <[EMAIL PROTECTED]> posted to spamassassin-talk: > I suppose that the correspondant line would be : > whitelist_from_rcvd [EMAIL PROTECTED] mail.techsolutionsgroupllc.com > since mail.techsolutionsgroupllc.com is our DNS server as well as > our

[SAtalk] Re: bigevil.cf + rsync?

On Fri, 05 Dec 2003 10:42:05 -0800, Kelson Vibber <[EMAIL PROTECTED]> posted to spamassassin-talk: > At 10:19 AM 12/5/2003, Chris Santerre wrote: >> All of Gary's posts read: >> Content-Type: text/plain; >> charset="utf-8" > And the digest is sent just as "text/plain" (is the default for emai

[SAtalk] Re: More .procmailrc

On Fri, 5 Dec 2003 15:59:28 +0100, Maurice Snellen <[EMAIL PROTECTED]> posted to spamassassin-talk: > On Friday, December 5, 2003 at 08:39 (which was Friday, December 5, > 2003 at 14:39 where I am) Satya wrote: >> :0: >> * ^X-Spam-Level: \*\*\*\*\*\*\*\*\* >> spam >> works for me. > I'm not