Re[2]: [SAtalk] detecting large collections of random words

Among the recommendations for detecting spam with bayes fodder within it, were: rawbody WORDWORD/[a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} / describe WORDWORD long string of random

[SAtalk] Oh Joy, another abusable URI redirector

Oh Joy, another abusable URI redirector. Saw this in a recent spam: http://www.google.com/url?q=http://cardtraffic.com Proposed rule: uri L_URI_REDIR3/http:\/\/www\.google\.com\/url?q=http:/i describe L_URI_REDIR3 open URI redirector #3 score L_URI_REDIR3 1.5 Dave -- Dave Fun

[SAtalk] Eurika? A baysean model for dealing with bayes poison.

On Thu, 08 Jan 2004 20:50:17 -0800, Chris Petersen <[EMAIL PROTECTED]> writes: > > Is there a > > SpamAssassin fix for it or some test I can increase to fix it?? > > Check the "lots of random words" thread from today for a couple of > (probably short-term) solutions... Other than that, I'm hopi

Re: [SAtalk] mailscanner

delete? seriously though, can you be a little more specific in your question and configuration? SA is a scorer of spam - it doesnt delete, move, zap, squash , or block natively.. Depending on your schema, you would use a MTA, maybe even another form of Anti-Spam filtration/gateway, or your end user

[SAtalk] Re: New spam slipping through

Bo Stark wrote: > The last few days a few new spams have flew under the radar and not been > caught. What they all have in common is that they have alot of random words > at the end of the mail. Been trying to feed them through Bayes without much > luck so far. The random words are known as bay

[SAtalk] Re: difference spamd <-> spamassassin, debian Setup. Very weird...

Konstantin Kletschke wrote: > I recently wondered why I get e-mails which seemed to not contain a > body. Investigating this further I relaized that these are multipart > mails which mostly contained only a html message, which mutt does > display as an attachement, if ever. This is off topic, but

Re: [SAtalk] New Spam Type

> Is there a > SpamAssassin fix for it or some test I can increase to fix it?? Check the "lots of random words" thread from today for a couple of (probably short-term) solutions... Other than that, I'm hoping that bayes will start picking up on some of the less common words that get tossed into

[SAtalk] Re: Re: Re: Subject contains username

[EMAIL PROTECTED] wrote: > [EMAIL PROTECTED] wrote on 01/03/2004 11:52:41 AM: Who wrote that? I think you need to double check your quoting machinery! > > Subject: Bug 08378 was submitted by Bob Proulx > > Subject: Bob is out Friday/Monday > > Subject: TWiki - Registration for BobProulx >

[SAtalk] Header Rewrite

Is there a way to get SPAM Assassin to post the values each test contributed to the total score in the header of the e-mail? Our installation is still kinda new, and we are working out all of the configurations bugs to get the false positive rate down. We're using spamassassin.dll in Kerio's mail

[SAtalk] New Spam Type

Sorry if this has been covered but I just joined the list and it is too complicated to search for. I have had SpamAssassin running well for several months now. But recently I have been getting 10-12 messages a day that have an image at the top, then about 50 valid, but nonsensical English words.

Re[2]: [SAtalk] Simple newbie question

Hello Steve, Thursday, January 8, 2004, 11:25:20 AM, you wrote: ST> On Thu, Jan 08, 2004 at 02:07:59PM -0500, John Fleming is rumored to have said: >> >> I want to specify a text string in the Subject header such that if it >> exists, the msg will NOT be considered spam, no matter what else migh

Re: [SAtalk] Is BigEvil for me?

Hello Bert, Thursday, January 8, 2004, 10:34:31 AM, you wrote: BR> I've been half heartedly watching the list and have noticed some BigEvil BR> updates. So, I looked at the bigevil site BR> (http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm). Is there any BR> reason I would not want

RE: [SAtalk] detecting large collections of random words

> Negative look-ahead is (?!...), not (?!=...). In your version, > the equals sign is part of the pattern to match, and since > anything that matches [a-z] can't be '=', the negative look- > ahead ends up doing nothing. Oops.. Shows how long it's been since I've done serious regex stuff (and I

RE: [SAtalk] detecting large collections of random words

Chris Petersen <[EMAIL PROTECTED]> wrote: > what about something like: > > /(?:\b(?!=(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){12}/ Negative look-ahead is (?!...), not (?!=...). In your version, the equals sign is part of the pattern to match, and since anything that matches [a-z] can't

RE: [SAtalk] detecting large collections of random words

> Looks good. just running this over a ham mail box with about 500 messages > and a spam mail box with the same, and not decoding base64 and such, I > see the following: what about something like: /(?:\b(?!=(?:from|even|more|were|with)\b)[a-z]{4,12}\s+){12}/ I'm trying to think of extremely comm

RE: [SAtalk] detecting large collections of random words

> Slightly better might be: > /(?:(\b[a-z]{4,12}\s+){12,})/ The surrounding (?:) doesn't actually do anything - you're just grouping the whole regex itself. Thus /(\b[a-z]{4,12}\s+){12}/ would work just as well. or /(?:\b[a-z]{4,12}\s+){12}/ if you wanted to make a slight optimization and not g

RE: [SAtalk] Bigevil 2.06f posted.

Sorry it took me so long to reply. I'm working from home today. (don't ask!, but no it isn't a hockey injury :p) Yup, the regex is getting slowy rewritten rule by rule. Faster processing. I still add more domains every update. I've actually pulled out a few that expired or were bogus as well. N

Re: [SAtalk] Problems installing Mail::SpamAssassin 2.60

On 8 Jan 2004 at 12:21, Bart E. Hawley Sr. wrote: > Redhat 7.1 > Kernel 2.4.2-2 That's kind of an old kernel for a machine connected to the Internet. Have you done security updates? The last kernel RH released for 7.1 was 2.4.20-28.7. > Mail::SpamAssassin 2.20 > Perl 5.6.0 There's also a new

Re: [SAtalk] Bayes reset

On Thu, Jan 08, 2004 at 05:51:45PM -0600, Kevin Roberts wrote: > Is there a way to tell the bayes learning system to forget everything and > start over from a clean corpus sa-learn session? The reason I ask is I may > have many emails that were auto posted and learned that were learned the > wrong

[SAtalk] Bayes reset

Is there a way to tell the bayes learning system to forget everything and start over from a clean corpus sa-learn session? The reason I ask is I may have many emails that were auto posted and learned that were learned the wrong way. I have 2.55 ver Thanks

[SAtalk] mailscanner

quick q? if SA is installed and working why would i install mailscanner? what does MS do that SA can't --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced

RE: [SAtalk] Thank you, thank you, thank you to the developers of SpamAssassin!

You forgot the part about the free Blaupunkt car stereos and Sony WEGA televisions. -tom > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of [EMAIL PROTECTED] > Sent: Wednesday, January 07, 2004 9:05 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk]

[SAtalk] add_header options for Razor2

If they exist, can someone point me to where the options are for add_header for Razor2 please? Thanks Alan --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advan

[SAtalk] Thank you, thank you, thank you to the developers of SpamAssassin!

I didn't feel like going to the trouble of subscribing to the dev list just to post a thank-you message, so I'll post it here. I want to thank all the developers and contributors to this terrific spam-marking program. I was able to install it on our incoming SMTP mail server here at Crutchfield

RE: [SAtalk] detecting large collections of random words

Here's a rule I wrote for just this sort of spam: rawbody WORDWORD/[a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} / describe WORDWORD long string of random words score WORDWORD 2.0 (Sorry if it wraps,

RE: [SAtalk] 1/2 OT - SA up2date debian package

I would go straight to the source at ftp.debian.org or http.us.debian.org, whichever you prefer. I currently have v2.6. [EMAIL PROTECTED]:~$ apt-cache show spamassassin Package: spamassassin Priority: optional Section: mail Installed-Size: 1988 Maintainer: Duncan Findlay <[EMAIL PROTECTED]> Archi

[SAtalk] DB_File is broken?

I just upgraded from Spamassassin 2.5? From an SUSE RPM to version 2.61 source. Everything was working fine but now I get an error doing anything with the bayes database. I reinstalled DB_File from CPAN but the error persists. Can anyone tell me what's wrong? Thanks, Michael Cloutier Use of uninit

[SAtalk] Is sa-learn supposed to take over 2 hours?

Hello, I've got SA 1.61 running with mailscanner in redhat 9. I'm trying to run: sa-learn -p /etc/MailScanner/spam.assassin.prefs.conf --spam --dir /var/spool/mail/cleveland And, it's been going for over 2 hours now. Does it normally take this long? Is there a -v or -h to see a hash, or verbose

Re: [SAtalk] Simple newbie question

The [brackets] are the problem, since they create a character class (that is, match anything with a b, or an r, or an a, or... You need to make it /\[text to look for\]/i if your text has [] in it. There are also a few other special characters you'd have to escape if they came up; +*?()[]\/ are t

Re: [SAtalk] Simple newbie question

On Thu, Jan 08, 2004 at 05:53:53PM -0500, WA9ALS - John is rumored to have said: > > header MY_CUSTOM_RULE Subject =~ /texttolookfor/i (I used the text I > wanted, which included square brackets - Is that a problem? - e.g. [text to > look for]) Square brackets are special characters within a re

RE: [SAtalk] detecting large collections of random words

> From: Chris Petersen [...] > > Yes. though I used: > > /(\b[a-z]{4,12}\s+){12}/ > > notice the initial /b, and there's no need to make SA continue to search > beyond the "minimum" match, so leave off the , in the last {} cluster. > Looks good. just running this over a ham mail box with about

RE: [SAtalk] SA name resolution

I'll try creating one. Thanks Theo. C:\Mark > -Original Message- > From: Theo Van Dinter [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 2:48 PM > To: Mark Squire > Cc: [EMAIL PROTECTED] > Subject: Re: [SAtalk] SA name resolution > > > On Thu, Jan 08, 2004 at 02:32:33PM -

Re: [SAtalk] Simple newbie question

> In your /etc/mail/spamassassin/local.cf, add this at the bottom: > > header MY_CUSTOM_RULE Subject =~ /texttolookfor/i > describe MY_CUSTOM_RULE My custom subject rule > score MY_CUSTOM_RULE -500 Hi Steve - I thought this was working, but it looks like I'm getting EVERY email scored w

Re: [SAtalk] CF Usage?

On Thu, Jan 08, 2004 at 04:44:03PM -0500, Jonathan Calvert wrote: > The tutorial only mentions adding rules to the local.cf file. If I place additional > .cf files in the /etc/mail/spamassassin dir, will they be included? Or should I > append my local.cf? All .cf files in /etc/mail/spamassassin

Re: [SAtalk] SA name resolution

On Thu, Jan 08, 2004 at 02:32:33PM -0800, Mark Squire wrote: > Why is it that I can do an nslookup on a particular server's A record , > and it's MX record successfully, but Postfix can't? Note the error > below when the server from that domain connects: > > Postfix/smtpd[1368]: connect from unkn

[SAtalk] add_header options for Razor2

If they exist, can someone point me to where the options are for add_header for Razor2 please? Thanks Alan --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advan

[SAtalk] SA name resolution

Hi all, Why is it that I can do an nslookup on a particular server's A record , and it's MX record successfully, but Postfix can't? Note the error below when the server from that domain connects: Postfix/smtpd[1368]: connect from unknown[IPAddress] And . . . Type=A: Host found but no data recor

Re: [SAtalk] Stopping SPAM with subjects like "Re: ABC, settled high under"

On Thu, Jan 08, 2004 at 04:20:09PM -0600, Scott Gurley is rumored to have said: > > Anyone have a rule to stop this type of spam for cable filters and more. I > get tons of these. They all have a subject like this: > Re: BUESQY, with a completely > Re: BAZYUQ, telegrams of inquiry > Re: ABF, conti

[SAtalk] Stopping SPAM with subjects like "Re: ABC, settled high under"

Anyone have a rule to stop this type of spam for cable filters and more. I get tons of these. They all have a subject like this: Re: BUESQY, with a completely Re: BAZYUQ, telegrams of inquiry Re: ABF, continued: love leaped I wrote this rule: body THE_2003_SPAM_PATTRN Subject =~ /Re: [A-Z]{1

Re: [SAtalk] Is BigEvil for me?

Jeez; I just read my own post, and thought a little clarification might be in order: the "IMHO, no" is in response to "Is there any reason NOT to use BigEvil", and not in response to the subject line. Is it Friday yet?! Apparently my brain already thinks it's Saturday and is camped out somewhere

[SAtalk] My custom rulesets for random-word spam

The first one, rnd_uc_char.cf, I've already sent to the list a few weeks ago. It detects spam like: Subject: Re: IFWYOJRK, he was writing X-Originating-IP: [rx359.netIP] (the RND_UC_CHAR pattern) and I've just updated it for a few new variants that have shown up in the past couple of days. The

[SAtalk] [RD] Chickenpox Update

Edited Chickenpox Set is now available. Please read the notes on the site before using the set! I love the set, but I have them scored higher than you might like. I would set the scores lower to test and then score them per your tastes/spam threshold. If you would like to wait for testing resul

Re: [SAtalk] send mail and spamassasin must be on the same machime

On Thu, 8 Jan 2004, Douglas Kirkland wrote: > On Thursday 08 January 2004 09:32, Ceva wrote: > > hi everybody, > > does sendmail and spamassassin must be on the same machine, or they can be > on diferent machines? > > They can be on different machines. You will have to call spamassassin with > sp

[SAtalk] CF Usage?

The tutorial only mentions adding rules to the local.cf file. If I place additional .cf files in the /etc/mail/spamassassin dir, will they be included? Or should I append my local.cf?

Re: [SAtalk] questions about how bayes scores...

--On Thursday, January 08, 2004 1:29 PM -0800 Chris Petersen <[EMAIL PROTECTED]> wrote: > And if they are NOT assigned more weight, they should be. "if a message > is fed to the bayes db as spam, the URL's should have additional weight, > such that if they're found in future messages, the URL ind

RE: [SAtalk] detecting large collections of random words

> -Original Message- > From: [EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 12:57 PM > > Would this regex make more sense? > > /([a-z]{4,12}\s){12,}/ Slightly better might be: /(?:(\b[a-z]{4,12}\s+){12,})/ --- This SF.net e

[SAtalk] questions about how bayes scores...

A friend of mine not on the list asked me to forward along a couple of questions - and I'm also curious to know the answers. Basically, he asks if the bayes filter assigns more weight to URI's and phone numbers, since spammers are much less able to change these than they are the actual message tex

RE: [SAtalk] detecting large collections of random words

BTW, I'm already seeing some random-word spam with random punctuation thrown in as well... Pierre Thomson -Original Message- From: Chris Petersen [mailto:[EMAIL PROTECTED] Sent: Thursday, January 08, 2004 4:18 PM To: [EMAIL PROTECTED] Subject: RE: [SAtalk] detecting large collections of

[SAtalk] (no subject)

Here is another one for BigEvil that I am getting a lot of: www.allsafetyproducts.biz Andrew Hoying --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced b

RE: [SAtalk] detecting large collections of random words

> Would this regex make more sense? > /([a-z]{4,12}\s){12,}/ Yes. though I used: /(\b[a-z]{4,12}\s+){12}/ notice the initial /b, and there's no need to make SA continue to search beyond the "minimum" match, so leave off the , in the last {} cluster. -- Chris Petersen Programmer / Web Designe

RE: [SAtalk] detecting large collections of random words

Would this regex make more sense? /([a-z]{4,12}\s){12,}/ Andrew Hoying [EMAIL PROTECTED] wrote on 01/08/2004 01:37:49 PM: > Here's a rule I wrote for just this sort of spam: > > rawbody WORDWORD/[a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z] > {4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [

Re: [SAtalk] newbie: windows binary as auto spam

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 08 January 2004 12:05, Geoffrey Lane wrote: > score MICROSOFT_EXECUTABLE 0.100 Try setting this to 10 or more. score MICROSOFT_EXECUTABLE 10.00 Douglas -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE//cHYSpWn8R0

RE: [SAtalk] newbie: windows binary as auto spam

You can change the score, yes, I infact, did the same thing. In the local.cf you put this line: score MICROSOFT_EXECUTABLE 100 HTH Thanks, James -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Geoffrey Lane Sent: Thursday, January 08, 2004 3:05 PM To

RE: [SAtalk] Is sa-learn supposed to take over 2 hours?

> > Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: lock > > failed: File exists > > I believe this usually means that a lock file from a previous > failed attempt > to update the bayes DB files already exists. Is there any > sort of lock file > in that directory (/etc/MailScan

RE: [SAtalk] detecting large collections of random words

Here's a rule I wrote for just this sort of spam: rawbody WORDWORD/[a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} [a-z]{4,12} / describe WORDWORD long string of random words score WORDWORD

RE: [SAtalk] Is sa-learn supposed to take over 2 hours?

> -Original Message- > From: Jody Cleveland [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 2:29 PM > To: 'Kang , Joseph S.' > Subject: RE: [SAtalk] Is sa-learn supposed to take over 2 hours? > > > Cool. I tried that, and now, after sitting for about 5 > minutes gives me >

RE: [SAtalk] Is sa-learn supposed to take over 2 hours?

> -Original Message- > From: Jody Cleveland [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 2:21 PM > To: 'David A. Carter'; '[EMAIL PROTECTED]' > Subject: RE: [SAtalk] Is sa-learn supposed to take over 2 hours? > > Ohh... So, I would want to run: > # sa-learn -p /etc/MailSca

RE: [SAtalk] Is sa-learn supposed to take over 2 hours?

> Something similar happened to me when using sa-learn. The > problem was i was > running sa-learn over an mbox-format file and didn't pass sa-learn the > --mbox switch, so it was just treating the entire file as one big huge > email. Also, make sure you run it over a mailbox that has all > the

Re: [SAtalk] Is BigEvil for me?

IMHO, no. I think BigEvil is good enough for general use (I am running it on about a dozen sites, one of whom is an ISP with about 500 customers). My $0.02 Rubin On Thu, 2004-01-08 at 13:34, Bert Rapp wrote: > I've been half heartedly watching the list and have noticed some BigEvil > updates.

[SAtalk] detecting large collections of random words

I've noticed that a lot of spams recently have been following the random-words technique, with very little "spam" content - often just an image or some obfuscated text. Has anyone given any thought to writing up a rule that detects a LACK of punctuation, or a lack of short words like a/and/the? I

[SAtalk] Once more, with feeling

Yes, no, maybe, don't care? Original Message Subject: [SAtalk] Does SA do this check: Date: Sun, 4 Jan 2004 18:04:27 -0800 From: John Rudd <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Some friends and I have noticed that some spam messages arrive with multipart/alternative me

RE: [SAtalk] Is sa-learn supposed to take over 2 hours?

Hi Martin, > There's --showdots, as mentioned in the man page. Thanks. I did -h for help and didn't notice that in there. > And yes, sa-learn can take some time to run, particularly on slower > machines. It also depends on how many messages are in the mailbox. > > Is /var/spool/mail/cleveland

Re: [SAtalk] Is sa-learn supposed to take over 2 hours?

At Thu Jan 8 19:06:10 2004, Jody Cleveland wrote: > > Hello, > > I've got SA 1.61 running with mailscanner in redhat 9. > > I'm trying to run: > sa-learn -p /etc/MailScanner/spam.assassin.prefs.conf --spam --dir > /var/spool/mail/cleveland > > And, it's been going for over 2 hours now. > Does

[SAtalk] newbie: windows binary as auto spam

i've added: score MICROSOFT_EXECUTABLE 0.100 score MICROSOFT 1 to my ~/.spamassassin/user_prefs but I still get windows binary as "ham", below the required hits and not autolearned as spam. I want to auto classify ANYTHING with a windows binary as spam. Is there another score, or option that I

Re: [SAtalk] Losing the war against spammers

On 8 Jan 2004 at 17:31, Odhiambo Washington wrote: > I am running 2.61 but still I seem to be losing this war, especially > against the chinese spammers. > I will highly appreciate all advise towards making this setup better. > Unfortunately, I cannot use bayes because of the filtering that I d

Re: [SAtalk] Is sa-learn supposed to take over 2 hours?

Jody said: > I'm trying to run: > sa-learn -p /etc/MailScanner/spam.assassin.prefs.conf --spam --dir > /var/spool/mail/cleveland > > And, it's been going for over 2 hours now. Something similar happened to me when using sa-learn. The problem was i was running sa-learn over an mbox-format file a

nice list this even to newbies! RE: [SAtalk] Simple newbie question

Hi >From being on here a while, this isn't the worst list in the world not like some of the egotistical tossers on the qmail list who spend time flaming *every* newbie (not to name any names). ;) Pete Also well impressed by SA and the support surrounding it. -Original Mess

Re: [SAtalk] Simple newbie question

Hi John: > This is my embarrassingly simple first post to this list, but I can't find > the answer. Be gentle with me - answer this and then I'll quietly leave the > list. > Some of us other newbies like the embarrassingly simple questions, otherwise we'd have nothing to respond to! Also, rath

Re: [SAtalk] Simple newbie question

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 08 January 2004 11:25, Steve Thomas wrote: > On Thu, Jan 08, 2004 at 02:07:59PM -0500, John Fleming is rumored to have said: > > > > I want to specify a text string in the Subject header such that if it > > exists, the msg will NOT be con

Re: [SAtalk] Simple newbie question

> Be sure to restart spamd (if you use it) after adding/changing things in your local.cf. THANKS to those suggesting a negative score - DUH! I understand why "0" doesn't accomplish anything - don't know why I couldn't see the value in a negative score! (Uh, and thanks for the reminder to restart

[SAtalk] patch for report scores in headers?

I remember seeing a patch at one point that would put report scores in the header summary report (so you know what resulted in the high score without having to run the message through again manually). Is this now a configurable feature? If not, does anyone know where the patch lives? Is there a

Re: [SAtalk] Simple newbie question

On Thu, Jan 08, 2004 at 02:07:59PM -0500, John Fleming is rumored to have said: > > I want to specify a text string in the Subject header such that if it > exists, the msg will NOT be considered spam, no matter what else might be > wrong with it. In your /etc/mail/spamassassin/local.cf, add this

Re: [SAtalk] Simple newbie question

How about giving the test a negative score? i.e. -20.0 Brad On Thu, 8 Jan 2004, John Fleming wrote: > > I want to specify a text string in the Subject header such that if it > exists, the msg will NOT be considered spam, no matter what else might be > wrong with it. -

Re: [SAtalk] Losing the war against spammers

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Genchev, Sergei writes: > >Yes, but the bayes portion isn't working. Why? Because when SA runs, it > >runs with the privileges of the user whose mail is being scanned. I > >believe bayes would require that SA (spamc) is run under a specific > >user, n

[SAtalk] Simple newbie question

This is my embarrassingly simple first post to this list, but I can't find the answer. Be gentle with me - answer this and then I'll quietly leave the list. I want to specify a text string in the Subject header such that if it exists, the msg will NOT be considered spam, no matter what else might

[SAtalk] Is sa-learn supposed to take over 2 hours?

Hello, I've got SA 1.61 running with mailscanner in redhat 9. I'm trying to run: sa-learn -p /etc/MailScanner/spam.assassin.prefs.conf --spam --dir /var/spool/mail/cleveland And, it's been going for over 2 hours now. Does it normally take this long? Is there a -v or -h to see a hash, or verbose

RE: [SAtalk] Log file config

> > When I'm debugging this system, I find that its obnoxiuos to > pick through > > the maillog to find the spamd messages. Does anyone have their logging > > configured to dump spamd messages in something like > /var/log/spamd ? Any > > suggestions on how to make this happen? > > > > -Russell >

RE: [SAtalk] Bigevil 2.06f posted.

> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of Upwood, Jim > Sent: Thursday, January 08, 2004 8:45 AM > To: Spamassassin-Talk (E-mail) > Subject: RE: [SAtalk] Bigevil 2.06f posted. > > I think he means smaller memory usage of the spamd proces

[SAtalk] Is BigEvil for me?

I've been half heartedly watching the list and have noticed some BigEvil updates. So, I looked at the bigevil site (http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm). Is there any reason I would not want to use bigevil? - This mail

[SAtalk] Problems installing Mail::SpamAssassin 2.60

Hello all,   I am sure this error has probably been covered at one time or another, but multiple searches of the archives have produced no results for me. I am trying to upgrade the site-wide SA on a server using CPAN and things seem to go fine. Until it gets to the rules_tests and then I get

Re: [SAtalk] send mail and spamassasin must be on the same machime

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday 08 January 2004 09:32, Ceva wrote: > hi everybody, > does sendmail and spamassassin must be on the same machine, or they can be on diferent machines? They can be on different machines. You will have to call spamassassin with spamc to ge

RE: [SAtalk] Losing the war against spammers

Are you running some of the additional checks such as the "BigEvil". I found that this made a world of difference. That catches 50% of my incoming spam alone. Gary -Original Message- From: [EMAIL PROTECTED] on behalf of Odhiambo Washington Sent: Thu 1/8/200

[SAtalk] Log file config

Hello, Thanks to those who pointed me to the Razor2 patch for being able to upgrade to 2.61. It worked, then the FVGT rules worked too! When I'm debugging this system, I find that its obnoxiuos to pick through the maillog to find the spamd messages. Does anyone have their logging configured to

[SAtalk] Re: Bonded Sender Program

"John Hall" <[EMAIL PROTECTED]> wrote: The whole point is that a sender posts a bond, which presumably is forfeited if they send spam. How do I go about reporting it? http://www.bondedsender.org/complaint/ Or send it to the bondedsender.org abuse email address. Kelson Vibber SpeedGate Communicati

Re: [SAtalk] RedHat init

Hmm ok. It is the one I have though. Thanks. Dennis Duval wrote: Dennis Duval wrote: Michael H. Collins wrote: I want to pass the debug command to spamassassin using the init scripts redhat supplies. For the life of me i cannot figure out where to insert the flag. Somewhere around line numbe

[SAtalk] SA 2.55, (?/?)

Received: from [EMAIL PROTECTED] by dude.myhost.com by uid 504 with qmail-scanner-1.20rc3 (clamscan: 0.60. spamassassin: 2.55. Clear:RC:0:SA:0(?/?):. Processed in 16.851793 secs); 08 Jan 2004 10:20:46 - Hello, The spam that get through my current filter setup always have this (?/?) scorei

RE: [SAtalk] Losing the war against spammers

>Yes, but the bayes portion isn't working. Why? Because when SA runs, it >runs with the privileges of the user whose mail is being scanned. I >believe bayes would require that SA (spamc) is run under a specific >user, no? One option that I see would be to copy your bayes database (7K spam and 1.5

Re: [SAtalk] RedHat init

Dennis Duval wrote: > Michael H. Collins wrote: >> I want to pass the debug command to spamassassin using >> the init scripts redhat supplies. For the life of me i >> cannot figure out where to insert the flag. >> > Somewhere around line number 24 you will see: > > SPAMDOPTIONS="-d -c -a -

Re: [SAtalk] RedHat init

Michael H. Collins wrote: > I want to pass the debug command to spamassassin using > the init scripts redhat supplies. For the life of me i > cannot figure out where to insert the flag. > Somewhere around line number 24 you will see: SPAMDOPTIONS="-d -c -a -m5 -H" append -D to the list

RE: [SAtalk] RedHat init

This is for Redhat 9.0, I'm not sure if it's in the same place for other versions. The init script reads from: /etc/sysconfig/spamassassin and if it is not found has it defined in the init script itself. You could add into the init script a debug option ala: debug) #Put what ever oth

RE: [SAtalk] Losing the war against spammers

If you can afford the network checks, both DCC and razor2 caught the four that I ran through SA. Combined, they gave it a score of 5.055 by the default scores. Tim Donahue > -Original Message- > From: Genchev, Sergei [mailto:[EMAIL PROTECTED] > Sent: Thursday, January 08, 2004 11:13 AM >

RE: [SAtalk] Bigevil 2.06f posted.

I think he means smaller memory usage of the spamd process, not smaller file size... -Jim Jim Upwood System Administrator Bond, Schoeneck, and King Syracuse, NY -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Harris Sent: Thursday, January 08, 200

RE: [SAtalk] Useful to compare sender domain with relay?

> I get a lot of these: > > Jan 2 14:53:38 linux1 sm-mta[22500]: i02MrVWw022500: > from=<[EMAIL PROTECTED]>, size=0, class=0, nrcpts=0, > proto=SMTP, daemon=MTA, > relay=200-168-30-167.dsl.telesp.net.br [200.168.30.167] > > Would a useful check be to reject anything where the relay > domai

RE: [SAtalk] send mail and spamassasin must be on the same machime

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ceva Sent: Thursday, January 08, 2004 9:32 AM To: [EMAIL PROTECTED] Subject: [SAtalk] send mail and spamassasin must be on the same machime hi e

RE: [SAtalk] Bigevil 2.06f posted.

>-Original Message- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Santerre >Sent: Thursday, January 08, 2004 6:42 AM >To: Spamassassin-Talk (E-mail) >Subject: [SAtalk] Bigevil 2.06f posted. > >Another update. Bunch of stragler FPs removed. Thank you Robert M! >Fas

[SAtalk] send mail and spamassasin must be on the same machime

hi everybody, does sendmail and spamassassin must be on the same machine, or they can be on diferent machines?

Re: [SAtalk] razor and spamassassin

On Thu, Jan 08, 2004 at 08:17:57AM -0600, SAtalk Mail User wrote: > I have a question i regards to razor2 and spamassassin - this is what I see > from my maillog, I have spamd in debug mode, I am wondering if you can tell me > if razor is being used. If so how can I tell that razor2 is being utili

Re: [SAtalk] Losing the war against spammers

* Genchev, Sergei <[EMAIL PROTECTED]> [20040108 19:13]: wrote: > >I have some mail that was received by this particular user. I have put > >the tarbal here: http://ns2.wananchi.com/~wash/SPAM/ and it is in > >Maildir/ format. > > >Looking forward to your observa

[SAtalk] checking local rbl list

Hello, I have setup a local RBL list on the server running spamassassin. How do I go about setting spamassassin to check the local copy of this rbl? Thank in advance, Dan -- Dan Spray, Director of Internet Operations [EMAIL PROTECTED] Connecting Point Norfolk, NE <

[SAtalk] Illinois Spam Law

Our new law as of 1/1/04, now if it was just enforceable !! http://www.spamlaws.com/state/il.html SCott At 10:13 AM 1/8/2004, Genchev, Sergei wrote: >I have some mail that was received by this particular user. I have put >the tarbal here: http://ns2.wananchi.com/~wash/SPAM/ and it is in >Maildi

  1   2   >