Re: [SAtalk] surprising low score for this spam mail

2004-01-30 Thread Bill Landry
- Original Message - From: "Andreas J Koenig" <[EMAIL PROTECTED]> > I wonder why spamassassin didn't calculate a higher score for this mail. > > Are not "adu1t", "p0rn", and "m0vies" words that trigger some spam > points? Try Jennifer's chickenpox ruleset, it is geared to catch these. Y

Re: [SAtalk] new chicnpox --lint failed

2004-01-26 Thread Bill Landry
- Original Message - From: "Arpi" <[EMAIL PROTECTED]> > After upgrading chichekpox to Version 1.11, spamassassin --lint fails on > every server i tried (spamassassin 2.62, perl 5.8.2). > i've tried re-downloading many times, no change, the error is still there: > > [EMAIL PROTECTED]:~$ sp

Re: [SAtalk] Mass-Check

2004-01-11 Thread Bill Landry
Wow, very nice Bob! Thanks for sharing this with the list. I'll give it a try this next week and see how it goes. Bill - Original Message - From: "Robert Menschel" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, January 11, 2004 3:31 PM Subject: [SAtalk] Mass-Check > Some pe

Re: [SAtalk] Newbie: delete only spam from server

2004-01-11 Thread Bill Landry
Check-out amavisd-new, it can invoke SA and, based on the result score, apply any of several different options, including quarantining or discarding the message. Bill - Original Message - From: "Andrew Cranson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, January 11, 2004 2:0

Re: [SAtalk] Email Not Caught

2004-01-07 Thread Bill Landry
- Original Message - From: "Andy Donovan" <[EMAIL PROTECTED]> > I'll need to be enlightened on what BIGEVIL > is .. is it really that simple .. drop the file into > your SA folder?? or am I confussed ? Drop it into the directory where your local.cf file lives (typically /etc/mail/spamas

Re: [SAtalk] [RD] Chickenpox Update

2003-12-31 Thread Bill Landry
- Original Message - From: "Martin Radford" <[EMAIL PROTECTED]> > At Thu Jan 1 00:53:48 2004, jennifer wrote: > > > Bill Landry contacted me with some nice edits on Chickenpox. More > > punctuation included (in addition to "."), and the s

Re: [SAtalk] Bigevil 2.05m updated + question for devs

2003-12-29 Thread Bill Landry
Chris, check the "uri BigEvilList_14" line, you have a couple of dots "." in front of the escape character "\" instead of behind it. That's what's causing the "Illegal octal digit" warning when you --lint the new BigEvil.cf file. Bill - Original Message - From: "Chris Santerre" <[EMAIL P

Re: [SAtalk] NJABL Dialup test

2003-12-23 Thread Bill Landry
- Original Message - From: "Mike Grau" <[EMAIL PROTECTED]> > Can someone tell me if, using SA 2.61, the > NJABL test for dialup "dnsbl.njabl.org" is correct > or should we be using "dynablock.njabl.org"? You can use either or both. This from a recent update message from NJABL: For anyo

Re: [SAtalk] SPF Support in SA?

2003-12-20 Thread Bill Landry
- Original Message - From: "Theo Van Dinter" <[EMAIL PROTECTED]> > On Sat, Dec 20, 2003 at 11:49:37AM -0800, Bill Landry wrote: > > I was wondering if the SA developers are considering adding support > for > > "Sender Permitted From" (SPF) i

[SAtalk] SPF Support in SA?

2003-12-20 Thread Bill Landry
I was wondering if the SA developers are considering adding support for "Sender Permitted From" (SPF) in SA, as defined at spf.pobox.com? I have been using a product call Declude JunkMail, that just added SPF support in a beta version of their product, and it seems to be working quite well. Altho

Re: [SAtalk] DCC ? Vipul's Razor? skip_rbl_checks?

2003-12-15 Thread Bill Landry
Did you install the Razor, DCC, and Pyzor modules? If you enable them in local.cf without actually installing the modules, spamassassin will simply ignore those settings. You can test by running: spamassassin -D --lint to see if it reports any errors or finds the necessary modules. Bil

[SAtalk] Score reduction test

2003-12-15 Thread Bill Landry
Is there a way to retrieve the MX/A record info from spamassassin via a .cf based test? I would like to be able to build a score reduction test that will help legit messages get delivered. Here are my thoughts: HELO & "A" record & rDNS domain match -1 HELO & "A" record & rDNS & MAILFROM domain

Re: Custom Rules (was Re: [SAtalk] Clever spam (first of many, I'm afraid...))

2003-12-15 Thread Bill Landry
You can add them to your local.cf file, if you want. However, I would simply drop them into the same location of your local.cf file, typically located at /etc/mail/spamassassin, and just make sure you use a .cf extension. Spamassassin will read all files in that directory that end in .cf. If you

[SAtalk] chickenpox.cf

2003-12-13 Thread Bill Landry
Jennifer, I have been testing your chickenpox.cf rules, and I noticed that there is plenty of other punctuation marks besides the period "." that are also being used between the letters of works to obfuscate them. So I modified you rules a bit from, for example: /\s[a-zA-Z]{9}\.[a-zA-Z]{1}[ ,'\?!

Re: [SAtalk] Detecting strings of Gibberish

2003-12-11 Thread Bill Landry
Hmmm, Jennifer was hosting her excellent rules at http://spamhammers.nxtek.net, but the site appears to be inaccessible right now. You can also fine them at http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm, listed as: popcorn.cf, backhair.cf, and weeds.cf. There may be a combined set

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
CTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 10, 2003 10:16 AM Subject: RE: [SAtalk] Using dccifd instead of dccproc > Do you have an example of how to configure the dcc_conf? The INSTALL.txt > and dccifd.html offers very little on this. > > <> > > >

Re: [SAtalk] Using dccifd instead of dccproc

2003-12-10 Thread Bill Landry
It should already be installed at /var/dcc/libexec/dccifd (depending on your ./configure parameters). All you have to do is setup the config files at /var/dcc/dcc_conf and /var/dcc/libexec/start-dccifd, then execute start-dccifd and you should be good to go. Oh, and appears to run faster in our e

Re: [SAtalk] FW: Can I auto report spam to Razor & DCC using spamassain?

2003-12-09 Thread Bill Landry
- Original Message - From: "stan" <[EMAIL PROTECTED]> > It occurs to me that the world might be a better place if these databases > get updated as quickly as possible. > > Can I instruct Spamassain to do this upon detection, instead of waiting for > me to get around to reading my mail and

Re: [WL] Re: [SAtalk] ATTN DEVELOPERS: Rule out-of-date??

2003-12-06 Thread Bill Landry
- Original Message - From: "Charles Gregory" <[EMAIL PROTECTED]> > On Sat, 6 Dec 2003, Matt Kettler wrote: > > There are a lot of outlook 2003 related bugs that have recently been fixed > > in CVS and are slated for 2.61.. > > http://bugzilla.spamassassin.org/show_bug.cgi?id=2344 > > htt

Re: [SAtalk] New dnsbl to use?

2003-10-18 Thread Bill Landry
- Original Message - From: "Jonathan Nichols" <[EMAIL PROTECTED]> > Hey all, > http://www.au.sorbs.net/ <---looks kind of neat. Is there any way to > write a rule to have SpamAssassin peek at it? I'm guessing that the > answer is "yes" but the obvious fact is that I have no idea how to do

[SAtalk] Fw: BLOCK,MISC: MONKEYS.COM: Now retired from spam fighting

2003-09-23 Thread Bill Landry
Well this makes it official, monkeys.com has regrettably thrown in the towel. Bill - Original Message - From: "Ronald F. Guilmette" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 22, 2003 4:40 PM Subject: BLOCK,MISC: MONKEYS.COM: Now retired from spam fighting > It

[SAtalk] How to process a local DNS query?

2003-09-16 Thread Bill Landry
I wanted to setup an RHSBL test that would simply query my local DNS server for a host "A" record. Here is what I attempted to do, however, this does not work: header RCVD_IN_VERISCAM eval:check_rbl_from_host('veriscam', '.', '64.94.110.11') describe RCVD_IN_VERISCAMVERISCAM: bogus e-ma

Re: [SAtalk] The Verisign folly

2003-09-16 Thread Bill Landry
- Original Message - From: "Kai Schaetzl" <[EMAIL PROTECTED]> > Anyone knows a workaround for sendmail, so that it knows that any domain > pointing to 64.94.110.11 isn't valid? I use Postfix, but if Sendmail support RHSBL lookups, point the zone to ".", which will process an "A" record q

[SAtalk] How to use trusted_networks setting?

2003-08-14 Thread Bill Landry
When I attempt to use the trusted_networks setting in my local.cf file, I get the following: spamassassin -V SpamAssassin version 2.55 spamassassin --lint Failed to parse line in SpamAssassin configuration, skipping: trusted_networks 192.168/16 127/8 debug: Failed to parse line in SpamAssassin c

[SAtalk] Querying several RBLs

2003-08-14 Thread Bill Landry
I am a new subscriber to both the Amavis and Spamassassin lists. I've recently installed Amavisd-New and Spamassassin/Razor2/DCC on a RedHat 9/Postfix 2 server. I am cross-posting this question to both lists since I'm hoping that someone on one of the lists will be able to point me to what I'm mi

Re: [SAtalk] How to use trusted_networks setting?

2003-08-10 Thread Bill Landry
- Original Message - From: "Theo Van Dinter" <[EMAIL PROTECTED]> > Are you using 2.60? It's a new option. Thanks, upgraded to 2.60 and it's working beautifully now! Bill --- This SF.Net email sponsored by: Free pre-built ASP.NET sit

Re: [SAtalk] Fw: Querying several RBLs

2003-08-10 Thread Bill Landry
- Original Message - From: "Matt Kettler" <[EMAIL PROTECTED]> > I know nothing about amavis, but SA will always query all of the RBL's that > have a score greater than zero. (or none at all if you use the -L > parameter). It does not even have the option of being configured to "only > che

[SAtalk] Fw: Querying several RBLs

2003-08-08 Thread Bill Landry
I apologize in advance if this is a redundant post. I sent the message below to the list yesterday after subscribing, but have not seen it come back from the list yet, so I'm trying again. Any and all responses appreciated! - Original Message - > I am a new subscriber to both the Amavis