[SAtalk] Re: bayes permission errors (still)

On 22 Dec 2003, at 12:33, Robert Nicholson wrote: Since you're using bayes do you get the same errors when you try to use sa-learn? I have a nightly cron job that runs on most accounts that runs sa-learn over the contents of $HOME/Mail/sa-learn-spam, but I've not noticed the files getting change

[SAtalk] Re: bayes permission errors (still)

On 20 Dec 2003, at 12:25, Lukreme wrote: On 19 Dec 2003, at 22:15, Lukreme wrote: I set the permissions on all the bayes files to 700 for all users and I still ended up having them get switched to - after some period of time. Although, it appears that this time it was a couple of hours

[SAtalk] Re: bayes permission errors (still)

On 19 Dec 2003, at 22:15, Lukreme wrote: I set the permissions on all the bayes files to 700 for all users and I still ended up having them get switched to - after some period of time. Although, it appears that this time it was a couple of hours: One more datum, this does not happen

[SAtalk] Re: bayes permission errors (still)

On 19 Dec 2003, at 16:01, Lukreme wrote: On 19 Dec 2003, at 06:57, Theo Van Dinter wrote: On Fri, Dec 19, 2003 at 02:06:13AM -0700, Lukreme wrote: Now, somehow after processing a single message spamd has set the perms on the bayes_journal file to -- What is "bayes_file_mode" s

[SAtalk] Re: bayes permission errors (still)

On 19 Dec 2003, at 06:57, Theo Van Dinter wrote: On Fri, Dec 19, 2003 at 02:06:13AM -0700, Lukreme wrote: Now, somehow after processing a single message spamd has set the perms on the bayes_journal file to -- What is "bayes_file_mode" set to? By default it's 0700. It's

[SAtalk] bayes permission errors (still)

I make sure the permission on my bayes files are 644. I restart spamd. I tail the maillog $ psa spamd root61393 0.0 13.6 21968 16912 ?? Is1:20AM 0:00.90 /usr/local/bin/spamd -a -c -d (perl) First message comes in and is processed by spamd just fine. Dec 19 01:29:09 mail spamd[61

[SAtalk] Re: bayes permission errors

On 06 Dec 2003, at 16:19, Lukreme wrote: [stuff] I seem to keep having problems with bayes and permissions: bayes: bad permissions on journal, can't read: /home/kremels/.spamassassin/bayes_journal Learned from 0 message(s) (0 message(s) examined). bayes: bad permissions on journal, can&#

[SAtalk] Re: bayes permission errors

On 07 Dec 2003, at 01:02, David B Funk wrote: You've got spamd running as the user "postfix" (that "-u postfix" command line argument). Thus the user postfix needs to have write permissions to the bayes_* files. but in that directory listing you show: 4160 -rw--- 1 user staff 5111808 Dec 4

[SAtalk] bayes permission errors

spamd[33089]: Creating default_prefs [/root/.spamassassin/user_prefs] spamd[33089]: Cannot write to /root/.spamassassin/user_prefs: Permission denied spamd[33089]: Couldn't create readable default_prefs for [/root/.spamassassin/user_prefs] spamd[33089]: processing message <[EMAIL PROTECTED]> for

[SAtalk] Re: Productivity...long...

On 13 Nov 2003, at 07:40, Upwood, Jim wrote: 60.12% of our Incoming Internet E-mail is Spam! According to pflogsumm we are rejecting about 2.2 mails for everyone we accept. That's BEFORE SA even gets a crack at the messages. Mostly that is based on the cbl blacklist and attachment rejection of

[SAtalk] Re: scoring system and values...

On 12 Nov 2003, at 10:09, Covington, Chris wrote: And it doesn't help that Razor, DCC and Pyzor have a lot of users that report legitimate solicited commercial email as spam (the people that forget to uncheck "send me great offers" when they order a product from a vendor, and then report those vend

[SAtalk] Added Rules to local.cf, are they working?

I have SA running under freebsd: $ ls -ls /usr/local/etc/mail total 0 0 lrwxr-xr-x 1 root wheel 22 Nov 11 09:53 spamassassin -> /etc/mail/spamassassin $ ls -ls /etc/mail/spamassassin/ total 24 22 -rw-r--r-- 1 root wheel 21544 Nov 13 10:00 local.cf I've recently added a bunch of rules to SA

[SAtalk] Re: FROM_AND_TO_SAME Rule does not seem to work

On 12 Nov 2003, at 13:09, Gerhardt, Scott wrote:   ## Forged CAMI Header   header   __CLAIMS_FROM_CAMI    From  =~   /[EMAIL PROTECTED]/i   header   __NOT_CAMI_IP Received  !~   /\[206\.252\.197\.\d+\]/   meta FORGED_CAMI_RCVD  (__CLAIMS_FROM_CAMI && __NOT_CAMI_IP)   describe F

[SAtalk] Re: Updated Corn

On 11 Nov 2003, at 20:52, Jennifer Wheeler wrote: point bein'...i named them for me to remember, and knowing nobody else would be naming rules similar to mine, so adding rules would not be a problem. When i saw they were fairly lethal, and spammers started being even more blatant with what they d

[SAtalk] Re: Bounce all but whitelist

On 11 Nov 2003, at 16:07, Tim Merkel wrote: I have a client who wishes to only allow mail into his inbox that is explicitly allowed via his white list. Yahoo currently allows you to do this (which is where they got the idea). procmail -- This story shall the good man teach his son; And Crispin C

[SAtalk] Re: Updated Corn

On 11 Nov 2003, at 13:52, Jennifer Wheeler wrote: Popcorn Only - http://spamhammers.nxtek.net/popcorn.cf Backhair Only - http://spamhammers.nxtek.net/backhair.cf Weeds Only - http://spamhammers.nxtek.net/weeds.cf Why "Popcorn", "Backhair", and "Weeds"?? as opposed to "snarkle", "filgret", and "ash

[SAtalk] Re: Okay, this one makes me mad.. anybody see or stop this one yet? How did this get through!!!!! ?????

On 11 Nov 2003, at 16:51, Robert Leonard III wrote: X-Spam-Level: *** X-Spam-Status: No, hits=7.1 required=9.5 tests=BAYES_50,FVGT_u_ODD_PORT, OACYS_CONS_6,OPTO_HEADER,OPT_HEADER,RCVD_IN_NJABL,RCVD_IN_SORBS, WEIRD_PORT version=2.60 You set your level at 9.0 and ask how it got through? You L

[SAtalk] Re: Filtering.

On 11 Nov 2003, at 10:31, Rajdeep Larha wrote: I have successfully installed the SA. but I am not able to filer the content. Any stuff which I want to filter in there in the rules directory but not getting filter. What I have to do with this? For e.g I have to filter the vulgar stuff. But it does

[SAtalk] Re: scoring system and values...

On 11 Nov 2003, at 12:17, Larry Gilson wrote: I don't know if this really fits in this subject or not. However, I keep thinking while reading this thread if anyone considers real opt-in advertisements/messages that get tagged by SA (like from OshKosh, Travelocity, Lands' End, etc.) to be a FP or

[SAtalk] Re: Abused redirector URLs ?

On 11 Nov 2003, at 11:28, Matt Kettler wrote: At 11:47 AM 11/11/2003, Lukreme wrote: Quick (stupid) question. What is the best place to add rules where they will not get "blown away" via an upgrade? Right out of the rule-writing guide, section 1.2: I knew it was a stupid question when

[SAtalk] Re: Comments on CBL DNSBL (cbl.abuseat.org)

On 11 Nov 2003, at 10:09, Robert James Kaes wrote: Hi, Does anyone have any comments on the quality of the cbl.abuseat.org DNSBL? I noticed that it isn't used in SpamAssassin, but it is one of the black lists checked by spamcop. Is anyone else using this list? I use it a the postfix level to reje

[SAtalk] Re: What Dynamic IPs rbl list?

On 11 Nov 2003, at 07:30, Marcio Merlone wrote: I was wondering what rbl lists you guys use to block dynamic IP ranges. I will use it on a gateway relay-only server, which makes anti-virus and anti-spam and then forwards messages to end server. It's a postfix box. reject_rbl_client cbl.abuseat.or

[SAtalk] Re: Abused redirector URLs ?

On 06 Nov 2003, at 20:26, Keith C. Ivey wrote: Chr. von Stuckrad <[EMAIL PROTECTED]> wrote: I created the following rule for them # Special abused yahoo-redirector uri YAHOO_REDIR /srd.yahoo.com\/drst\/illuminating\/\*http:/ score YAHOO_REDIR 2 describe YAHOO_REDIRcontains url of

Re: [SAtalk] [MailServer Notification]To recipient: Message matched eManager setting and action was taken.

On 11 Nov 2003, at 01:45, David B Funk wrote: On Mon, 10 Nov 2003 [EMAIL PROTECTED] wrote: The following mail was blocked since it contains sensitive content. Love the stupid -PC- double-talk here. Gee, what was the content sensitive to? (is it sensitve to light, heat, shock...) Stupidity, of cours

[SAtalk] Re: filebased whitelisting

On 10 Nov 2003, at 01:32, peter pilsl wrote: to avoid false posetives (which is at a rate of approx. 0.2% now) I'd like to whitelist my whole adressbook. My adressbook is changing/growing, so I would like not to implement it using 500 "whitelist_from"-configs but put it to a file and have a sing

[SAtalk] Re: scoring system and values...

On 10 Nov 2003, at 07:33, Terry Milnes wrote: The typical user is capable of making toast in his electric toaster, but when it comes to the overwhelming complexities involved in operating a computer he is totally lost. He will become extremely agitated when he looses the *REALLY IMPORTANT* email

[SAtalk] Re: scoring system and values...

On 08 Nov 2003, at 06:46, Terry Milnes wrote: Some of us though are system administrators and need a solution to offer to the end users. The typical end user wants to open their email and see no spam, period. Since the definition of spam varies from person to person that is simply not possible

[SAtalk] Re: scoring system and values...

On 08 Nov 2003, at 22:34, Dan Kohn wrote: I recommend allowing mistake-based training of the small number of false negatives (I use procmail for this as described at ). that link does not load. -- we all have our moments when we lose it the key is thou

[SAtalk] Re: scoring system and values...

On 07 Nov 2003, at 08:29, Maarten J H van den Berg wrote: Just being curious at how this system came about... As I understand it by feeding millions of spam and ham messages to the filters and seeing what sticks. Now, for your purposes, subjects with [word blacklisted by stupid list server] migh

[SAtalk] Re: Postfix Spamtrap Configuration

On 31 Oct 2003, at 14:54, Patrick von der Hagen wrote: If your users use IMAP it might be easier to have them copy their mails to a special folder (either a private one or a shared one) and have spamassassin regularly learn all mails in this folder(s). I'm interested in this approach. What is th

[SAtalk] Re: (not) up to date SpamAssassin

On 05 Nov 2003, at 18:01, Matt Kettler wrote: CPAN thinks of them both as 2.60, and doesn't differentiate between finals and RC's. Ah... I thought CPAN was smarter than that. Thanks. -- The older you get the more you need the people you knew when you were young. -

[SAtalk] (not) up to date SpamAssassin

My spam assassin is still 2.60-rc6: X-Spam-Status: No, hits=-4.8 required=5.0 tests=BAYES_00,CLICK_BELOW autolearn=ham version=2.60-rc6 So cpan> install Mail::SpamAssassin CPAN: Storable loaded ok Going to read /home/kreme/.cpan/Metadata Database was generated on Sun, 02 Nov 2003 12:45:5

[SAtalk] Re: Custom Rule question..

On 05 Nov 2003, at 17:00, Robert Leonard III wrote: I'd like to add negative points to an email that comes in saying: " I love Fuzz99.com's products!" But to NOT add these negative points if it says: "[EMAIL PROTECTED], you are a winner!" well, in regex you would say /[EMAIL PROTECTED]/ -- "Queen

[SAtalk] (not) up to date SpamAssassin

My spam assassin is still 2.60-rc6: X-Spam-Status: No, hits=-4.8 required=5.0 tests=BAYES_00,CLICK_BELOW autolearn=ham version=2.60-rc6 So cpan> install Mail::SpamAssassin CPAN: Storable loaded ok Going to read /home/kreme/.cpan/Metadata Database was generated on Sun, 02 Nov 2003 12:45:5

[SAtalk] X-SA-Relays-Trusted

After updating to SpamAssassin 2.60-cvs I noticed this new SA header. Great idea. Now, where can I find documentation on it? Or is that something I need to wait for? I did try searching the archives, but "No matches found for X-SA-Relays-Trusted" and "No matches found for Relays-Trusted" --

[SAtalk] Re: Forwarding ham to another mailbox (using .forward)

On Thursday, May 8, 2003, at 10:58 Canada/Mountain, Bill Horsman wrote: On Thu, 2003-05-08 at 17:22, Theo Van Dinter wrote: On Thu, May 08, 2003 at 05:12:34PM +0100, Bill Horsman wrote: But my question is: how do I get SA to forward just ham mail to my bill-cp mailbox? Add a rule to your procmailrc

[SAtalk] Ham/spam aliases

Has anyone setup local mail aliases for ham and spam? What I want is when someone receives a mail that is spam but not marked by SA, they "redirect" the message to a "this-is-spam" email alias, which then runs it through sa-learn -spam similarly, there would be a "this-is-ham" address for sa-le

[SAtalk] Re: Thanks for nothing

On Friday, Feb 28, 2003, at 06:17 Canada/Mountain, Kevin Morwood wrote: An interesting side-bar... When my previous message arrived through the maillist it was immediately moved to the trashbin since the filter phrase was found in the message. I might have to improve my filter slightly. :-) if

[SAtalk] Re: Thanks for nothing

On Friday, Feb 28, 2003, at 03:20 Canada/Mountain, Daniel J. Rachlin wrote: Your format change makes it so that I cannot filter and junk your messages from Outlook anymore. The **SPAM*** was obviously a good recognizable filter pattern. Way to make a positive impression! Congrats fro e

[SAtalk] COmbining Bayes data?

I meant to setup SA 2.5 with a unified Bayes filter but didn't remember to do it. Now I have, but I want to preserve the bayes training that has already gone on since I did not preserve the spam ovr the last week or so... So, can I? -- It was intended that when Newspeak had been adopted once

[SAtalk] Re: FORGED_MUA_OUTLOOK rule?

On Friday, Feb 28, 2003, at 01:18 Canada/Mountain, Cliff Sarginson wrote: Mmm. I don;t know if this relevant but despite the name Outlook Express and Outlook have no relationship to each other (except their origin of course). They write similar headers. -- Living is easy with eyes closed, misunde

[SAtalk] Re: Newsgroup spam (was: Totally new kind of spam)

On Thursday, Feb 27, 2003, at 11:54 Canada/Mountain, John Rudd wrote: Hipcrime was far from the first, and contrary to what LuKreme says, it definitely is spam. It's just not commercial in nature. Depends on your definition of spam. Mine is "Unsolicited commercial email" since th

[SAtalk] Re: Spam Arrest is spamming

On Thursday, Feb 13, 2003, at 12:22 Canada/Mountain, Matt Kettler wrote: Well, if the allegations are true, It's likely to be a one-time mailing after all the flack they're about to get (ie: they aren't going to be making THAT mistake for very long) According to their user agreement they are

[SAtalk] Re: From being cut off

On Thursday, Feb 13, 2003, at 10:10 Canada/Mountain, Jeremy Simmons wrote: I'm seeing a problem where the F in From at the beginning of some mails is cut off corrupting the mailbox. I'm running: This is not a SA problem, this is a procmail bug. It's been around a long time. No one has quite tr

[SAtalk] Re: .cf option to not put in X-Spam-Status

On Friday, Oct 25, 2002, at 13:06 Canada/Mountain, Robert Carsey wrote: I've read through the man page for Mail::SpamAssassin::Conf and did not find any option which will allow me to tell Spamassassin "hey, I don't want any X-Spam-Status" headers in my message. My boss doesn't want that line (and

Re: [SAtalk] porn rules

Yevgeniy Miretskiy wrote: > None of the porn rules fired on this message: well, unless the phrase "her ass[!|?|.|,]" is in the porn filter, why would it? --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkge

Re: [SAtalk] SpamAssassin - Additional Rating System

At 08:44 7/12/2002 -0700 Steven Stringham wrote: >I am looking to filter my entire domain's email through SpamAssassin. >Sendmail + spamass-milter. > >I am however, concerned with letting valid emails through (we are a Law >Firm). If I were to kill valid messages, there would be real problems. > >

Re: [SAtalk] Fake IPs

On Saturday, June 1, 2002, at 08:38 PM, Theo Van Dinter wrote: > On Sat, Jun 01, 2002 at 09:10:24PM -0400, Patrice Fournier wrote: >> Would any of you have a rule to catch fake IPs in received: header lines? >> Something to catch received lines like the followings: > > I catch the bad IPs in procm

Re: [SAtalk] First of two problems - implementing user "opt-out" from spamassassin...

On Wednesday, May 15, 2002, at 11:48 AM, dman wrote: > | :0: > | * X-Spam-Level: ** > | /dev/null > > Are you sure this does what you think it does? I think this regex > reads like this : > > 0 or more occurences of Well, I typed it in, not copied and pasted. So yes, you need to escape

Re: [SAtalk] First of two problems - implementing user "opt-out" from spamassassin...

On Tuesday, May 14, 2002, at 08:24 PM, Sidney Markowitz wrote: > On Tue, 2002-05-14 at 18:28, Ron Carter wrote: > > :0: > * ^X-Spam-Status: Yes > /dev/null > } > > I agree with Theo that piping to /dev/null is not a good idea because > spamassassin is > not perfect. I have :0: * X-Spam-Level

Re: [SAtalk] Re: Ick Viruses!

> I added my own rule to check the message body (no mime-parsing) > instead of the Content-Type: header since klez usually comes as an > attachment : That looks pretty nice. Can procmail do that as well? (Never used procmail except to trigger SA). If so, that would solve the problem for me as

Re: [SAtalk] rule for IMG

> There's a lot of nonspam which uses IMG too, thing like Amazon order > confirmations, fancier newsletters, etc, etc. Still, might be the case > that it's a useful rule with a low score. But is it more useful than the HTML check? Is there a reason to have both? -- You are responsible for y

[SAtalk] Re: Ick Viruses!

On Saturday, May 4, 2002, at 02:26 AM, Daniel Pittman wrote: > On Sat, 4 May 2002, LuKreme wrote: >> OK, I know SA is not an anti virus tool, and frankly I don't care >> about viruses anyway, but I am getting a lot of exe file attachements >> the last day or two >

[SAtalk] Ick Viruses!

OK, I know SA is not an anti virus tool, and frankly I don't care about viruses anyway, but I am getting a lot of exe file attachements the last day or two Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from localhost (localhost [127.0.0.1]) by mail.syth.serveftp.ne

Re: [SAtalk] Brute force spam prevention for NSP's

On Friday, May 3, 2002, at 06:57 PM, Olivier Nicole wrote: > install SA and silently drop spam traffic. Oooo! that is clever. I like it I like it. -- You are responsible for your rose. ___ Have big pipes? SourceForge.net is looking

Re: [SAtalk] rule for IMG

On Friday, May 3, 2002, at 05:23 PM, Kaitlin Duck Sherwood wrote: > I don't even bother trying to parse to make sure it's an HTML tag: the > only English-language word with I-M-G in it is the city Pri.m.ghar, Iowa > -- population 950. There are a few acronyms -- Inside Macintosh Games, > for e

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

> > Running spamd? Did you restart it after changing local.cf? Ahh, no I didn't. Thought it got read for each message. Guess that seems silly now. -- You are responsible for your rose. ___ Have big pipes? SourceForge.net is lo

Re: [SAtalk] Detecting local spammers

> On Fri, May 03, 2002 at 11:09:53AM -0400, CertaintyTech - Ed Henderson > wrote: | This question is not SA specific but just a general email > sysadmin type | question: What is an effective way to monitor my own > dialup customers to | see if any are abusing their email privilege by > sending

RE: [SAtalk] Turning on SA sitewide, overriding on a per-user basis?

> You could add an entry to the main procmailrc that checks for the > existence of a certain file called "nospamcheck" (or something like > that). IF the file exists in the users dir then don't run spamc > otherwise run spamc. Then put "nospamcheck" in each of the user's dir > that do not want

Re: [SAtalk] ${token1} Leave your debt problems behind you (fwd)

> This is really spam - should we not have something that matches credit > card debt? Submitted to razor. Not to mention the key phrase "cut [your] interest rate" -- You are responsible for your rose. ___ Have big pipes? SourceFo

Re: [SAtalk] Detecting local spammers

> This question is not SA specific but just a general email sysadmin type > question: What is an effective way to monitor my own dialup customers > to see if any are abusing their email privilege by sending out spam? I > am using qmail. Somehow monitor the volume that each local IP is > sendin

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

OK, so I decided to drop the value of X_OSIRU_SPAM_SRC to 2.9 (from 3.0) so I made changes to the existing local.cf file: % cat /etc/mail/spamassassin/local.cf # Add your own customisations to this file. See 'man Mail::SpamAssassin::Conf'# for details of what can be tweaked. # score X_OSIRU_SPA

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

On Thursday, May 2, 2002, at 06:19 PM, dman wrote: > /etc/spamassassin/99_local.cf Any particular reason not to put it in /etc/mail/spamassassin/local.cf? I mean, is th 99_ significant? -- You know you've achieved perfection in replying to a list message, not when you have nothing more to add

RE: [SAtalk] Re: RATWARE rule and manual vs. GA scores

Craig R Hughes said: > and have not just two, but maybe 3-4 levels of porniness. Many levels of porniness would be good. :-) [sorry, couldn't resist] Now, on topic, if I get messages from a mailing list that test out as spam I know I can whitelist the mailing list. whitelist_to [EMAIL PROTECT

Re: [SAtalk] More SA site-wide stuff

On Thursday, May 2, 2002, at 01:00 AM, LuKreme wrote: > On Thursday, May 2, 2002, at 12:50 AM, Craig R Hughes wrote: >> LuKreme wrote: I-R-A-MORON. sigh. Hey, NOTHING I read said I had to explicitly turn on procmail in the master. cf file for postfix. And I searched DOZENS of sit

Re: [SAtalk] Re: RATWARE rule and manual vs. GA scores

On Thursday, May 2, 2002, at 01:04 AM, Michael Moncur wrote: > I'm sure it's better than the current PORN_3 regardless. But will generate more false positives if you have any friend who like the word "puss{ies|y)" and use it a couple of times in an email along with "dick." Like, "That dick is

Re: [SAtalk] More SA site-wide stuff

Looking through /etc/mail/sendmail.cf I see this: ##*## ### PROCMAIL Mailer specification ### ##*## # $Id: procmail.m4,v 1.1.1.3 2000/06/10 00:40:39 wsanchez Exp $ # Mprocmail, P=/usr/bin/procmail, F=DFM

Re: [SAtalk] More SA site-wide stuff

On Thursday, May 2, 2002, at 12:50 AM, Craig R Hughes wrote: > LuKreme wrote: > > L> On Wednesday, May 1, 2002, at 11:46 PM, Kelsey Cummings wrote: > L> > LOGABSTRACT=all > L> > LOGFILE=/var/log/prcmail.log > L> > VERBOSE=YES > L> > L> I did th

Re: [SAtalk] More SA site-wide stuff

On Wednesday, May 1, 2002, at 11:46 PM, Kelsey Cummings wrote: > LOGABSTRACT=all > LOGFILE=/var/log/prcmail.log > VERBOSE=YES I did this about 2 hours ago. Actually, closer to 3. I've send numerous copies of the spam to various email accounts and have seen nothing in procmail.log. I know tha

Re: [SAtalk] spamd/spamc with Postfix

Craig R Hughes said: > Yup, here you go, take a look at the spamproxy subdirectory in the > distribution! So for postfix one should use spamproxyd instead of spamd/spamc? Doesn't taht counter the sitewide instructions for using /etc/procmail :0fw | spam c ??? If spamproxy is better or easier

[SAtalk] Turning on logging with spamd?

I would like to enable some sort of logging on spamd so that I can see exactly why most of the incoming spam is NOT getting marked as spam. Even when sending the sample-spam.txt file it doesn't "ring up" as spam on all my local accounts. It does on some, not on others. all I see is the not v