Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Rich Puhek ([EMAIL PROTECTED]) had this to say on 01/13/04 at 15:45: > > I put together a little script to generate a summary. An example recent > spam gives the following output: Looks nice. However, the mail has already been forwarded to my Exchange server, so it's not on my mail gateway any

Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 15:21: > At 02:47 PM 1/13/2004, Mike Leone wrote: > >Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 14:22: > >> At 02:12 PM 1/13/2004, Mike Leone wrote: > >> >I have a spam that scored

Re: [SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
Matt Kettler ([EMAIL PROTECTED]) had this to say on 01/13/04 at 14:22: > At 02:12 PM 1/13/2004, Mike Leone wrote: > >I have a spam that scored like this: > > > >X-Spam-Status: No, hits=2.4 tagged_above=-999.0 required=5.0 > >tests=BAYES_56, > >

[SAtalk] How to find values assigned to different tests?

2004-01-13 Thread Mike Leone
I have a spam that scored like this: X-Spam-Status: No, hits=2.4 tagged_above=-999.0 required=5.0 tests=BAYES_56, FORGED_OUTLOOK_TAGS, HTML_60_70, HTML_IMAGE_ONLY_02, HTML_MESSAGE In my local.cf, I made the test HTML_IMAGE_ONLY_02 score 3 points. That would mean that the other tes

Re: [SAtalk] filter suggestions

2004-01-12 Thread Mike Leone
Brian McGroarty ([EMAIL PROTECTED]) had this to say on 01/12/04 at 23:37: > What's the proper way to suggest a new filter to the SA developers? > > I'm getting a TON of mail with a bunch of random uncommon-but-real > words to thwart Bayesian filtering, combined with a single picture > link. Spama

Re: [SAtalk] How to do? Linux/Spam Assasin running as a gateway spam filter f or another mail server.

2003-07-26 Thread Mike Leone
[EMAIL PROTECTED] ([EMAIL PROTECTED]) had this to say on 07/07/03 at 22:20: > Hi All, > I've got spam assassin working like a dream on our small sendmail box. > works like a bought one.what i want to do is setup a gateway arrangment > for an Exchange Server (everyone shudders, i know). > > li

Re: [SAtalk] Re: Movie FILTER THIS VIRUS ALREADY!!!

2003-07-13 Thread Mike Leone
Jason Haar ([EMAIL PROTECTED]) had this to say on 07/03/03 at 23:14: > On Thu, Jul 03, 2003 at 10:29:47PM -0400, Shaun T. Erickson wrote: > > So, no rant from me, but I *do* think the list admin (or the admin of > > the system that hosts the list) should be making every attempt to block > > viri

Re: [SAtalk] Bayes safety zone

2003-06-02 Thread Mike Leone
Theo Van Dinter ([EMAIL PROTECTED]) had this to say on 06/01/03 at 11:14: > On Sun, Jun 01, 2003 at 08:34:52AM -0500, Tom Meunier wrote: > > I don't understand the Bayes safety zone, where it's set, and why it's > > hard coded. > > > there. Looked in MAN SA-LEARN but didn't find anything. Anyo

Re: [SAtalk] SA on *n*x mail gateways protecting MSExchange Servers

2003-06-01 Thread Mike Leone
Patrick Morris ([EMAIL PROTECTED]) had this to say on 05/29/03 at 23:23: > This may be a silly question -- but why not just have Sendmail do the > LDAP account lookup itself (using the LDAP_ROUTING feature)? Seems like > it'd be quite a bit less overhead to deal with than passing stuff to a >

Re: [SAtalk] Spam Rejection Message

2002-12-29 Thread Mike Leone
Maxime Ritter ([EMAIL PROTECTED]) had this to say on 12/29/02 at 13:27: > On Fri, Dec 13, 2002 at 10:00:07PM -0500, Mike Leone wrote: > > > > > if ((/^X-Spam-Status:.*Yes/)) > > > > > { > > > > > echo "Your Email was Rejected by

Re: [SAtalk] Spam Rejection Message

2002-12-13 Thread Mike Leone
[EMAIL PROTECTED] ([EMAIL PROTECTED]) had this to say on 12/13/02 at 21:43: > Maybe I need to rephrase that: It informs the *sender*. What I like about > exit code 100 is that it doesn't queue the message and clog my queue. > Anyway, I've tested this. It definitely passes the echo back. Here i

Re: [SAtalk] Spam Rejection Message

2002-12-13 Thread Mike Leone
[EMAIL PROTECTED] ([EMAIL PROTECTED]) had this to say on 12/13/02 at 18:20: > > This varies depending on the MDA. With maildrop (used with Maildir), you > would have something like: > > if ((/^X-Spam-Status:.*Yes/)) > { > echo "Your Email was Rejected by our SPAM filters. Sorry." > EXIT

Re: [SAtalk] OT: Reply-To headers (was: No tag?)

2002-12-13 Thread Mike Leone
Matt Kettler ([EMAIL PROTECTED]) had this to say on 12/13/02 at 15:36: > I'd say that's perfectly reasonable.. Unfortunately some of mailing lists > flat-out munge any existing reply-to's.. which is the bad part everyone > objects to. > > ie: if I explicitly set a reply-to of myself because I w

Re: [SAtalk] cyrus-sieve + SpamAssassin

2002-12-13 Thread Mike Leone
Tom Allison ([EMAIL PROTECTED]) had this to say on 12/13/02 at 07:36: > [EMAIL PROTECTED] wrote: > >--On Thursday, December 12, 2002 3:07 PM -0500 Tom Allison > ><[EMAIL PROTECTED]> wrote: > > > >| My question is if anyone knows anything about running > >| spamassassin/spamc/spamd under sieve. >

Re: [SAtalk] OT: Reply-To headers (was: No tag?)

2002-12-13 Thread Mike Leone
Duncan Findlay ([EMAIL PROTECTED]) had this to say on 12/13/02 at 00:40: > Fair enough, I guess. On the Debian lists, Mail-Followup-To is the > header everyone lives by. (Probably because we all use mutt) Not everyone. :-) When I read my email from work, I do it via Squirrelmail, a web client. A

Re: [SAtalk] OT: Reply-To headers (was: No tag?)

2002-12-13 Thread Mike Leone
Bob Proulx ([EMAIL PROTECTED]) had this to say on 12/13/02 at 02:00: > Duncan Findlay <[EMAIL PROTECTED]> [2002-12-12 23:57:48 -0500]: > > On Thu, Dec 12, 2002 at 09:56:23PM -0500, Matt Kettler wrote: > > > If you really want people to reply on-list your should add a Reply-To > > > header that co

Re: [SAtalk] Altering the report

2002-12-07 Thread Mike Leone
[EMAIL PROTECTED] ([EMAIL PROTECTED]) had this to say on 12/07/02 at 20:06: > I need to remove a sentence from the report SA generates. Specifically > the part about "This mail is probably spam.". Apparently it's confusing > some of my users. I'm using MIMEDefang as the milter glue but What's

Re: [SAtalk] bouncing as an alternative to /dev/null

2002-11-25 Thread Mike Leone
Rich Duzenbury ([EMAIL PROTECTED]) had this to say on 11/25/02 at 18:43: > > > > >Auto-bouncing spam also auto-bounces FPs, and you lose legitmate mail. Tag > >everything with SA, and no need to change addresses; simply route all > >tagged mail to a special folder, which you check every few days.

Re: [SAtalk] How can I tighten SA?

2002-11-23 Thread Mike Leone
Mike Burger ([EMAIL PROTECTED]) had this to say on 11/23/02 at 23:48: > Now, I got the same thing, but since my threshold is set to 5.0, it got > listed as spam. Since I whitelist this mailing list, as I do for all my mailing lists, it came thru for me. Personally, I like the way the subject lin

Re: [SAtalk] Get rid of some headers?

2002-11-21 Thread Mike Leone
Steve Thomas ([EMAIL PROTECTED]) had this to say on 11/20/02 at 13:18: > | X-Spam-Status is ok with Yes, hits required but how do i get rid > | of the tests= part? > > procmail/formail, or hack the SA code. > > > | I do not want the report at all in the message body how do u get > | rid of this

Re: [SAtalk] Maildrop spamassassin per user

2002-11-18 Thread Mike Leone
Philip Mak ([EMAIL PROTECTED]) had this to say on 11/18/02 at 15:44: > if (/^X-Spam-Flag: *YES/) > { > exception { > to Mail/killed > } > } > Why do you have the move to the folder as an exception, and not a direct action of the if? I use: if ( /X-Spam-Status: Yes/ )

Re: [SAtalk] Re: Spammer forums?

2002-11-18 Thread Mike Leone
Ross Vandegrift ([EMAIL PROTECTED]) had this to say on 11/18/02 at 20:59: > On Mon, Nov 18, 2002 at 04:59:28PM -0500, Vivek Khera wrote: > > There are many mail senders out there that send ligitimate mail that > > often gets flagged as spam, and finding ways to avoid being tripped up > > by these

Re: [SAtalk] Postfix - Procmail - SA _Security Problem?

2002-11-18 Thread Mike Leone
Christoph Bieselt ([EMAIL PROTECTED]) had this to say on 11/18/02 at 05:47: > Hi together, > > I am using Postfix with Procmail to call SA. As usual the procmail is > called with the user defined in /etc/postfix/master.cf where the > procmail transport is specified. SA is called by the user cyrus

Re: [SAtalk] Using spamassassin but don't get any result

2002-11-11 Thread Mike Leone
Christoph Bieselt ([EMAIL PROTECTED]) wrote this on 11 11, 02 at 07:37: > I implemented spamassassin in my following environment: > > - Postfix for SMTP > - Cyrus Imapd (2.0.16) > - Procmail delivery > - Spamassassin (2.43) > > > For postfix I changed the main.cf to: > mailbox_transport = procm

Re: [SAtalk] SCORES

2002-10-14 Thread Mike Leone
* spamassassin ([EMAIL PROTECTED]) wrote this on 10 14, 02 at 12:06: > > How is everyone using SA? Do you auto delete spam after some high score? I > would like to find the safest score to delete spam, and keep the other mail > with smaller score. I never auto-delete anything. :-) Losing real m

Re: [SAtalk] Spammer

2002-10-11 Thread Mike Leone
* McClung, Darren W. ([EMAIL PROTECTED]) wrote this on 10 11, 02 at 09:34: > This is OT, but pretty important. If these messenger spams are getting > through, your NetBIOS ports are open to the outside, which is VERY BAD. Saw the same reports on the WinNT list, and one of the people there defini

Re: [SAtalk] ok_locales question

2002-10-05 Thread Mike Leone
* Michael Moncur ([EMAIL PROTECTED]) wrote this on 10 05, 02 at 19:09: > > ok_languages en > > > > It must be listed, that's where I got it ;-) > > That's nice, but I was talking about ok_locales. Completely different thing. > > Anyone know whether "en" is valid for ok_locales? I thought it was

Re: [SAtalk] Tagged Spam

2002-10-05 Thread Mike Leone
* Jack Coates ([EMAIL PROTECTED]) wrote this on 10 05, 02 at 12:39: > To reinforce what a bad idea that is, here's an average week's worth of > false positives in my quarantine box: > > three online-billing notifications (Citibank, AT&T, Working Assets) > two LPI newsletters, one of which was im

Re: [SAtalk] What Am I Doing Wrong?

2002-10-01 Thread Mike Leone
* Doug Appleton ([EMAIL PROTECTED]) wrote this on 10 01, 02 at 13:08: > On Tuesday 01 October 2002 09:44 am, you wrote: > > Thanks for getting back to me.. Sorry to be such a pain , but literally I'm > new at this Red Hat thing.. I'm more of an NT person.. Anyhow... This is what > I need to ha

Re: [SAtalk] Postfix and high load

2002-09-26 Thread Mike Leone
* Florin Andrei ([EMAIL PROTECTED]) wrote this on 09 26, 02 at 23:43: > On Thu, 2002-09-26 at 06:42, Vivek Khera wrote: > > > "FA" == Florin Andrei <[EMAIL PROTECTED]> writes: > > > > FA> (i'll describe my situation first, the questions are at the end) > > FA> I managed to make SpamAssassin

Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Leone
* Mike Burger ([EMAIL PROTECTED]) wrote this on 09 21, 02 at 00:50: > I have "X-Spam-Status" in every message that SA scans. SA scanning is different than when Amavisd-new calls SA modules to spam scan. Amavisd-new does not call all SA modules, such as adding the X-Spam-Status header for all ema

Re: [SAtalk] X-Spam-Status question

2002-09-20 Thread Mike Leone
* Avi Schwartz ([EMAIL PROTECTED]) wrote this on 09 20, 02 at 23:57: > Is SA supposed to always insert a X-Spam-Status tag? > > I just started using SA + Postfix + amavisd-new and it seems to me that > SA does not insert this tag into non-spam messages. Is this correct? Correct. Amavisd-new on

[SAtalk] FWD: Postfix SPAMFILTER HOWTO updated/final]

2002-09-17 Thread Mike Leone
Saw this on the postfix list; thought it might be of use. Posting to the postfix list if you have questions that impact/interact with postfix is a good idea. - Forwarded message from Scott Henderson <[EMAIL PROTECTED]> - Date: Tue, 17 Sep 2002 13:08:30 -0400 (EDT) From: Scott Henderson <

Re: [SAtalk] RE: postfix issues (was: No Subject)

2002-09-17 Thread Mike Leone
* SpamTalk ([EMAIL PROTECTED]) wrote this on 09 17, 02 at 22:25: > I would sack postfix before SA. Was any attempt made to query a postfix > mailing list? No need; see my earlier email. msg07860/pgp0.pgp Description: PGP signature

Re: [SAtalk] is there a user-admin for SA with postfix

2002-09-17 Thread Mike Leone
> Well, then few people know how to use SA with postfix. I use SA with > procmail. Of course, I won't be able to help you. There's a webpage somewhere that explicitly lists how to call SA from postfix as a content filter. http://www.advosys.ca/papers/postfix-filtering.html First Google hit on