[SAtalk] Can't locate object method

appreciatted. Thanks Nicole Aug 5 16:33:40 home spamd[7555]: Failed to run RAZOR_CHECK SpamAssassin test, skipping: (Can't locate object method "check_razor" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssa

[SAtalk] Can't locate object method :(

appreciatted. Thanks Nicole Aug 5 16:33:40 home spamd[7555]: Failed to run RAZOR_CHECK SpamAssassin test, skipping: (Can't locate object method "check_razor" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/local/lib/perl5/site_perl/5.8.0/Mail/SpamAssa

Re: [SAtalk] Reporting....

>I currently have spam being filtered for about 50 users via spamd. >Works perfectly! However, is there anyone out there providing reports >to their users about what was filetered? Maybe just something like >date/time, From, and subject? Yup! You can check: http://www.cs.ait.ac.th/laboratory/em

Re: [SAtalk] Two rule suggestions

>With a score as small as -0.036 the GA is giving more of a statement that >this rule isn't much of an indicator of anything at all. Just wondering, when runninh GA, would it be possible to make it a 2 step process, first step let it run without constraint, and on the second setp force the nearl

Re: [SAtalk] Apple, Kmail, Adaptive Rules

>How would forgeries (e.g. viruses) be detected? Would there be an >"oops-I-didn't-mean-to-submit-that" option somehow? Real viruses are filtered before they reach any mailbox for delivery. Tose two addresses could be accessible only for internal mail. And as a user is using this mechanism to

Re: [SAtalk] Apple, Kmail, Adaptive Rules

>false postives/negatives to different e-mailaddresses, but then each user would >need two more e-mailaddresses for each and every account; not to mention that That could be done with only 2 addresses per domain, and let it figure who did the bounce... Olivier -

Re: [SAtalk] newbie question about rule base

>I already have RBL enabled in my MTA (postfix), and those RBL checks >don't take anywhere near 30 seconds. Altho I will try setting >"skip_rbl_checks" to 1 and try the timing again. Be careful;l that RBL test of SA are not the same as RBL tests of your MTA. SA does not test on the enveloppe, but

Re: [SAtalk] newbie question about rule base

>Something must be wrong with your installation or setup. >My average time for a scan is ~4 seconds and that's with >RBL's checks and Razor. That is forgetting a lot of versatility in network access. I beleive I access most of the RBL servers through 2 satellite hops, thats means 1 second RTT. A

Re: [SAtalk] newbie question about rule base

>It *is* faster than spamd, tho - when I was using spamc/spamd, it would >take 30+ seconds to scan; amavisd-new does it in like 3 or 4. It should be, AFAIR, it disable RBL check that takes some time (if nop CPU resources). Olivier --- This sf

Re: [SAtalk] testing system-wide filtering/question

Hi, > If I put a spamc (or spamassasin) call in /etc/procmailrc (and > procmail is my MDA in sendmail), will SA look for user confs based on > the intended recipient? I think the answer is no, but I want to be > sure. Unless you DROPPRIV=yes or you use -u $LOGNAME, it will not use the user pre

Re: [SAtalk] Spamassassin + aliases + exim

Chris, > I've been trying to work out one things but seem to not have enough > of a clue to get anywhere. I can briefly describe this problem I am > having as 'problem with filtering using user prefs when dealing with > an aliased addresses ?' Either you run SA after the alias has been resolved

Re: [SAtalk] problem with "equals 20" at line endings.

Russ, > my users are >complaining that emails, particularily long-lined HTML emails have an "=20" >at the ends, which can break HTML if it occurs in the middle of the tag and >just looks ugly otherwise. I don't think it is due to SA. I get such messages from time to time, usually coming for F

Re: [SAtalk] Re: =20 line endings problem...

> FYI, =3D20 is the quoted-printable encoding of a space character. Is that a joke? "equal three D" is the encoding for the equal of course Olivier --- This sf.net email is sponsored by:ThinkGeek Oh, it's good to be a geek. http://thinkgeek.c

Re: [SAtalk] rule testing against corpus

> sanitising code written... On another hand, sanitising code could prove usefull in general in the future, to check just any new rule added to SA. > Could easily lead to >deliberate of accidental DoS attacks against the machine hosting >the CGI. Ressource limitation could be enforced I gues

Re: [SAtalk] Re: spamc/spamd questions

Hi, > Yes, spamd indicates that a connection was made from localhost, but > there's no followup log entry for the virtual domain addresses; email > to me generates 'clean message' or 'identified spam' followups, but not > so for the virtual users. Just one question, are you sure that your virtua

Re: [SAtalk] (1) User_prefs ignored? (2) Permission problem? (fwd)

>Jul 3 17:27:44 firefox spamd[28177]: read_scoreonly_config: cannot open >"/home/rcs/.spamassassin/user_prefs": Permission denied Are you sure /home/rcs/.spamassassin/user_prefs exists? If not, maybe you're missing the -x (or is that -a) option to spamc that tells to create the user-pref. Oli

Re: [SAtalk] (1) User_prefs ignored? (2) Permission problem? (fwd)

Hi Bob, > I run spamd as follows: > /usr/bin/spamd -d -u nobody And how do you run spamc? > (1) Whether the user_prefs settings are used or not seems to be > hit-and-miss. What's in the header often disagrees with waht actually > happens. For example: I beleinve the difference is because w

Re: [SAtalk] Interview with "Spam King" Scelson

>don't own. According to the SPEWS event ticket its just a single server there >which had sent Spam (with 4 IPs on it according to NMAP) and SPEWS blocks >+60K IP addresses thanks to that fact. There is absolutely no way to get out >of SPEWS until the owner of the netblock shuts down the spamme

Re: [SAtalk] whitelist vs. mime_defang

Hi, > shows that whitelist is applied, bumping the score down to change > is as non-spam-status. But it is still getting mangled by > mime_defang to a somewhat-unreadable form (straight HTML code). I am not sure mime-defang option applies to spam only, I think that is a general option that SA ap

Re: [SAtalk] For field, not To Field

Hi, > I'm getting allot of problems with > SA marking mail as spam that's being sent to a group/list, even when the > recipient has been whitelisted. When sending to a group/list, who is THE recipient? If I am not wrong, a message send to a list of recipients on a single destination machine, is

Re: [SAtalk] Re: Re: Fw: Hi, it's Nadia. please come talk with me.. I have a webcam

>Those would be Olivier's French translation of the rule descriptions. >Either he can package them up differently (gzip or something) or I can >lose them. *I*'m not going to do anything with that translation >either way. (btw, I am saving a copy of all sa-exim rejected mail, for now) :P Well

Re: [SAtalk] Proper way to handle misidentified spam site-wide?

John, > Have you done modifications or are you using > a standard MailScanner/SpamAssassin setup? I've set mine to "store" not > instead of "deliver" -- and I plan to go through them manually to check for > misidentifications (at least for now). I use procmail, not mailscanner, so everything is

Re: [SAtalk] SpamAssassin idea?

Hi, > > Now I see no reason why in real life one should accept such case. I'd > > say that in real life I only accept connection from machine with valid > > DNS and reverse DNS. > Sadly ISP's aren't as on-the-ball as you are. I've been trying for > months to get my ISP to setup reverse DNS for s

Re: [SAtalk] spamd woes (was: spamd ignoring local.cf)

Hi Michelle, > Actually, I'm running spamd server-wide, invoked from a main > procmailrc. In your scheme, spamd would be called only directly from So do I. > the user's .procmailrc, right? Would it still be possible to somehow > use the .no_spam_check method to opt out when using server-wi

Re: [SAtalk] Proper way to handle misidentified spam site-wide?

John, >I'm just worried that it will come up more and more as people join such >"specials" mailing lists since they look so much like spam sometimes. I just >want to know how to handle them. Especially since when I switch to "delete", >they wouldn't even SEE the emails to be able to whitelist t

Re: [SAtalk] SpamAssassin idea?

>I believe the only check that for instance sendmail could do, is to >check if a lookup of the ip gives the hostname, and if the hostname >lookup doesnt give the IP, then it can block the message. But in >real life, there are so many situations where this is not the case, >that blocking that scen

Re: [SAtalk] Detecting spam tagged mail on a 2nd pass.

>It's been requested that if a message has been detected as SPAM already, >that it would be nice to have a ALREADY_ASSASSINATED rule that could >be used by the procmail delivery to process these messages seperately. Sounds to be a problem of configuring your Mail Delivery Agent (procmail or other

Re: [SAtalk] Debugging switch

> /usr/bin/spamd -d -D -F 1 AFAIR, -d and -D are incompatible, with -D and no -d, spamd runs in foreground and logs information on screen. Olivier --- Sponsored by: ThinkGeek at http://www.ThinkGeek.com/

Re: [SAtalk] spamd woes (was: spamd ignoring local.cf)

> I've -HUP'ped spamd every time local.cf has been modified. But just > for grins I killed it completely and restarted it. It came up for a > short while then died. Odd, I thought. I restarted it again with > the same result. So figuring it was time to upgrade to the latest > version, I d

Re: [SAtalk] Replying to list???

> How come this list does not have the reply to: set to the spamassassin list? > Every time I want to reply to the list I have to type in the email address. > Or as I see others do they use the reply to all feature and then the user > and the list gets a copy. Just considering how frequent the qu

Re: [SAtalk] Cyrillic encoding raises the spam level to 3.8

> If Russian email is supposed to have 8-bit characters in the Subject > line, it seems like a bug to me. Can you file one in Bugzilla? > > For now, you can work-around the issue by changing the score for > SUBJ_FULL_OF_8BITS to 0.0 and that will deactivate the rule. That's why the next big cha

Re: [SAtalk] RE: Broken Bugzilla links? - RE: [SAdev] [Bug 436] Score on spam exceeded maximum and went negative

>Can anyone else verify this or should I check myself in to the appropriate >institution? mail41: (echo "" ; echo ""; echo "testing i=1 a=2 b=22 c=33 d=476 f=23 id=33 3")|spamassassin -t >From spamassassin@localhost Thu Jun 13 06:58:47 2002 X-Spam-Status: No, hits=4.8 required=5.0 tests=FROM_MIS

Re: [SAtalk] More Spam phrases that from a porn that slipped through the current rules

>body YNIWHI /you name it[.,\b]*we have it/i /you name it(,|\.{1-3})? we have it/i This matches exactely on comma or one to three dots, or nothing if you do not escape the . with \., it means any character, and * can match any number of time, so it means just plain anything between

Re: [SAtalk] SA with .forward files

>My server is a Cobalt Raq4. I have several users who have .forward files in >their user directory. I have noticed that mails sent using .forward files >are NOT passed through SA. How do you call SA? Before or after the forward? What is the mail server on your machine? What is the mail deliver

Re: [SAtalk] Newbee's question: seem long to check an email, and spamd

Hi, If you are interested in seeing some statistics about CPU, processing time, message size and spam level, you can get a look at: http://www.cs.ait.ac.th/laboratory/monitor/mail/ Machine is a P166, with some 64MB ram and SCSI disks. Disregard virus and client connection that may not be givin

Re: [SAtalk] Re: Freeze for 2.30, call for nonspam.log submissions

>Ummm... yeah... I just couldn't figure out how to add in the >accents. And my shift button got stuck when I hit L! ^q 3 4 0 in emacs :) Olivier ___ Multimillion Dollar Computer Inventory Live Webcast Auctions Thru Aug. 2002 - http://

Re: [SAtalk] Freeze for 2.30, call for nonspam.log submissions

Craig, I rsync a mass-check and posted bug #421 that has the rule description in French corresponding to the 2.30 coming tomorrow. Olivier ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas

Re: [SAtalk] Re: Freeze for 2.30, call for nonspam.log submissions

> Spamassassin 2.30 (a L'orange) would be a pretty good name. If I may... that hould be Spamassassin 2.30 (à l'orange) Lets be orthographically correct :) Olivier ___ Don't miss the 2002 Sprint PCS Application Developer's Conference

Re: [SAtalk] sa troubles

> 1. I'm invoking SA from /etc/procmailrc, which works well. But I'm > trying to keep a copy of everything that SA tags as spam, using the > following: At sometime I used: FILESPAM=/var/maildump/$LOGNAME.spam DUMMY=`test -f $FILESPAM || touch $FILESPAM` :0 c: * ^X-Spam-Status: Yes | /usr/local

Re: [SAtalk] C version

Hi, Running masscheck I got the following errors: Premature end of base64 data at /home/java/on/CVS/spamassassin/masses/../lib/Mail/SpamAssassin/PerMsgStatus.pm line 1875, line 15606. Premature end of base64 data at /home/java/on/CVS/spamassassin/masses/../lib/Mail/SpamAssassin/PerMsgStatus.

Re: [SAtalk] Re: scoring question

> Only PORN_8 is negatively scoring. (Severely negative) PORN_* means PORN_8 of course, just a problem of synch on the shift key :)) Olivier ___ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Veg

Re: [SAtalk] Documentation for procmail / spamassassin gateway?

> I must not be looking in the right place or something. The only thing I saw > for setting up a gateway was someone had posted an example sendmail.mc file > in usenet (Google search) but it didn't quite work for me. Mail passes > through the gateway, but none of my test spam ever passes through

Re: [SAtalk] Re: scoring question

> | For certain items, e.g. porn, I would like to send > | these to /dev/null. > > :0 > * ^X-Spam-Status: Yes > * ^X-Spam-Status:.*PORN > /dev/null Be carefull!, rule PORN_* is a negative rule (it triggers on email that are not porn). Olivier ___

Re: [SAtalk] Finally got it working...

> My guess is Local Delivery Agent (e.g. procmail, deliver, ...). > The term I've usually seen though is MDA (Mail Delivery Agent). Very true, I should have used MDA, I think I used LDA because they use it on procmail list. Olivier ___

RE: [SAtalk] Finally got it working...

> what is the term LDA? My fault, I didn't knew like 3 month ago. Local Delivery Agent, the piece of code that gets a message from your SMTP server and (after some ossible filtering) put it in users mailbox. Procmail is an LDA Olivier

Re: [SAtalk] Finally got it working...

>I finally got it working and it is tagging email. However, spam is still >making it to my inbox. Is there something else to this I am missing? SA only tags spam, it is the role of your LDA to do something with such email, put it in a separate folder, quarantine it, delete it, whatever you want.

Re: [SAtalk] bug: spamd does not honour -s flag

>To be exactly, under OpenBSD 3.1, I am starting spamd with the following >command line: > >/usr/bin/spamd -d -a -c -s mail.info I think you must specify only the facility, not the level. Olivier ___ Don't miss the 2002 Sprint PCS

Re: [SAtalk] Updating Rules

> The tricky part is maintaining a list of which rules will work only in CVS vs > which rules are OK for the nightly distro. I beleive regexpr are stand alone. I beleive most eval are. Other could start with a version check of the SA engine. Version check being build in once and for ever in the

Re: [SAtalk] Updating Rules

> Would it not be easier to simply release the non-eval rules. Sure, > scores wouldn't be ideal. But hey, that's the price you pay :-) Unless the GA is run everyday, the score for new rules will always be set by hand. I think I can live with that. What I would be more concerned about, is that so

Re: [SAtalk] Updating Rules

>The tricky part is that frequently between releases new rules get built which >depend on new library features -- so CVS rules won't necessarily work on >anything but CVS libs. Certainly at least EvalTests.pm would need to be in the >"rules update" distro Craig, I beleive that if regexpr rules

Re: [SAtalk] save to file

> ok... but when i save a message to a file can i send it via mail? > because my clients have not another way to report spam.. I don't know, it would need to clean the file first I am afraid, so what they send is really only the body of the spam. Any alteration of the body makes it unseless to re

Re: [SAtalk] Outlook express and sendmail

>i read that razor can handle forward attached email.. >outlook express cannot bounce message There are hundreds of MUA and each has a different way to present attachements. How could Razor handle all of them? You can also save the message to a file and spamassassin -r http://devcon.sprintpcs.c

Re: [SAtalk] Outlook express and sendmail

> another problem is that all my clients use outlook express=20 >and they send forward message > is this handle correctly by razor-report and=20 No. For safe use of razor, you must bounce the message, not forward it. Forward always changes the body of the email, and razor needs an unaltered body

Re: [SAtalk] Bug in SUBJ_HAS_UNIQ_ID

> I don't see how the Subject contains anything remotely like a unique > ID code. Is this right? I did not check at the rule (too lazy.buzy) but maybe the unique ID is characterised by some string at the end of Subject, after a lot of spaces. Olivier ___

Re: [SAtalk] Preventing interception of a redelivery

>Suppose a recipient wanted a message that had been marked as spam by >mistake, intercepted, and archived. Is there a way to deliver this >specific message to the recipient, preventing it from being >intercepted again? It would involve circumventing spamd's scanning >this message so that it

Re: freespeech Re: *****SPAM***** [SAtalk] Re: Spamassassin-talkdigest, Vol 1 #456 - 14 msgs

Hi, It is not exactlly fitting in that thread but... > Maybe a little different approach wouldn't require as much huffing > and puffing: > header Spama X-BeenThere =~ spamassassin-.*@lists > score Spama -100 I noticed that SA do not check the messages that have the X-BeenThere header in it

Re: [SAtalk] Oops!

>Olivier, could you attach the new file to a bugzilla ticket? It's hard to >extract from your original email. That's what I though, how to *attach* anything in bugzilla? I see nowhere mention of such attachement. I understood that it was not supposed to be dumped in the "Description:" textarea,

Re: [SAtalk] AWL adjustment flags SA-talk email as spam

>I was surprised to see that the "AWL: Auto-whitelist >adjustment" rule added 31.1 (thirty-one point one!) to >the score of the following email from this very list >server. I hope I will not get white/blak listed on this answer... The previous mail I sent had a very very bad score, so I got my

Re: [SAtalk] spamass-milter, spamc/d, per-user prefs

>Second - does the milter get called for every distinct recipient, or is >it called once per session, with a callback call per recipient? Reason I >ask is, this particular server is a relay only, no local delivery. I've >got a feeling that there is no way I will reasonably be able to have >per-rec

Re: ** 30.50/04.50 ** [SAtalk] New describe in French and a newversion of the tool that extracts lateste rules

> Hmmm... just had to ask... what score did this get by the latest and greatest >version of SA? Well for some reason, SA list is never checked by SA here. But I remember that the previous post (at time of 2.01 ?) got some 58 points or something. Olivier

[SAtalk] New describe in French and a new version of the tool that extracts lateste rules

/^.*$r\s+//; chomp; # print "$_+++$expr"; print OUT "lang $lang $_ $expr"; } - the French descriptions -- # Traduction française d'Olivier Nicole <[EMAIL PROTECTED]> # Asian Institute of Technology, Bangkok, Thailande lang fr cl

[SAtalk] Oops!

There was a typo in this one, I missed the 96 lang fr describe DATE_IN_FUTURE_96_XX L'entête Date: est plus de 96 heures après la date de l'entête Received: Olivier ___ Don't miss the 2002 Sprint PCS Application Developer's Confer

Re: Removing rules with negative score? (Was: Re: [SAtalk] WEB_BUGS tests a negative?)

> If we want to have negative scoring rules, we should try to put > together regexp's that are actually non-spam indicators. The > DEAR_SOMEBODY rules is a perfect example. "Dear Sir/Madam" is a sign > of spam, "Dear Duncan" is not. I think we should add: Humm, that's me again... This is a matte

Re: [SAtalk] Per User Spam Filtering w/ postfix+cyrus+spamassassin ...

> All of this requires the ability for 'per-user' configurations to work ... > > Now, getting this to work where the email has one recipient is a piece of > cake, and can be done inside of postfix quite nicely ... but as soon as > you have 2+ recipients, it breaks ... I don't use postfix, but it

Re: [SAtalk] new private rules

> header USENET_SPAM_ACCOUNT /?:[EMAIL PROTECTED]/i > describe USENET_SPAM_ACCOUNTTo: mail sent to usenet spam accounts > score USENET_SPAM_ACCOUNT 5 I think header rule should read something like header USENET_SPAM_ACCOUNT To =~ /?:[EMAIL PROTECTED]/i specifying the header

Re: [SAtalk] Spam Tracking

> Yes, that is why I'm thinking of creating this database -- we can see what > tests are consistently bad and modify/eliminate them. Just one thought, you have to be carefull of rules that change contents along the time, but kept the same name. Olivier __

[SAtalk] A small script for SA translators

Hi, I found it a mess to prepare a list of the various rule description, the first time I did the French translation. Now that I make myself ready for a second translation, I found I had to merge the English description, get the French existing one, and see what is only new. Yuck! So, I come up

Re: [SAtalk] Can I train the GA?

>Sorry, two or three messages later in the spool I saw Craig's mention of the >masses directory. My apologies for inferring that the term "genetic >algorithm" might be misused. Seems like this is something that should be >mentioned in the man pages, as it's a significant differentiator between S

Re: [SAtalk] spamc/spamd hanging (was spamd dying)

>The basis of the problems seems to be that sendmail won't send the full email >across to spamc for whatever reason, at least on some platforms. Seems like it >would be logical for the whole message to get sent, then to read the whole Wouldn't it be rather spamass-milter that is not sending the

Re: [SAtalk] First of two problems - implementing user "opt-out" from spamassassin...

> Although I would prefer a way to bounce it (with spamassasin headers), on > the off chance that there is ever legitimate mail with a spam score over 10. >The only once I've ever seen was a sample sent to this list with a score > of 39. Everything else over 8 has been spam. Rather than bo

Re: [SAtalk] Lots of stuff gets tagged as positive, regardless of score!

> So, it says "this mail is probably spam" even though it scored -2.8!! When you use -t, you will get a repport in any case. If you run the same message through SA without the -t, it will not be flagged as possible spam. Olivier ___

Re: [SAtalk] First of two problems - implementing user "opt-out" from spamassassin...

> :0 > * ! ? test -f $HOME/.nospamcheck > > :0fw > | spamassassin -P > > :0: > * ^X-Spam-Status: Yes > /dev/null Hummm, if I understand well procmail receips, what you do is: if $HOME/.nospamcheck exists, then empty here, do nothing for all messages, filter through SA if the message is fl

[SAtalk] Sendmail configuration

Hi, This is a completely unrelated topic, but is there a mailing list for sendmail? Olivier ___ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: [EMAIL PROTECT

Re: [SAtalk] spamd 2.20 bad protocol

>Soem very huge Mails (about 2 MB) coming in, will be investigated by spamc >(2.20), which is breaking after a few seconds because mail is too big (> >25k). But then, the spamass-milter timout in sendmail works after 12 >minutes (!) and the mail seems not be be delivered, so the sender tries it >a

Re: [SAtalk] New Announcements Mailing List

>It's just 3 questions, all multiple choice :) -- if you have 3 seconds while >signing up for the announcements list, go ahead and click through the survey >too. I'd have been glad to answer the survey, if it did not mean registering to Source Forge, which I don't see any need in doing so (plus t

[SAtalk] Re: Brute force spam prevention for NSP's

>Good luck on avoiding false positives. Any reason you think you can >completely avoid them when _every_ previous attempt has failed? Once again, I am not the ISP, but I would have no remorse at all to miss handle false positive for a known spammer (the kind of guy you receive 50 complains a wee

Re: [SAtalk] rule for IMG

> > install SA and silently drop spam traffic. > Oooo! that is clever. I like it I like it. Remember it is droping the mail at source, not at destination. Any why taking any precaution with identified spammers, that have been going against the rules for years. If they are not happy they can s

Re: [SAtalk] RFC: ok_languages patch

Beside the intrest for selected languages, I see another general interest in that piece of code, is to apply rules depending on the language. Why trying to find "click below" if the message is detected to be in French. That could lead to buid rules with language variants, one single CLICKBELOW r

Re: [SAtalk] Brute force spam prevention for NSP's

Jeremy, >STARTTLS tunneled mail does not take kindly to being transparently >redirected, especially if client certificates are being used. Not >sure what percentage of your customers would be using TLS mail, but a >false positive redirect would break things. I'd beleive not many spammer use TL

Re: [SAtalk] Brute force spam prevention for NSP's

> I would suggest notifying an admin person rather than silently dropping. > Silently dropping is really bad should you ever have a false positive. I was talking about 100% identified spammers, only filter them. The war against these few customer has been runnig for ages, blocking their port 25,

Re: [SAtalk] Brute force spam prevention for NSP's

> Some questions I have is if anyone in a similar situation that I'm in? And if > so, would you think such a system like the above would be useful? I'd > appreciate any suggestions. Well I am not ISP, but I once talked to my friend who is working at one and has having the same problem. What we h

Re: [SAtalk] How do I avoid this being spam?

> Are you sure? daf.2y.net just has an "A" record... I get mail just fine... It will works also if you have only an A reccord, as the domain is a real one and the machine a real one. But with an MX reccord you would avoid to trigger the rule NO_MX_FOR_FROM Olivier _

Re: [SAtalk] Global SA Statistics?

>Does SA keep stats on what it's doing? IE- 73 of the last 100 >messages were fl\ agged as spam, average score=5.3. Processed 300 >messages in the last 24 hours.\ ... stuff like that. In that line, could (does I did not look at 2.20 yet) SA log the size of the message? I'd like to create graph

Re: [SAtalk] SA 2.11 munging messages

Hummm, I am not sure of your diagram below | POP3_server -> fetchmail -> procmail -> spamd -> sendmail_local -> | mailbox Spamd returns the message back to procmail, so that is procmail that interacts with whatever is sendmail_local. So it would read rather: spamd

Re: [SAtalk] Spam Assassin

Hi > Describe PURE_PROFIT Profit is dirty, not pure. I avoid such jokes in French translation, becaus eI am not sure it would be perceived well by all French speaking communities. I think that those describe could change when SA become more mature. > However, I do agree that many tests descri

Re: [SAtalk] SiteWide Config Questions

> 1.Getting the following messages: > spamd[28788]: Still running as root: user not specified, not found, or set > to root. Fall back to nobody. > > How do I fix this? start spamd with the option -u whatever-user-you-want > 2.What config files does it actually read in order to run in a s

[SAtalk] SA sightings

HI, Is there a way to report to sa-sightings list, without receiving all the reports from others? Idea is that I will only report from time to time, and don't like the idea to be flooded by others' reports (enough traffic with SA-talk, razor, and few other lists). Olivier _

Re: [SAtalk] I am so happy, I could kiss you...

> That's what I was afraid of. I don't think the magic is *that* deep, at > least in linux 2.4, you should be able to just read the NAT table to > figure out what X was trying to talk to in the first place. But I was > just wondering if there was some more elegant way of doing it. I beleive tha

Re: [SAtalk] I am so happy, I could kiss you...

>See, but I don't want to store-and-forward. I want to just pass what X >says on to Z, then listen to what Z says, and pass that back to X. It's possible too, I was misslead when you use the word redirection. It could be your router (provided it is based on a Unix box (or Windows box :)) or an

Re: [SAtalk] Scores on the Doors

On one month worth of spam, here are the highest hits: 30.4 30.8 30.9 31.2 39.5 55.8 The 39.5 triggered the following tests: SUBJ_ALL_CAPS, NO_REAL_NAME, ADVERT_CODE, SUBJ_HAS_SPACES, TO_MALFORMED, PLING, FROM_ENDS_IN_NUMS, INVALID_DATE_TZ_ABSURD, SMTPD_IN_RCVD, VIAGRA, CLICK_BELOW, CASHCASHCASH

Re: [SAtalk] I am so happy, I could kiss you...

> So X connects to what it thinks is Z, but is really Y. Now what I want > to do is have Y open a connection on to Z, and transparently monitor the Y would not "monitor the traffic" but really act impersonnate Z when it talks to X and impersonnate X when it talks to Z. But if you don't care one

Re: [SAtalk] I am so happy, I could kiss you...

> This is possible when using iptables on a Linux 2.4 router. (The code > to emulate the expected delays, remote system prompts, etc. is left > as an exersize for the reader.) Yes, that I know, but the border routers are Cisco (talking about a big ISP) and the most valid point to do redirection

Re: [SAtalk] I am so happy, I could kiss you...

> Thailand and China ;) Sometimes Korea. :PPP BTW, a serious question. Do you any of you know if on a Cisco router it is possible to do transparent redirection for SMTP? Idea, at ISP side, would be for know spamer, to transparently redirect their outgoing mail traffic, so it can be checked and

Re: [SAtalk] Using SpamAssassin if you don't own the mail server ?

>I understand that SA might not be exactly what I'm looking for in its >present form, but I know it's got to be close. Here in more detail is >exactly what I'd like to do. To do the closeness-of-fit comparison, you could try using nilsimsa that is do

Re: [SAtalk] How to specify custom rules?

>Sorry to jump in but I have a similar question. I have read the "man >Mail::SpamAssassin::Conf" but still dont understand how I could fix a >score for exampel every mail where the sender is for example *@*.com.tw >and a score if the body contains also a com.tw address. Before assigning a score t

Re: [SAtalk] Razor::Client

>Looks like the solution is right there to me. Is there some way I could >make it more apparent? No point having the FAQ if people are seeing it, >but not finding the answer! Change every occurence of the word Razor into Razor (use version 1.19) :) Olivier _

Re: [SAtalk] spamc & procmail

> Yeah, you're wrong. spamc will automagically pass the username it's > executing as to spamd. So spamc -u $LOGNAME is identical to spamc. > spamc -u somethingelse is however not the same as spamc by itself. So > the distinction is based on what userID spamc is running as. I myself Well, I d

Re: [SAtalk] spamc & procmail

> (Get rid of -u $LOGNAME -- it's deprecated anyways) Depending on your settings, the -u option may be the ONLY way for spamc/spamd to create the user_pref files. And the setting I am thinking about is when the user's dir are NFS mounted on the mail server, from another machine, and that they ar

Re: [SAtalk] Razor::Client

>Can someone please explain the razor 1.20 issue? spamassassin is >convinced that its not installed even though it is. Downgrade to Razor 1.19 As far as I understood, Razor had once a problem, so SA installed a work around, but since Razor 1.20, the problem is solved, but SA still has the wo

Re: [SAtalk] help exploiting formmail to black list

mail60: netcat netcat: Command not found. mail61: so what next? Telnet works pretty well for the purpose of simulating TCP protocols by hand. So in that case, that was simulating HTTP protocol. Olivier > That's not HTTP. You meant: > > $ echo -e 'GET /path/to/script.cgi HTTP/1.0\r\n\r\n' |

  1   2   >