[SAtalk] SoBig Virus

2003-08-22 Thread Patrick Bores
Hello, I'd like to add spamassassin rules to match certain attachment filenames, but I can't seem to get it right. I'm trying things like: rawbody SOBIG_VIRUS /filename="?application.pif|document_all.pif|thank_you.pif"?/ Any ideas on how to match attachment filenames? Patrick -

Re: [SAtalk] Slightly OT: Arguments needed for not replying to spam

2003-06-18 Thread Patrick Bores
management wants me to set up an auto-reply to mails marked as spam by SA. I told them that this is a very bad idea, since a.) reply addresses are fakes and not working most of the time anyway b.) if they DO work, we will just notify the spammers that the address they bought/harvested is working

[SAtalk] What's your spam level?

2003-06-06 Thread Patrick Bores
Hello, On the system I help administer, we deliver spam-flagged messages to an IMAP folder inside the user's directory. Nightly, a script runs that deletes messages that are older than 10 days from that folder. So, there are no flagged messages more than 10 days old. Yet, several users have up

Re: [SAtalk] (no subject)

2003-06-05 Thread Patrick Bores
Well, with all the great material gathered so far, we could just start semi-randomly auto-generating these response threads and stick them in the list whenever an e-mail like Marge's comes in. Then we could waste everyone's time without wasting everyone's time. ;-) Patrick On Tuesday, June 3,

[SAtalk] Not enough space

2003-01-03 Thread Patrick Bores
Hello, I'm seeing a bunch of these errors in my syslog file: spamd[406]: cannot fork: Not enough space Okay, so swap is filling up on my mail server for some reason, right? Problem is, spamd just dies and the message gets delivered into the INBOX unscanned. Is there a way to return an error

[SAtalk] hits vs. points

2002-12-30 Thread Patrick Bores
Hello, Okay, this is nit-picky, but is there a difference between "hits" and "points" in the SPAM tag? SPAM: Content analysis details: (6.30 hits, 5 required) SPAM: NO_REAL_NAME (1.3 points) From: does not include a real name SPAM: MARKETING_PARTNERS (1.7 points) BODY: Claims you regi

Re: [SAtalk] Increase in low scoring spam?

2002-12-24 Thread Patrick Bores
On Tuesday, December 24, 2002, at 09:40 AM, Jonathan Duncan wrote: Have you not added them to your blacklist yet? Sure, I have. They use a new domain every time they send me spam. I can't keep up. I need some way to filter the source, like something based on NS records. Luckily, it looks like

Re: [SAtalk] Whitelisting/Blacklisting - How

2002-12-16 Thread Patrick Bores
On Sunday, December 15, 2002, at 09:43 PM, G. Wayne Kidd wrote: 1) Give the user or the spam-reviewer a mechanism for adding the sender to the whitelist. Probably a web based configuration file editor is a good idea. I posted a meager PHP-based editor to the list a couple days ago. 2) If the

Re: [SAtalk] web interface?

2002-12-12 Thread Patrick Bores
ignorance or apathy? I don't know and I don't care." -- William Safire On Wed, 11 Dec 2002, Patrick Bores wrote: Here's the PHP template I wrote for my small user base (slightly modified for public consumption). You'll have to write your own authentication code. All

Re: [SAtalk] web interface?

2002-12-11 Thread Patrick Bores
kable. Good luck, Patrick On Wednesday, December 11, 2002, at 02:27 PM, James D. Stallings wrote: Yes If you have a URL for this, please publish. That would be great!! Thanks Jim On Wed, 11 Dec 2002, Patrick Bores ([EMAIL PROTECTED]) wrote: Mark, I posted the file to the SATalk

Re: [SAtalk] web interface?

2002-12-11 Thread Patrick Bores
that forward to their real e-mail addresses, as well as a couple addresses that deliver locally. I'd like to be able to give everyone, whether their mail is delivered locally or forwarded, the ability to tweak their SA prefs). Thanks for any ideas, -Mark Patrick Bores wrote: I've put

Re: [SAtalk] web interface?

2002-12-11 Thread Patrick Bores
e: I am definately interested in checking this out. Thanks. -- Chris LaFrance email: [EMAIL PROTECTED] "Is sloppiness in speech caused by ignorance or apathy? I don't know and I don't care." -- William Safire On Wed, 11 Dec 2002, Patrick Bores wrote: I've put together a

Re: [SAtalk] web interface?

2002-12-11 Thread Patrick Bores
I've put together a web interface that allows users to change the required_hits, and add/delete blacklist_from, whitelist_from, and whitelist_to directives. It's written in PHP, and requires that the user_prefs file have group write permissions for the same group that the web server runs as. L

Re: [SAtalk] Updated DailyPromotions / HSM rules

2002-12-09 Thread Patrick Bores
I have a feeling this is one of those wack-a-mole solutions. While is sounds like lots of fun (! :) ) I feel it might be better to rely on other means for scoring this spam. Namely the DNSBLs that specifically look for spamhauses like HSM or Razor2. I just don't see any other feasible solution

Re: [SAtalk] Updated DailyPromotions / HSM rules

2002-12-06 Thread Patrick Bores
Hello, I have noticed that most of the NS records for these spammers are the same or similar. Would it be too expensive to do a quick lookup of NS records to block these guys? Here are my results: [whiteout:~] patrick% host -t ns thelst40090hspeedm.com thelst40090hspeedm.com name server NS1.HS

Re: [SAtalk] Setting up spamassassin sitewide with multiple mail servers

2002-11-26 Thread Patrick Bores
I run a similar setup with 3 servers and 1 user list (glued together with NIS). It shouldn't be that difficult. 1. Install SA on each machine in a central directory. Mine is "/usr/data/spamassassin" In SA dist directory: perl Makefile.PL PREFIX=/usr/data/spamassassin/usr SYSCONFDIR=/usr/data/s

[SAtalk] Multiple Subject Matches

2002-11-12 Thread Patrick Bores
Hello, I'm trying to deploy SA site-wide and I'm writing a web configuration tool. What I would like to do is this: Have the web configuration tool put the following into the user_prefs file, like so: header MY_SUBJECT_TEST Subject=~/subject1/ header MY_SUBJECT_TEST Subject=~/subject2/ header

Re: [SAtalk] Custom rules not working with spamc/spamd?

2002-11-11 Thread Patrick Bores
*nix uses to stop and restart the spamd service. -Michael Patrick Bores <[EMAIL PROTECTED]> 11/11/02 10:34AM >>> Hello, I have the following in my user_prefs file: header MY_WHITELIST Subject=~/test/ score MY_WHITELIST -100 Piping a message to spamassassin applies the rule c

[SAtalk] Custom rules not working with spamc/spamd?

2002-11-11 Thread Patrick Bores
Hello, I have the following in my user_prefs file: header MY_WHITELIST Subject=~/test/ score MY_WHITELIST -100 Piping a message to spamassassin applies the rule correctly. Piping the same message to spamc ignores the rule. My local.cf file looks like this: allow_user_rules 1 rewrite_subjec