http://www.impsec.org/email-tools/local-rules.procmail
and look at the bottom of the file you will see what you need to look for.
Brad
---
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Inte
That will teach me to RTFM.
Thanks.
Brad
On Wed, 21 Jan 2004, Matt Kettler wrote:
> Why not change your domain whitelist to a whitelist_from_rcvd command,
> instead of whitelist_from.
>
> You'll avoid the forgery
I had the same problem and found out why.
The log has to be the current year only. The code inserts the current year
and my log went back to July. After I moved everything out prior to Jan
1st it worked fine.
Brad
On Thu, 22 Jan 2004, Vermyndax wrote:
> Hi Bob... Tried this and still got
fargo.caledoncard.com" in the
header and thinks that all is well.
If anyone out there has encountered this and found a way around it then I
would appreciate some input.
Thanks.
Brad
---
The SF.Net email is sponsored by EclipseCon 2004
Premi
http://www.emtinc.net/spamhammers.htm
There is also this list.
>
> Would anyone out there bother giving me a real-world example for a simple
> spam mail message ?
I don't know what to say here. Simply firing up the mail server should
provide you wi
w how to do it all, especially when
it comes to tying it into the Bayes system.
I suspect that systems like this could help target a fair amount of
spam, but I'm also not sure what it would do to the poor whois servers
(I notice SpamCop caches whois listings itself). Anybod
Are you using the --mbox flag with sa-learn?
Brad
On Fri, 16 Jan 2004, Marcus Frischherz wrote:
> Hi!
>
> I use SA 2.61, exim 4.24 and WU imapd, I use IMAP4 and keep my mails on the
> server. The folders seem to be in the mbx format. When I run sa-learn on one of
> them it, s
I was catching them with all of the other rules, I was just unsure as to
whether or not it was even checking the violator list. The sample that
Seth sent me came back positive so I know it is working.
Brad
On Thu, 15 Jan 2004, Christopher X. Candreva wrote:
>
> Rather that takeing o
Thanks Seth, that did the trick.
Brad
On 15 Jan 2004, Seth wrote:
> If you run the attached email through SpamAssassin, it should flag as a
> HABEAS_VIOLATOR.
>
> Seth
---
The SF.Net email is sponsored by EclipseCon 2
?ip=66.136.203.220>]
1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?66.136.203.220>]
Any help would be appreciated.
Thanks,
Brad Hazledine <[
Hi,
You want http://kepler.acns.bethel.edu/~bjn/spamassassin/rnd_uc_char.cf
Works great!
Brad
On Wed, 14 Jan 2004, Hein Zelle wrote:
> Hello,
>
> (new to this list, so please notify me if this has already been
> discussed or should be posted elsewhere. I've checked
score HABEAS_SWE 0.0 in your local.cf
Brad
On Mon, 12 Jan 2004, SAtalk Mail User wrote:
> Hello All,
>
> I have been getting alot of HABEAS based spam and I have been reporting
> the spam to [EMAIL PROTECTED] But in the mean time I would like to
> figure out a way to eith
I use the procmail sanitizer ...
http://www.impsec.org/email-tools/procmail-security.html
Been using it for years and it traps all of the garbage that people try to
send. Wonderful tool.
Brad
On Fri, 9 Jan 2004, Jeff Lasman wrote:
> We're being hit by MS security update emails.
How about giving the test a negative score? i.e. -20.0
Brad
On Thu, 8 Jan 2004, John Fleming wrote:
>
> I want to specify a text string in the Subject header such that if it
> exists, the msg will NOT be considered spam, no matter what else might be
> w
Excellent!!
Thanks for the help.
Brad
On Tue, 6 Jan 2004, Kenneth Porter wrote:
> I'm using this set of rules posted to the list last month. Drop this in
> /etc/mail/spamassassin as rnd_uc_char.cf.
---
This SF.net email is s
skin campion bunny beverage
diathesis reception ave stasis
washbowl chromatic embolden brad bismark chill me darken conifer here
caribou build ticklish predilect
slum joan scotsman kyoto bog plastic kamchatka attribution between width
paraxial claude way absentee
colatitude pedro otherwise bili
I've been getting a bunch of messages either squeaking by SA 2.61 or
nearly so (bigevil is nice), and added some rules to make them less
likely (I couldn't come up with a better name than glop, sorry):
describeglop_15 15 or more alphas in sequence
bodyglop_15 /[a-zA-Z]{15}/
s
also generate a fake MD5, you need the right private
key to generate a fake digital signature). I'm moderately surprised
that this hasn't happened already, as hackers have gotten to other
open-source projects like Debian, sendmail, etc.
Brad
On Jan 1, 2004, at 11:12 AM, Barry Port
t
should be good enough to authenticate.
Good luck!
Brad Koehn
---
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from
them and yet have an
intelligible message.
Lastly, RBLs adapt quickly, so you need a fresh supply of machines/IPs
to transmit the message.
We've made it pretty tough on the spammers. I'm glad I'm in another
line of work.
Brad
Martin Radford wrote:
At Mon Dec 15 15:12:42 2003
Oh boy am I dumb!
Never mind, the Received headers are correct, it's the attached spam
message that shows the full chain of headers back to the originating
server. That whole Received... with Spamassassin thing through me for a
loop.
My bad, sorry for the waste of bandwidth.
Brad
Brad
I've noticed that my Received: headers seem to have disappeared, at
least in messages that are marked as spam. For example, my subscription
to this list came in with the following Received headers:
Received: from mail.koehn.com ([unix socket])
by mail.koehn.com (Cyrus v2.1.15) with LMTP;
efore doing the pattern matching,
SA will be able to identify these.
Thanks.
Brad Wilkin
Lewis and Clark College
-
Brad Wilkin Information Technology
Director of Information Sy
Hey Everyone,
I'm having a problem trying to install spamassassin locally (my provider's
box crashed, and the new one doesn't have it installed site-wide):
I run:
perl Makefile.PL PREFIX=~/sausr SYSCONFDIR=~/saetc
and then
make ; make install
This is the error I get:
mkdir /usr/local/lib/per
0;
}
---
Regards,
Brad
On Thursday 16 October 2003 08:49, you wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> On October 15, 2003 02:15 pm, Brad wrote:
> > SA doesn't appear to learn from my SPAM mailbox:
> >
>
SA doesn't appear to learn from my SPAM mailbox:
sa-learn --mbox --spam /home//SPAM
Learned from 0 message(s) (521 message(s) examined).
Does anyone know why this is?
---
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.
Thanks Chris. That's all it was: restart spamd.
:-))
Is there a good help reference available for local.cf? I have searched on
Google and looked on th SA website but haven't foud anything so far. There is
no local.cf man page on my system.
Cheers,
Brad
On Saturday 11 October
In the message below, I have substituted the word "moon" for the male organ
waker upper drug. If I use the V word it'll be blocked.
I have a RH9 mail server and have done a default installation of SA 2.6. It
appears to be working as I am getting 75% of spam marked as *SPAM*
However, I
Title: Message
The
header info isn't stripped, but it the .msg files are still wrapped in
TNEF.
Another way to save them (this is how I do it) is to setup an IMAP
account thru Outlook Express, sync the messages, then drag them out to a folder
on your filesystem. This will expor
Put LANG="en_US" in /etc/sysconfig/i18n, log out and log back in and
start over. You should be ok then
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Greg
Ennis
Sent: Saturday, September 27, 2003 04:52 PM
To: [EMAIL PROTECTED]
Subject: [SAtalk] Installati
I would for sure set this one to zero since Osirusoft is defunct for the
time being
-Original Message-
From: Ken Gordon [mailto:[EMAIL PROTECTED]
Sent: Thursday, September 11, 2003 9:41 AM
To: [EMAIL PROTECTED]
Subject: [SAtalk] RCVD_IN_OSIRUSOFT_COM still in SpamAssassin version
2.60-rc3
Title: Message
RH8
-Original Message-From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wednesday,
September 10, 2003 8:40 AMTo:
[EMAIL PROTECTED]Subject: [SAtalk] Help,
Where are the awards, List of companies using it?
P.S. Anyone know
when spamassassin was i
Your FEATURES go in your sendmail macro file for creating your sendmail.cf.
Should be /etc/mail/freebsd.mc on FreeBSD and /etc/mail/sendmail.mc on Red Hat.
-Original Message-
From: Céline REDON [mailto:[EMAIL PROTECTED]
Sent: Tuesday, September 09, 2003 12:39 PM
To: '[EMAIL PROTECTED]'
Title: Message
use UNINST=1 when you upgrade your installation
like:
perl
Makefile.PL
make
make
test
make
UNINST=1 install
-Original Message-From: Chuck Baker
[mailto:[EMAIL PROTECTED] Sent: Tuesday, September 09, 2003 10:55
AMTo: [EMAIL PROTECTED]Subject:
[SAtalk] sa
confined to arcane editing of configuration files?
Regards,
Brad
---
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or
elps at all: most of the documentation I've found
either relates to sendmail, and the QMail docs I found didn't seem to work
with my setup. I'm sure I'm just missing something obvious, but feeling
myopic after staring at this for so long.
Again, thanks for any help.
B
GE
message rather than as individual messages. I haven't encountered this
problem on any of the lists: any idea what this is and how to fix?
Brad
---
This SF.NET email is sponsored by: eBay
Great deals on office technology -- on eBay now! C
I'm trying to figure out a good way to send mail from my mbox threw SA on
a machine that i just finished installing SA on. ie the mail was recived
before SA was installed and i want to process it now if i can.
anyone got a good one liner for me?
--
Brad
own fix or workaround for this?
Am I just being stupid? (Wouldn't be the first time!)
I'd appreciate off-list copies of any
replies.
Thanks,
Brad Jackson
Net Admin
I-1 Internet Group, Inc.
"i1" + at-sign + "i-1.net"
PS: Personal email stats for today: Receiv
We have a Red hat 7.3 mail server and I am looking for a way to filter out
SPAM email from our server. We have about 30 email accounts. Can Spam
Assassin do this?
---
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://t
hat wasn't spam.
Thanks,
Brad
---
This sf.net email is sponsored by: Influence the future
of Java(TM) technology. Join the Java Community
Process(SM) (JCP(SM)) program now.
http://ads.sourceforge.net/cgi-bin/redirec
y help would be great.
Thanks,
Brad
---
This sf.net email is sponsored by: Influence the future
of Java(TM) technology. Join the Java Community
Process(SM) (JCP(SM)) program now.
http://ads.sourceforge.net/cgi-bin/redirec
On Fri, Oct 18, 2002 at 08:12:48PM -0400, Duncan Findlay wrote:
> On Fri, Oct 18, 2002 at 10:45:39AM -0700, Jeremy Zawodny wrote:
> >
> > Where can I get more informaiton on that? I *really* need "-m" to
> > work. It semed to have been reliably on Linux w/Perl 5.6.1.
> >
> > If "-m" is hopeless
rified that I have the latest versions of all of my perl modules.
I'm running Perl 5.8.0 on Linux.
Has anybody else seen this? Any ideas on how to get past?
TIA,
Brad
---
This SF.NET email is sponsored by: AMD - Your access to the experts
no idea why this happens, but I'm sure someone out there can set
me straight... right?
Thanks in advance!!
Brad
smime.p7s
Description: S/MIME Cryptographic Signature
g that if I'm using spamc/d, I need to invoke
"| spamc -u $LOGNAME" from /etc/procmailrc?
TIA,
Brad Koehn
[EMAIL PROTECTED]
___
Don't miss the 2002 Sprint PCS Application Developer's Conferenc
My freebsd 4.4 startup script is much simpler then yours and it seems to
work for me. in /usr/local/etc/rc.d/
#!/bin/sh
[ -x /usr/bin/spamd ] && /usr/bin/spamd -u nobody -L -d > /dev/null && echo -n ' spamd'
The file is executable
brad
On Tue, 26 Feb 2002,
Should I remove the : after 0fw?
:0fw:
| spamc -f
:0e
{
EXITCODE=$?
}
___
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
>procmail: Couldn't determine implicit lockfile from "spamc"
What could be causing this?
- Transcript of session follows -
>... while talking to mail-incoming.hostsave.com.:
> >>> DATA
><<< 550 5.7.2 Refused at request of postmaster
>554 5.0.0 Service unavailable
>procmail: Coul
How can I enable the directory and not db based whitelisting? I am
getting these messages in the debug?
ebug: DB addr list: untie-ing and destroying lockfile.
debug: DB addr list: file locked, breaking lock.
___
Spamassassin-talk mailing list
[EMAI
I just turned on SA in an ISP environment using spamd with no
auto-whitelist for about 5000 users.
I have received about 50 complaints from people Yelling at me to disable
this for them. I was reading the docs and I don't know how to disable on
a per user basis when using spamd. I used to use t
seen some at 2 seconds. I have contacted mail-abuse and
I am going to get a secondary of their zone files and run it locally for
the DNS based lookup, and I think that it will be ok.
brad
On 17 Jan 2002, Craig Hughes wrote:
> On Thu, 2002-01-17 at 12:29, brad wrote:
>
> :0fw:
Are you recomending spamd -d -L -D is ok and then call it with the
procmailrc of spamc -f
Brad
On 17 Jan 2002, Sidney Markowitz wrote:
> On Thu, 2002-01-17 at 10:51, brad wrote:
> > SA takes 5-7 seconds per message and can leave
> > hundreds of procmail processes running.
>
:0fw:spam.lock
| spamc -f
:0e
{
EXITCODE=$?
}
and no there are not hundreds of spamc processes that I noticed. I did
mention that the perl Net::DNS module was found, and in the -D debug it is
not installed. Could this be part of the issue? I am doing razor lookups
and rbl lookups.
brad
On 17
Has anyone successfully used the milter as a direct plugin yet? My
procmailrc in /usr/local/etc/ is just invoking the spamc -f process.
Brad
On 17 Jan 2002, Craig Hughes wrote:
> On Thu, 2002-01-17 at 10:51, brad wrote:
>
> Problem: CPU usage with procmail to high, MTA stops
onnects to a SPAMD machine
to do the scanning and then then processes the mail and sends it to "main mail server"
running no SA just MTA / LDA / pop3 / IMAP
keep existing config + popper / imap
Brad
___
Spamassassin-talk mailing list
[EMAIL
you mention "up to date" are you inquiring if I run mergemaster and then
add the new users into the master.passwd file?
Thank you for your help thus far.
brad
On Wed, 16 Jan 2002, Thomas Hurst wrote:
> * brad ([EMAIL PROTECTED]) wrote:
>
> > Still running as root: u
Running SA 1.5 / SPAMD -u nobody -d on a machine that accepts 88k mails
per day.
Today was the big test, and there was a huge failure. The issue is that I
get so many procmail processes opening that the CPU average on the machine
pegs and the load average then causes sendmail to die.
I get on
I am running spamd -d -D to start out with I am getting this error message
Still running as root: user not specified, not found, or set to root.
Fall back to nobody.
on a freebsd system should I run it as spamd -u nobody -d ?
brad
___
Spamassassin
59 matches
Mail list logo
