Re: [SAtalk] SPAMD stops tagging spam?

2004-01-31 Thread WA9ALS - John
, please let me know. I'm a newbie and have no clue where to look. I use Postfix, Procmail, and SA, and it was working great. -John P.S. I posted about this several hours ago and have still not seen the post. We know the list is having problems, so that's no big deal. I'd sure l

Re: [SAtalk] list working

2004-01-29 Thread WA9ALS - John
> is this list working today? Seems off and on... I posted a few hours ago and haven't seen it yet. I've also gotten several copies of mail sent over the weekend. --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on O

[SAtalk] Some filtered, some not!

2004-01-28 Thread John Fleming
Below are example of 2 headers from the SATalk list. One was apparently filtered by Spamassassin, and one not. What's the difference? Some of my mail is being filtered, and some not, and I have no idea why! I thought a reboot fixed it, but NOT! PLEASE HELP! Thanks - John X-Mailer: X

[SAtalk] Re: Stopped filtering

2004-01-28 Thread John Fleming
> For the most part, SA had stopped filtering my email accts. I say "for the > most part" because some headers indicate some activity by SA, but they are > not what I usually see, and I'm not experienced enough to know if someone > else's SA was what filtered the ones that show this activity. Ple

[SAtalk] Stopped filtering

2004-01-28 Thread John Fleming
it just quit working overnight, but I don't know where to start looking for the problem. I'm not sure about my other users, but everyone is using the site-wide local.cf file. - John --- The SF.Net email is sponsored by EclipseCon 2

[SAtalk] Another V got through

2004-01-28 Thread WA9ALS - John
This one even has the V word spelled correctly as part of a bigger word. How is it getting past the DRUGS and MRWIGGLY rules? http://wa9als.com/spam2.html I've gotten a couple of these now and have added a body check for the "grax" word, but that seems like a banda

[SAtalk] [RD] Meta-tripwire idea

2004-01-28 Thread John Wilcock
six people) to quickly judge whether this is more effective than merely scoring individual tripwire rules at 0.07 each or whatever. I've put a modified tripwire.cf (based on tripwire 1.16) at http://www.snoweye.com/john/metatripwire.cf if anyone is interested in trying this against a corp

Re: [SAtalk] Problem upgrading SA

2004-01-27 Thread John Oliver
On Tue, Jan 27, 2004 at 02:08:54PM -0800, Evan Platt wrote: > --On Tuesday, January 27, 2004 1:46 PM -0800 John Oliver > <[EMAIL PROTECTED]> wrote: > > > I had SA 2.60 and just installed 2.63 via CPAN. spamassassin -V tells > > me I have 2.63 now, but the headers of my

[SAtalk] Problem upgrading SA

2004-01-27 Thread John Oliver
I had SA 2.60 and just installed 2.63 via CPAN. spamassassin -V tells me I have 2.63 now, but the headers of my emails still say 2.60 How can I make certain that mail is being scanned by 2.63? -- John Oliver, CCNAhttp://www.john-oliver.net/ Linux/UNIX/network

[SAtalk] Re: W32.Novarg.A@mm virus

2004-01-27 Thread John Hall
ument.zip kcmnw.exe message.scr message.zip pqoew.pif readme.scr readme.zip text.exe text.zip xatwdu.zip Cheers, John --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See

[SAtalk] Meta-tripwire idea

2004-01-27 Thread John Wilcock
ire.cf (based on tripwire 1.16) at http://www.snoweye.com/john/metatripwire.cf if anyone is interested in trying this against a corpus in comparison with the standard tripwire set. John. -- -- Over 2400 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical doc

[SAtalk] SA-procmail newbie

2004-01-26 Thread WA9ALS - John
t the files with vim shows that they are indeed the spam emails. Can I run SA learn on that directory as is? Thanks! - John --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration Se

[SAtalk] Another v word got through

2004-01-26 Thread WA9ALS - John
This one even has the V word spelled correctly as part of a bigger word. How is it getting past the DRUGS and MRWIGGLY rules? http://wa9als.com/spam2.html I've gotten a couple of these now and have added a body check for the "grax" word, but that seems like a banda

[SAtalk] Where is auto_learn?

2004-01-23 Thread John Fleming
Where is the auto_learn parameter - which file? tnx --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www

Re: [SAtalk] v+word problem

2004-01-22 Thread John Fleming
BTW, I AM using BigEvil and Anti_Drug... - Original Message - From: "WA9ALS - John" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, January 22, 2004 7:19 AM Subject: [SAtalk] v+word problem > I received a dreaded v word spam that got past MRWIGGLY

[SAtalk] v+word problem

2004-01-22 Thread WA9ALS - John
what I can do to remedy these getting through? I guess I can put it on a website: http://wa9als.com/spamtest.htm Thanks for any tips! - John --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development

[SAtalk] At least they're honest about it!

2004-01-22 Thread John Wilcock
:34:57 +0100 (CET) John. -- -- Over 2000 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages- www.tradoc.fr --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Confere

[SAtalk] Phoneme and Grammar anti-noise scanning ?

2004-01-21 Thread John August
phoneme substitutions of words which were meant to be communicated; I'm talking here about noise identification, and there do not seem to be any postings of this nature readily searched. -- Democracy is a bitch if you're in the 49%. John August --

Re: [SAtalk] Hello, new to list ! :-)

2004-01-21 Thread John Fleming
This works pretty well, with only an occasional ham getting through. I suspect that mine is this low because I haven't been "SA-learn"ing much...?? If I set it at 5.0, lots would be getting through. Is this the usual? IOW, as my system learns more, I will be able to raise the c

[SAtalk] Help with report pse

2004-01-19 Thread John Fleming
too, so I don't understand the date in past - Does that use timing from the sender's computer time, ISP times, or what? Who is likely the open proxy - Earthlink That seems unlikely...? Thanks - John X-Spam-Report: * 0.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 600-800 bytes of words *

[SAtalk] Re: Razor issue on Debian

2004-01-19 Thread John Hall
etting razor 2.36 and applying the taint-safeness patch. There is a backported version of razor (and of spamassassin) for Debian stable. Add these lines to /etc/apt/sources.list: deb http://www.backports.org/debian stable razor deb http://www.backports.org/de

[SAtalk] Where are values kept for the built-in rules?

2004-01-17 Thread John Fleming
I would like to increase one of the built-in rule hit values. Tnx - John --- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in

Re: [SAtalk] Above threshhold but not tagged

2004-01-15 Thread John Fleming
I did restart spamd one time, but as I said, autolearn has never been on since I started, and the computer has been rebooted a few times. - Original Message - From: "Gary Smith" <[EMAIL PROTECTED]> To: "John Fleming" <[EMAIL PROTECTED]> Sent: Thursda

[SAtalk] Above threshhold but not tagged

2004-01-15 Thread John Fleming
Newbie question - I just got one of those d-rug type emails that scored several points above my spam cutoff and wasn't on a whitelist, yet the subject wasn't tagged as expected. What can cause that? tnx --- The SF.Net email is sponsored by E

Re: [SAtalk] Scoring the Habeas header ...

2004-01-14 Thread John Ruttenberg
Mike Batchelor: > --On Tuesday, January 13, 2004 11:39 AM -0800 Brian May > <[EMAIL PROTECTED]> wrote: > > > IF spammers use the > > Habeas headers, and the message is in fact spam, they will be sued. > > And as soon as SA is upgraded to recognize when a lawsuit is pending, I > might turn the H

Re: [SAtalk] Habeas and digital signatures

2004-01-14 Thread John Ruttenberg
Adam D. Lopresto: > The problem is that gpg/pgp aren't very well supported. Getting people to > add a few header lines is pretty easy (I've considered it a few times, but > never got around to it), but getting people to sign their mail is much > harder. After all, that's the reason we aren't all

Re: [SAtalk] Habeas and digital signatures

2004-01-14 Thread John Ruttenberg
Mat Harris: > > this sounds like a heavily commercialized version of pgp/gpg. It would be > just as easy to adapt MTAs to filter spam based on pgp keys (i'm not > suggesting we do). > I was imagining it would just use pgp/gpg and not reinvent that wheel. The idea was just to have habeas actuall

[SAtalk] Habeas and digital signatures

2004-01-14 Thread John Ruttenberg
I sent this to Habeas Technical Support. But I think I'll get a better response on this mailing list. This seems like an obvious idea. There must be something wrong with it. But what? Here is a technical suggestion. I think your business plan works by using legal action against violat

[SAtalk] Re: Exchange and autolearn

2004-01-14 Thread John Hall
I don't have > to use a real user's account info. I found that Exchange 2000 changed the headers too much and mime-encoded the body and so this approach wasn't really going to work, since the e-mail was too heavily modified for the Bayes to work properly. John -

Re: [SAtalk] Scoring the Habeas header ...

2004-01-14 Thread John Wilcock
Of the five spams I received over the last 24 hours with forged Habeas headers, one also hit the HABEAS_VIOLATOR rule. Give Habeas a chance and their system should be perfectly effective (though we need to make the HABEAS_SWE score less negative). John. -- -- Over 2000 webcams from ski resort

[SAtalk] [Fwd: gedanken forsythe deadhead hom] - Does anyone have a filter for this?

2004-01-13 Thread John Burricelli - KC2KZZ
Suddenly I'm getting flooded with emails like this one? Does anyone have a filter for this? Original Message Subject: gedanken forsythe deadhead hom From:"Melody Hare" <[EMAIL PROTECTED]> Date:Tue, January 13, 2004 8:16 pm To:

[SAtalk] Re: Exchange and autolearn

2004-01-13 Thread John Hall
om the messages that have been dropped into the imap folder. It's a kludge but it does work. Cheers, John --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering adva

RE: [SAtalk] Habeas mark and auto-learning as ham

2004-01-12 Thread Stewart, John
> Anyway, what do others think about this? I personally turned off auto-learning some time ago and it seems that SA's effectiveness has been quite good, and *remained* good. I do train it manually with stuff that it missed, but that's pretty much the only training I do. johnS -

[SAtalk] Empty spam?

2004-01-09 Thread Stewart, John
I, as well as many others at my company here, have been getting in the past month or two a lot of empty spam. In the body of the email is nothing at all. Often SA will tag it with some stuff based on the headers, but many of these are getting through because there is simply nothing on which to tri

Re: [SAtalk] Simple newbie question

2004-01-08 Thread WA9ALS - John
see that this got a score of +19.4 based on the spam, but it started at -500, so it ended up at -480.6 and got through. What am I missing? THANKS! - John --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast

[SAtalk] Once more, with feeling

2004-01-08 Thread John Rudd
Yes, no, maybe, don't care? Original Message Subject: [SAtalk] Does SA do this check: Date: Sun, 4 Jan 2004 18:04:27 -0800 From: John Rudd <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Some friends and I have noticed that some spam messages arrive with multipart/

Re: [SAtalk] Simple newbie question

2004-01-08 Thread John Fleming
> Be sure to restart spamd (if you use it) after adding/changing things in your local.cf. THANKS to those suggesting a negative score - DUH! I understand why "0" doesn't accomplish anything - don't know why I couldn't see the value in a negative score! (Uh, and thanks for the reminder to restart

[SAtalk] Simple newbie question

2004-01-08 Thread John Fleming
what else might be wrong with it. Using SA with Procmail and Postfix. Thanks - John --- This SF.net email is sponsored by: Perforce Software. Perforce is the Fast Software Configuration Management System offering advanced branching capabilities

[SAtalk] Bonded Sender Program

2004-01-08 Thread John Hall
has an open relay/proxy, but can't find an easy way on their website of reporting it. The whole point is that a sender posts a bond, which presumably is forfeited if they send spam. How do I go about reporting it? Cheers, John --- This S

RE: [SAtalk] Update on SQL-ization of AWL, Bayes, etc.?

2004-01-06 Thread Stewart, John
> I've had my AWL data in a SQL database for almost a year now Michael - does your code handle per-user AWL and bayes in SQL, or just site-wide? thanks! johnS --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in L

RE: [SAtalk] SA for home use, with POP server at ISP?

2004-01-06 Thread John Cianfarani
Vipul Razor etc... Thanks John -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Thielen Sent: Tuesday, January 06, 2004 1:50 AM To: [EMAIL PROTECTED] Cc: Andrew Lazarewicz; Steve Thomas Subject: Re: [SAtalk] SA for home use, with POP server at ISP? On Mon

Re: [SAtalk] X-Mailer is totally bogus

2004-01-06 Thread John Wilcock
- my regexp skills aren't top-notch. It seems to work fine - hits all those bayes-buster spams. However, it also hits messages with no X-Mailer header at all - which I suspect may lead to FPs. To exclude this, I've changed it to: header local_XMAILER_BOGUS X-Mailer =~ /^[a-z][^A-Z0-9]

[SAtalk] Does SA do this check:

2004-01-04 Thread John Rudd
Some friends and I have noticed that some spam messages arrive with multipart/alternative messages whose different multiparts don't match (they're supposed to be the same data in different formats, like txt vs html). In particular, the txt segments seem to be gibberish and the html segments

[SAtalk] SA.rpm with sendmail install/usage

2004-01-03 Thread john walsh
me how to call spamassassin from sendmail to start with. Please can someone tell me (and add into the DOC's) how I link spamassassin into sendmail when using the RPM ? NB. all the DOC's talk about downloading the source files and building, or perl -MCPAN, but I want to u

[SAtalk] Filtering on second isp account being ignored.

2003-12-31 Thread John Phillips
s a config file I should write to somewhere with special settings? Any web page that explains this sort of stuff in simple English? All help greatly appreciated! Words of one syllable even more appreciated! -- John Phillips Sydney, Australia (Happy New Year!) --

Re: [SAtalk] USER_IN_ALL_SPAM_TO

2003-12-30 Thread John Sickles
On Tue, 30 Dec 2003, John Sickles wrote: Another thing that I noticed about the headers is that the "Received" headers are missing "for username" entries and have "id XX" instead. I have edited these headers to show what I mean. I am wondering how is this m

Re: [SAtalk] USER_IN_ALL_SPAM_TO

2003-12-30 Thread John Sickles
On Tue, 30 Dec 2003, Theo Van Dinter wrote: > On Tue, Dec 30, 2003 at 01:14:07PM -0500, John Sickles wrote: > > test USER_IN_ALL_SPAM_TO is triggered. But he is not listed in local.cf > > (or any files in /usr/share/spamassassin) in a "all_spam_to" entry. When I >

[SAtalk] USER_IN_ALL_SPAM_TO

2003-12-30 Thread John Sickles
Hi, This user "[EMAIL PROTECTED]" keeps getting spam because the test USER_IN_ALL_SPAM_TO is triggered. But he is not listed in local.cf (or any files in /usr/share/spamassassin) in a "all_spam_to" entry. When I run this mail by hand with "spamassassin -D < mail" there is no hit for USER_IN_ALL_SPA

Re: [SAtalk] False positives

2003-12-29 Thread John Beamon
He's gone, folks. He had no interest in getting real assistance, and he never came back. The list has been most helpful in pointing out that his own subscribers use SA voluntarily, train it themselves, and failed to whitelist this web-app travesty of an "email" message. (I particularly like

[SAtalk] Cron job messages

2003-12-27 Thread Dr. John W. Glendening
ject: Cron <[EMAIL PROTECTED]> /usr/lib/sa/sa1 1 1 Cannot append data to that file -- Dr. John W. (Jack) Glendening --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skil

[SAtalk] Delay in spamd

2003-12-23 Thread John Hetherington
e the 30 sec delay ? TIA -- John Hetherington. -- John Hetherington <[EMAIL PROTECTED]> --- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Lin

Re: [SAtalk] Can I feeda whole mailbox to spamassain -r?

2003-12-19 Thread John Harrold
use_bayes -- -- | /"\ john harrold | \ / ASCII ribbon campaign jmh at member.fsf.org| X against HTML mail the mo

Re: [SAtalk] regex expansion tool

2003-12-17 Thread John Harrold
would have 100 different matches: 00, 01, 02, ..., 98, 99, something like m#\d*\w# would effectively have an infinite number of matches. -- -- | /"\ jo

[SAtalk] Can I feeda whole mailbox to spamassain -r?

2003-12-17 Thread John Harrold
use_bayes -- -- | /"\ john harrold | \ / ASCII ribbon campaign jmh at member.fsf.org| X against HTML mail the mo

RE: [SAtalk] MySQL not working? No indication of error when running spamd -D

2003-12-15 Thread Stevens, John
eld entries are standard and documented. BTW, apologies for the stupid disclaimer. See above. Regards TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 -Original Message-

RE: [SAtalk] MySQL not working? No indication of error when running spamd -D

2003-12-15 Thread Stevens, John
o the latest. Still using 2.54 Regards TUSC Computer Systems - www.tusc.com.au John Stevens - MIS Manager, Senior Project Engineer Mobile: 0419840411 Direct: 03 9840 4428 -Original Message- From: Jeremy Zawodny [mailto:[EMAIL PROTECTED] Sent:

[SAtalk] RE: Using outlook mail to feed sa-learn

2003-12-12 Thread John Hall
test ) which isn't much good for plain text spam. Does anyone have an idea how to stop this from happening? Cheers, John --- This SF.net email is spo

Re: [SAtalk] OT Help: Mail form CGI script?

2003-12-09 Thread John Harrold
field. -- -- | /"\ john harrold | \ / ASCII ribbon campaign jmh at member.fsf.org| X against HTML mail the most us

[SAtalk] a couple questions.

2003-12-09 Thread John Harrold
. -- -- | /"\ john harrold | \ / ASCII ribbon campaign jmh at member.fsf.org| X against HTML mail the most useful

[SAtalk] How to make SA "learn" from spam?

2003-12-02 Thread John Oliver
I'm led to believe I can feed untagged spam (and tagged non-spam) to SA for it to "learn" how to be better. How do I do this? -- John Oliver, CCNAhttp://www.john-oliver.net/ Linux/UNIX/network consulting http://www.john-ol

[SAtalk] SA 2.60 not logging - solaris 9

2003-11-27 Thread John Horne
cker-Version header). Anyone any ideas? Thanks, John. -- --- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 233839 -

Re: [SAtalk] Blocking of bouncing addresses

2003-11-27 Thread John Oliver
. I've asked about "reversing" FEATURE(`blacklist_recipients') in comp.mail.sendmail, but haven't had an answer. I'm in the same boat, but also have considerably more than 64kb/s to work with... :-) > anybody got any thoughts on a live blocking setup or seen a decent l

[SAtalk] SpamAssassin getting around dnsbls?

2003-11-26 Thread John Oliver
they work... I can look through the logs and see hundreds of denied connections. So, why did this piece of mail make it through sendmail to SpamAssassin? I don't see how SpamAssassin could be causing it, but... I know my dnsbls *are* working. -- John Oliver, CCNA

[SAtalk] rewrite_subject problems and partial solution? (spamassassin 2.60, spamc/spamd config)

2003-11-26 Thread John Jasen
tween the global local.cf and and the independant user_prefs file, perhaps where rewrite_subject is being reset to off-by-default if not explicitly declared in user_prefs? -- -- John E. Jasen ([EMAIL PROTECTED]) -- User Error #2361: Please insert coffee and try

RE: [SAtalk] Re: An Open Letter to the SA-talk forum

2003-11-26 Thread John Parken
his explanation, his work product seems fatally flawed. Personally, I think that Logan's explanation for his poor journalistic effort is just as weak as his initial work product after whatever effect his copy editor may have had on it. /s/ John Parken > -Original Message- &

[SAtalk] Why four scores?

2003-11-25 Thread John Oliver
/etc/mail/spamassassin/local.cf ? -- John Oliver, CCNAhttp://www.john-oliver.net/ Linux/UNIX/network consulting http://www.john-oliver.net/resume/ ******* ******** Contribute to the SpamCon Legal F

RE: [SAtalk] An Open Letter to the SA-talk forum

2003-11-25 Thread Stewart, John
> Is SA hard to install? Not harder than any other program > based on Perl. While I agree it is not a good idea to compare SA 2.44 to current commercial anti-spam packages, I think those of you who say that SA is easy to install are being a little bit disingenuous. It has a whole laundry list o

RE: [SAtalk] Why Bayes is so essential

2003-11-24 Thread Stewart, John
> Some time ago, there was an announcement of patches to SA to allow for > SQL-stored Bayes databases. > > I haven't seen word of this being integrated in to the main > tree since then, > but it's possible I've missed it. Hmm... I don't recall seeing this at all; does anyone have any info on t

[SAtalk] Meaning of spamassassin -a option

2003-11-23 Thread John Parken
Through the news.spamassassin.org site I found what looks like a good way for Outlook users to get spam (and ham) into the Bayes sa-learn.  Dan Kohn suggestions is at ─ http://www.dankohn.com/archives/000323.html.   After special handling for mail previously processed by SA that is now be

[SAtalk] Subject line not being marked

2003-11-23 Thread John Horne
is flagged as spam but the subject line hasn't been changed. The system-wide /etc/mail/spamassassin/local.cf file contains: rewrite_subject 1 I have stopped and restarted spamassassin. Anyone any ideas? Thanks, John. -- -

Re: [SAtalk] What is marked as spam

2003-11-22 Thread John Oliver
On Sat, Nov 22, 2003 at 06:24:38PM -0800, Robert Menschel wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hello John, > > Saturday, November 22, 2003, 4:24:01 PM, you wrote: > > JO> I started using the default setting of 5 in user_prefs. This caught >

[SAtalk] What is marked as spam

2003-11-22 Thread John Oliver
missing something really big and important here... :-) -- John Oliver, CCNAhttp://www.john-oliver.net/ Linux/UNIX/network consulting http://www.john-oliver.net/resume/ ******* ******** Contribute to the SpamCon

Re: [SAtalk] DNSBL observations and a couple of questions

2003-11-21 Thread John Oliver
of my clients happily use SPEWS ;-) I would recommend to *not* use bl.spamcop.net at the MTA for a large-scale, production server... even *they* say not to. It's too easy to game SpamCop. -- John Oliver, CCN

[SAtalk] Getting SA going

2003-11-21 Thread John Oliver
How do I proceed? -- John Oliver, CCNAhttp://www.john-oliver.net/ Linux/UNIX/network consulting http://www.john-oliver.net/resume/ ******* ******** Contribute to the SpamCon Legal Fund!! http://www.s

RE: [SAtalk] scoring system and values...

2003-11-08 Thread Stewart, John
Okay, THIS is a little silly for sourceforge, at least for the SA list: <[EMAIL PROTECTED]>: host mail.sourceforge.net[66.35.250.206] said: 550-This message matches a blacklisted regular expression ([Vv] *[Ii] *[Aa] 550 *[Gg] *[Rr] *[Aa]) (in reply to end of DATA command) (now re-edi

Re: [SAdev] Re: [SAtalk] (not) up to date SpamAssassin

2003-11-06 Thread John Peacock
e the 'version' modules I am writing, but I don't know how far that is going (and I know I haven't been exactly productive on that subject lately[1]). Even so, it is better to use pure numeric versions for the foreseeable future. John [1] I do have the first pass for a vers

[SAtalk] Per-user bayes without local accounts?

2003-11-06 Thread Stewart, John
I'm wondering if it is possible to provide per-user bayes learning without having accounts on the SA server for each user. Has anyone done anything like this? I'm running it with amavisd-new, and am running it with site-wide bayes. The spams/hams to learn come from a public folder, and generally

[SAtalk] Low score nigerian-type

2003-11-05 Thread John Kelly
The following mail gets a score of 0.1. How come? X-Spam-Status: No, hits=0.1 required=7.0 tests=BAYES_00, DATE_IN_FUTURE_24_48, FROM_ENDS_IN_NUMS, NO_REAL_NAME, TO_ADDRESS_EQ_REAL autolearn=no version=2.60-jdk.2.9.1 Body: Permit me to introduce myself – I am fredu makudo, special Aide to the

RE: [SAtalk] trying to tweak SA

2003-11-03 Thread Stewart, John
> Anne Ramey writes: > >I'm trying to add local rules, but only one of the .cf files in > >/etc/mail/spamassassin seems to be used. Can you only have > one extra > >.cf file? (I'm using amavis with SA, so I was told the extra rules > >can't go in local.cf). > > Please ask the amavis people

RE: [SAtalk] RCVD_IN_DYNABLOCK FP?

2003-11-03 Thread John Kelly
rstood this? I assume that the checks start at the most recent hop (ie here), go back until they can find a "trusted IP" and then check whether the next is in dynablock.easynet.nl. If a "trusted IP" cannot be found every IP

[SAtalk] Problems with bayes "forgetting" in 2.60

2003-11-03 Thread Stewart, John
So, I'm running SA 2.60 with bayes enabled. I've got a folder to which people can drag emails that are misclassified. This has always worked very well in the past with 2.55. What I've noticed is that when SA learns from a spam, the bayes score usually shoots way up to 99% right away (an improveme

RE: [SAtalk] Moving SPAM to a separate Mailbox

2003-10-27 Thread John Parken
ath (your path my of course be different). /s/ John > -Original Message- > From: [EMAIL PROTECTED] [mailto:spamassassin- > [EMAIL PROTECTED] On Behalf Of Evan Platt > Sent: Monday, October 27, 2003 9:32 AM > To: [EMAIL PROTECTED] > Subject: Re: [SAtalk] Moving SPAM to a sep

[SAtalk] RE: [AMaViS-user] Amavisd-new and logging untrusted relays...

2003-10-27 Thread Stewart, John
> Median sounds like a better idea than average, for sure. > Perhaps to be conservative both will have to be over a > certain threshold. Actually, perhaps it would be best to only turn off SMTP from servers from which *no* legitimate mail was delivered (in the last X amount of time). This is e

[SAtalk] RE: [AMaViS-user] Amavisd-new and logging untrusted relays...

2003-10-27 Thread Stewart, John
> | - The "action" routine would run through the hashes and > compute the average > | spam levels for each IP, ... > |... > | I guess I need to sort out what a good criteria would be > for action. Would > | average spam level be an adequate way to determine a "bad" IP? ... > > Don't use 'average

RE: [SAtalk] Re: [OT] What is next step?

2003-10-25 Thread VonEssen, John
ause in their policy to look good. If spammers and their commission partners loss the ability to operate with domain names, it makes things difficult very difficult. John -Original Message- From: E R [mailto:[EMAIL PROTECTED] Sent: Thursday, October 23, 2003 1:31 PM Cc: [EMAIL PR

[SAtalk] Re: spamass-milter error (Hannu Liljemark)

2003-10-25 Thread John Kelly
-p /var/run/spamass.sock If you're starting it from init.d you might try chkconfig --del spamass-milter and add something similar to above to rc.local instead. (Please bear in mind I'm no linux expert!) Cheers John --- This SF

[SAtalk] RE: Amavisd-new and logging untrusted relays... was: RE: [SAtalk] [OT ] What is next step?

2003-10-23 Thread Stewart, John
> > Unfortunately, the $untrusted variable always seems to be > blank. This is > > what I see in the logs: > > my bad. try > > my $untrusted = $per_msg_status->_get_tag > ("RELAYSUNTRUSTED"); > > no _'s. Awesome! That did it! I'm now getting logging of untrusted relays from ama

[SAtalk] RE: Amavisd-new and logging untrusted relays... was: RE: [SAtalk] [OT ] What is next step?

2003-10-23 Thread Stewart, John
Okay, I whacked together a perl script to do some very rudimentary parsing of the SMTP relays logging I hacked into amavisd-new. I filtered out any host that delivered less than 2 emails, or had an average spam level of less than 5. This is what I ended up with for this afternoon's mail (since I

[SAtalk] IP Blocks to kill at the firewall?

2003-10-23 Thread John L
block at the firewall too. Thanks! John --- This SF.net email is sponsored by: The SF.net Donation Program. Do you like what SourceForge.net is doing for the Open Source Community? Make a contribution, and help us add new features and functi

[SAtalk] RE: Amavisd-new and logging untrusted relays... was: RE: [SAtalk] [OT ] What is next step?

2003-10-23 Thread Stewart, John
Clueless hacker wrote: > > Is there any way to get this _RELAYSUNTRUSTED_ data into the > > Mail::SpamAssassin object somehow? Then I think I could > hack amavisd-new to > > log this relay information. jm wrote: > Hmm -- I suppose you could do > > my $untrusted = $per_msg_status->_get_tag

RE: [SAtalk] Re: [OT] What is next step?

2003-10-23 Thread VonEssen, John
sizable amount of spam to come in. Then, remove the user, resulting in 550. Then monitor inbound attempts for that address and see at what rate the traffic falls off. For all we know, maybe spammers don't clean their lists, and they are already wasting resources on bad addresses. John -

Amavisd-new and logging untrusted relays... was: RE: [SAtalk] [OT ] What is next step?

2003-10-22 Thread Stewart, John
John Stewart (not the talk show host, nor the singer) wrote: > > I'm sure SA must parse each of the Received headers to > determine the SMTP > > servers, so at some point this information is available. Would it be > > possible to get this information logged somehow wi

RE: [SAtalk] [OT] What is next step?

2003-10-22 Thread Stewart, John
I'm not sure if this would be something that SpamAssassin could do, or if it would need to be integrated into amavisd-new, for those of us using that excellent tool. (BTW, I just wanted to say 2.60 is the bee's knees. Bayes learning seems to be even more improved than the already good 2.55 learni

[SAtalk] Are you infested? Tell me about it...

2003-10-21 Thread John Biggs
Hi, I’m working on a book on computer security and would like to get a firsthand account of someone who is completely infested by spam and how they’re trying to fight it. Please reply to this address if you have a moment to talk about your spam woes. Best, John Biggs

[SAtalk] Re: autolearn=no, no awl, no syslog entries

2003-10-19 Thread John Kelly
Hi Some follow up: More searching implied that for specifying a global path for auto-whitelist an additional .../auto-whitelist needs to be appended to the path, eg: /root/.spamassassin/auto-whitelist/auto-whitelist and, sure enough, the file is now created. It's still not being used, thoug

[SAtalk] autolearn=no, no awl, no syslog entries

2003-10-17 Thread John Kelly
newbie to linux) and I guess I've overlooked something so simple! I've looked at the archives and note that others are in a similar position but I can't find a solution. Any suggestions? Thanks John Outputs: local.cf # Version # version_tag jdk.1.0.1 # B

[SAtalk] SA 2.60 and amavisd-new - more bayes issues?

2003-10-15 Thread Stewart, John
I finally got around to installing 2.60 today in my system, running it with amavisd-new (which I also bumped up to the latest, 20030616. I'm very happy that the bayes opportunistic expiration is now configurable with the bayes_auto_expire option. However, there seems to be some other contention

RE: [SAtalk] A delay on MX DNS check in 2.60

2003-10-15 Thread John Scully
delay on MX DNS check in 2.60 At 09:56 AM 10/15/03 -0400, John Scully wrote: >debug: Failed to parse line in SpamAssassin configuration, skipping: >local_tests_only 0 >debug: Failed to parse line in SpamAssassin configuration, skipping: >defang_mime 0 Ouch.. fix your config file to be

[SAtalk] A delay on MX DNS check in 2.60

2003-10-15 Thread John Scully
I upgraded from 2.55 to 2.60 last night and everything is running well except for a long (up to 30 seconds) delay on the MX DNS check. I am running named locally and it is responding fine. The delay seems to be while checking the MX DNS of the TO: addr. The following output is from a test. Ev

RE: [SAtalk] [RD] Evil rules HUGE update!

2003-10-14 Thread Stewart, John
> Nope, it looks like WordPad is a bad place to edit :) > Apparently it has some > hidden characters in it. AS of 4:40 EST today, I resaved it > under MSDOS text > format in the hopes it fixed it. Did you get the file before then? Aye, I'm sure I did. However, someone has also suggested wget, w

  1   2   3   4   >