Dan,
On Fri, 2004-01-23 at 09:04, Smart,Dan wrote:
> This command works every time from command line, but not passed as a param
> from SA_RESTART.
> "postfix stop ; sleep 15 ; /etc/init.d/spamassassin restart ; postfix start"
>
> It runs the postfix stop and then quits. Any idea why? I can cre
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Mike Batchelor writes:
>I am about ready to just open the message body with MIMEDefang and whack
>anything that mentions "InterScan" with extreme prejudice (like, forward it
>to InterScan's Postmaster, until they forcibly distribute a patch to all
On Tuesday 27 January 2004 17:09, Mike Batchelor wrote:
> I am about ready to just open the message body with MIMEDefang and whack
> anything that mentions "InterScan" with extreme prejudice (like, forward it
> to InterScan's Postmaster, until they forcibly distribute a patch to all
> their custome
iday, January 23, 2004 12:44 PM
| To: Smart,Dan; [EMAIL PROTECTED]
| Subject: RE: [SAtalk] Rules Du Jour v 1.07b
|
| Dan,
|
| On Fri, 2004-01-23 at 09:04, Smart,Dan wrote:
|
| > This command works every time from command line, but not
| passed as a
| > param from SA_RESTART.
| > "
On Fri, 23 Jan 2004, Smart,Dan wrote:
> Humm
>
> This command works every time from command line, but not passed as a param
> from SA_RESTART.
> "postfix stop ; sleep 15 ; /etc/init.d/spamassassin restart ; postfix start"
>
> It runs the postfix stop and then quits. Any idea why? I can creat
mart,Dan; [EMAIL PROTECTED]
| Subject: RE: [SAtalk] Rules Du Jour v 1.07b
|
| On Thu, 2004-01-22 at 22:57, Smart,Dan wrote:
| > That works great! Thanks.
| >
| > I added the following command for SA_RESTART
| "/usr/sbin/postfix stop
| > && sleep 15 && /etc/in
written by Randal, Phil
> Some mistake here:
>
>
> CF_URLS[4]="http://www.emtinc.net/includes/weeds.cf";;
> CF_FILES[4]="weeds.cf";
> CF_NAMES[4]="Jennifer's Weeds Set (1)";
> PARSE_NEW_VER_SCRIPTS[4]="${PERL} -ne 'print if
> /^\s*#.*(vers?|version|rev|revisi
Thanks. Will try in the AM.
<>
| -Original Message-
| From: Chris Thielen [mailto:[EMAIL PROTECTED]
| Sent: Thursday, January 22, 2004 5:18 PM
| To: Smart,Dan; [EMAIL PROTECTED]
| Subject: RE: [SAtalk] Rules Du Jour v 1.07b
|
| On Thu, 2004-01-22 at 22:57, Smart,Dan wrote:
|
On Thu, 2004-01-22 at 22:57, Smart,Dan wrote:
> That works great! Thanks.
>
> I added the following command for SA_RESTART "/usr/sbin/postfix stop &&
> sleep 15 && /etc/init.d/spamassassin restart && /usr/sbin/postfix start"
> but it doesn't seem to work, even though it works for command line.
need to make sure postfix starts if the SA_RESTART fails.
<>
| -Original Message-
| From: Chris Thielen [mailto:[EMAIL PROTECTED]
| Sent: Thursday, January 22, 2004 4:04 AM
| To: Smart,Dan; [EMAIL PROTECTED]
| Subject: RE: [SAtalk] Rules Du Jour v 1.07b
|
| On Thu, 2004-01-22 at 14:
On Thu, 2004-01-22 at 14:49, Smart,Dan wrote:
> Chris:
> Great job on the scripts. I have modified the munging on Tripwire (set name
> to TW) and BigEvil (comment out WXYZ). How do I add these custom munges to
> my_rules_du_jour?
Dan,
I'm going to suggest that you ignore the warning in my_rules
Chris:
Great job on the scripts. I have modified the munging on Tripwire (set name
to TW) and BigEvil (comment out WXYZ). How do I add these custom munges to
my_rules_du_jour?
tia
<>
| -Original Message-
| From: Chris Thielen [mailto:[EMAIL PROTECTED]
| Sent: Thursday, January 22,
Phil
Sent: Thursday, January 22, 2004 5:03 AM
To: 'Chris Thielen'; [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: RE: [SAtalk] Rules Du Jour v 1.07b
Some mistake here:
CF_URLS[4]="http://www.emtinc.net/includes/weeds.cf";;
Some mistake here:
CF_URLS[4]="http://www.emtinc.net/includes/weeds.cf";;
CF_FILES[4]="weeds.cf";
CF_NAMES[4]="Jennifer's Weeds Set (1)";
PARSE_NEW_VER_SCRIPTS[4]="${PERL} -ne 'print if
/^\s*#.*(vers?|version|rev|revision)[:\.\s]*[0-9]/i;' | sort | tail -1"
Yes I did mean spamd.
Thanks,
--Mike
From: Matt KettlerSent: Tue 1/13/2004 7:39 AMTo: Mike Carlson; [EMAIL PROTECTED]Subject: Re: [SAtalk] Rules Score
At 07:19 AM 1/13/04 -0600, Mike Carlson wrote:
>Do you have restart spamassassin if you change a score on a rule?
I assume you m
At 07:19 AM 1/13/04 -0600, Mike Carlson wrote:
Do you have restart spamassassin if you change a score on a rule?
I assume you mean spamd, not spamassassin, as spamassassin isn't a resident
thing that can be restarted.
If you change local.cf, you must restart spamd to get it to read it.
However u
Earlier, I wrote:
> > I came up with a set of rules which appear to catch the
> > new strain of spam with a meaningless jumble of words in
> > the body, while hopefully not catching any legitimate mail.
Rubin Bennett replied:
> I believe that the Backhair Ruleset will catch these
On Sat, 10 Jan 2004, Rich Wales <[EMAIL PROTECTED]> wrote:
> I came up with a set of rules which appear to catch the new strain
> of spam with a meaningless jumble of words in the body, [...]
> header__MPOP_SUBJ1Subject =~ /Re: [A-Z]+, \S+ \S+ \S+/
You may want to compare/contrast the
Robert Menschel <[EMAIL PROTECTED]> wrote:
> I don't find any indication anywhere on the Web that mPOP is
> used for anything but spam. If anyone can provide evidence that
> it can be used for ham on a valid webmail site, I'll lower the
> score.
There are a few seemingly genuine messages here:
h
Hello Rich,
Saturday, January 10, 2004, 10:27:47 PM, you wrote:
RW> I came up with a set of rules which appear to catch the new strain
RW> of spam with a meaningless jumble of words in the body, while hope-
RW> fully not catching any legitimate mail. See below; comments welcome,
RW> and (natural
I believe that the Backhair Ruleset will catch these as well; no sense
in duplicating work taht soneone else has already done!
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm
Rubin
On Sun, 2004-01-11 at 01:27, Rich Wales wrote:
> I came up with a set of rules which appear to catch t
On Sun, 2004-01-04 01:03:07, Jan-Pieter Cornet wrote:
> Much to my surprise, I found out that the current (2.60) SpamAssassin
> code doesn't allow matches against the entire body or against the entire
> rawbody (unless you make it an eval test). The regex matching is done on
> a line-by-line basis.
I'm getting a common response here which is to lean towards bayes
rather than score manipulation.
However, bayes takes so long to build up. Especially if grandma only
gets 2 or 3 spams a day. Given that SA refuses to use bayesian
filtering til after it has collected 200 spam samples, in my exam
On Mon, 2003-12-01 at 17:38, Arlo Gilbert wrote:
> Is there a faster way to get SA working? Because 90 days is a long time
> to ask somebody to wait.
You could train it with a publicly-available corpus of spam, but that
sort of defeats the purpose of the bayesian filter. It's highly
personaliz
My grandmother. She recieves only emails from family. So for example
if the standard spamassassin ruleset were implemented and somebody
sent her UBE about free porn but the message did not score enough
points to be "flagged", then the email would get through. This is
spamassassin doing it's job
<--- snip >
My Question/Concerns
Does anybody have any ideas about how this would affect the bayesian
learning system? If i suddenly changed my mind about liking porn one day
and decided to block all porn, would I need to clear out my bayesian
learning database so that it would begin t
My grandmother. She recieves only emails from family. So for example
if the standard spamassassin ruleset were implemented and somebody
sent her UBE about free porn but the message did not score enough
points to be "flagged", then the email would get through. This is
spamassassin doing it's job
At 02:41 PM 12/1/2003, Arlo Gilbert wrote:
The same goes for me for mortgages.. i dont have one and dont need one. so
anything about mortgages, home financing etc is definitely spam for me.
Ahh, but do you want to automatically declare any email which mentions such
things to be spam?
Do you have
> I'm working on integrating spamassassin into our own spam filtering
> mechanism. Currently, with a score of 5 or greater we modify the
> subject line to indicate the spammishness of the message... with a
> score of 10 or greater we delete the email automatically and do not
> deliver it to the use
TABLE and me
doing a some reading of the manual (that nearly always helps).
regards
Alan
-Original Message-
From: jennifer [mailto:[EMAIL PROTECTED]
Sent: 23 November 2003 23:47
To: 'Alan Munday'; [EMAIL PROTECTED]
Subject: RE: [SAtalk] Rules, rules and more rules
Hi Alan
TABLE and me
doing a some reading of the manual (that nearly always helps).
regards
Alan
-Original Message-
From: jennifer [mailto:[EMAIL PROTECTED]
Sent: 23 November 2003 23:47
To: 'Alan Munday'; [EMAIL PROTECTED]
Subject: RE: [SAtalk] Rules, rules and more rules
Hi Alan
Hi Alan
> -Original Message-
> From: [EMAIL PROTECTED]
[mailto:spamassassin-
> [EMAIL PROTECTED] On Behalf Of Alan Munday
> Sent: Sunday, November 23, 2003 6:03 PM
> To: [EMAIL PROTECTED]
> Subject: RE: [SAtalk] Rules, rules and more rules
>
> Thanks to all who re
Hello Alan,
Friday, November 21, 2003, 3:12:25 AM, you wrote:
AM> Having only recently installed SA I'd like to ask about the various
AM> rules files that abound.
AM> Is there a listing of the common rules and their target?
See http://www.exit0.us and subsequent links.
Bob Menschel
--
Thanks to all who responded to me with hints and suggestions.
I had seen all the web sites mentioned but had not completely understood how
they all fitted together. Maybe a topic for the FAQ?
I've tried adding a fair number of rules and, noting comments made, had the
notion of asking if it would
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello spamassassin,
Friday, November 21, 2003, 7:13:33 AM, you wrote:
s> Having only recently installed SA I'd like to ask about the various
s> rules files that abound.
s> Is there a listing of the common rules and their target?
In addition to Chr
Bret
Thanks for your response.
I've dropped those recommended onto my system. I'll see how they go.
regards
Alan
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Bret
Miller
Sent: 21 November 2003 20:54
To: [EMAIL PROTECTED]
Subject: RE: [SAt
> Having only recently installed SA I'd like to ask about the
> various rules files that abound.
>
> Is there a listing of the common rules and their target?
Well, Chris Santerre has a site that groups some of the common rules
together. It's under development and you'll find it at:
http://www.me
On Tue, 2003-08-19 at 09:19, Chris Santerre wrote:
> > -Original Message-
> > From: Alan Fullmer [mailto:[EMAIL PROTECTED]
> > Sent: Monday, August 18, 2003 10:46 PM
> > To: [EMAIL PROTECTED]
> > Cc: [EMAIL PROTECTED]
> > Subject: [SAtalk] Rules
> >
> >
> > Is there a good website / url s
> -Original Message-
> From: Alan Fullmer [mailto:[EMAIL PROTECTED]
> Sent: Monday, August 18, 2003 10:46 PM
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]
> Subject: [SAtalk] Rules
>
>
> Is there a good website / url someone could post that
> describes how to write
> rules for spam a
At 08:45 PM 8/18/03 -0600, Alan Fullmer wrote:
Is there a good website / url someone could post that describes how to write
rules for spam assassin?
I wrote a fairly comprehensive guide here:
http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt
-
Hello jvanasco,
Friday, July 25, 2003, 7:49:18 AM, you wrote:
jmc> I've been getting dozens of these, and they've got pretty clever
jmc> senders who don't seem to be doing things that other rules or bayes
jmc> catch.
jmc> anyone have some good custom rules they use?
No custom rules for it here.
n, is relished by the wisest men." - Willy
Wonka
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]
> Sent: Friday, July 25, 2003 2:19 PM
> To: Chris Santerre
> Cc: [EMAIL PROTECTED]
> Subject: Re: [RD] RE: [SAtalk] rules needed: iraq &q
est men." -
Willy
Wonka
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
Sent: Friday, July 25, 2003 12:40 PM
To: Chris Santerre
Cc: [EMAIL PROTECTED]
Subject: Re: [RD] RE: [SAtalk] rules needed: iraq "most
wanted" playing
cards
if it were only so easy..
i thi
eas.com/wwwroot/gorilla/sa_rules.htm
"A little nonsense now and then, is relished by the wisest men." - Willy
Wonka
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]
> Sent: Friday, July 25, 2003 12:40 PM
> To: Chris Santerre
> Cc: [EMAIL
if it were only so easy..
i think i might just give a couple points for "playing cards" in the
body. maybe that and 'support american soldiers'
the newest one reads :
Subject: Saddam's evil biological weapons -- his sons
Body: Big news yesterday. Saddam's two sons, Uday and Qusay
Huss
Something like this:
header MY_PLAYING_CARDS Subject =~ /pl(a|\@)ying.?c(a|\@)rds?/i
describe MY_PLAYING_CARDS Talks about playing cards in Subject
score MY_PLAYING_CARDS 1.0
Chris Santerre
System Admin and SA Custom Rules Emporium Keeper
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rule
Test, James wrote:
Using spamassassin 2.54 + red hat 8.0 + exim 4.20. I have made some custom rules, and sometimes incoming mail seems to totally bypass my custom rules. I had a piece of spam come in that did not seem to be analyzed by my local.cf file. I can then take that same mail and forwar
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Hello Jerry,
Friday, June 6, 2003, 6:59:39 PM, you wrote:
JB> I've come up with lots of custom rules as of late, ... Please give me
JB> comments as to whether you find them to be accurate/useful.
Running them against my personal corpus of 3k spam an
On Thu, Jan 23, 2003 at 09:56:14AM -0500, Debbie D wrote:
> header FROM_ARMY From =~ /army.mil/i
> describe FROM_ARMY From ARMY
Ok.
> which did not wuite do the trick as there are a bunch of sub-domains that
> the mail could be FROM.. so I changed it to:
doesn't matter, the above m
It looks like you're looking for SUBJ_FULL_OF_8BITS. See if these messages
are triggering that rule. I /dev/null anything that hits on that one.
| -Original Message-
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED]]On Behalf Of Harry
| Putnam
| Sent: Friday, November 01, 2002 6:12 A
Kevin Gagel wrote:
> Based on the following header info, is my rule built correctly?
>
> Received: from (127.0.0.1) by MAIL3041.flowgo.com (PowerMTA(TM)
> v1.5); Mon, 22 Jul 2002 17:19:56 -0700
> (envelope-from <[EMAIL PROTECTED]>)
>
> I want to make a rule that will tag it bassed on t
: Mailing List - Spam Assassin
> Subject: Re: [SAtalk] RULES File For rpm version
>
>
> /usr/share/spamassassin on my system... 10_misc.cf has the
> "score" entry...
>
>
> ___
>
> Don't miss th
> Jim> I installed the i386.rpm version of Spam Assassin and thanks to
the
> Jim> help from everybody, I got it up and running - question is,
where's
> Jim> the rules file so that I can alter the percentages and such?
>
> Dunno, but you can list the files in an RPM with
>
> rpm -ql
Jim> I installed the i386.rpm version of Spam Assassin and thanks to the
Jim> help from everybody, I got it up and running - question is, where's
Jim> the rules file so that I can alter the percentages and such?
Dunno, but you can list the files in an RPM with
rpm -ql rpmname
o
dman wrote:
d> On Fri, May 03, 2002 at 11:24:43AM +0100, Darren Coleman wrote:
d> | Yes, it does check for PGP signed messages, which is good.
d> |
d> | But digitally signed messages (like yours and mine), i.e those that
d> | require the person to buy a digital id, go through a verification
d> |
gt;
DC> > -Original Message-
DC> > From: dman [mailto:[EMAIL PROTECTED]]
DC> > Sent: 03 May 2002 01:53
DC> > To: Darren Coleman
DC> > Subject: Re: [SAtalk] Rules for digitally signed messages
DC> >
DC> > On Fri, May 03, 2002 at 01:20:31AM +0100, Darren
On Fri, May 03, 2002 at 11:24:43AM +0100, Darren Coleman wrote:
| Yes, it does check for PGP signed messages, which is good.
|
| But digitally signed messages (like yours and mine), i.e those that
| require the person to buy a digital id, go through a verification
| procedure etc, are not given a
possesses a digital id and uses it when
sending an email, that should surely be worth some kind of negative
value even if it isn't much.
Daz
> -Original Message-
> From: dman [mailto:[EMAIL PROTECTED]]
> Sent: 03 May 2002 01:53
> To: Darren Coleman
> Subject: Re: [SAtalk]
On Thursday 02 May 2002 05:20 pm, Darren Coleman wrote:
> I would've presumed that SpamAssassin would give a score (presumably
> negative) for MIME attachments, in particular digitally signed messages.
> I can't imagine many spammers going to the trouble of digitally signing
> email.. :)
As has b
Bart Schaefer wrote:
BS> So about all you could say from just this analysis is that rules that were
BS> never hit could possibly be deleted.
...except that there is probably network-geographic disparity in spam -- some
people receive different spam than others, and so just because you're not see
On Wed, 1 May 2002, Bart Schaefer wrote:
> On Wed, 1 May 2002, Daniel Rogers wrote:
>
> > I find this quite interesting, beucase it gives and example of how
> > ineffective some of the rules have become. (NIGERIAN_SCAM, for example)
>
> There are a couple of things to note about this analysis:
On Wed, 1 May 2002, Daniel Rogers wrote:
> I find this quite interesting, beucase it gives and example of how
> ineffective some of the rules have become. (NIGERIAN_SCAM, for example)
There are a couple of things to note about this analysis:
(1) It doesn't account for duplication. If you got
62 matches
Mail list logo
