RE: Mozilla Headers

2004-09-20 Thread Matthew.van.Eerde
David Brodbeck wrote: > [EMAIL PROTECTED] wrote: > >> MUA's creating headers for their own internal purposes is a >> dangerous idea. But many do it. This may be the tip of the >> iceberg here. > > Sure. Sending Outlook messages with flags, do-by dates, and "urgent" > status is an old trick. Al

Re: Mozilla Headers

2004-09-20 Thread David Brodbeck
[EMAIL PROTECTED] wrote: MUA's creating headers for their own internal purposes is a dangerous idea. But many do it. This may be the tip of the iceberg here. Sure. Sending Outlook messages with flags, do-by dates, and "urgent" status is an old trick. All those things are controlled by custo

Re: Mozilla Headers

2004-09-20 Thread Jamie Pratt
jdow wrote: From: "Kevin Peuhkurinen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: Sent: Monday, 2004 September, 20 11:20 Subject: Re: Mozilla Headers [EMAIL PROTECTED] wrote: David Brodbeck wrote: On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote Mozilla Mail and Thunderbird add

Re: 'body', 'uri', 'rawbody' rules ...

2004-09-20 Thread Matt Kettler
At 03:51 PM 9/20/2004, Shane Metler wrote: describeSKM_SPAM_LIST_B_236 SKM Rules bodySKM_SPAM_LIST_B_236 m/jgsgfta\.com/i score SKM_SPAM_LIST_B_236 50.0 Style note: the m modifier to regexes is pointless for body rules. All EOL's ar

'body', 'uri', 'rawbody' rules ...

2004-09-20 Thread Shane Metler
Hi there, Using SpamAssassin 2.64, I have found a few cases where the target domain of a custom rule can not be matched via any of these three rule types. The target of my rule is a plain text (non HREF) URL that is obfusticated in a way that seems to miss my rules. My rule: (I've have both rawb

Re: Mozilla Headers

2004-09-20 Thread jdow
From: "Kevin Peuhkurinen" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: Sent: Monday, 2004 September, 20 11:20 Subject: Re: Mozilla Headers > > [EMAIL PROTECTED] wrote: > > >David Brodbeck wrote: > > > > > >>On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote > >> > >> > >>>Mozilla Mai

Mozilla headers update

2004-09-20 Thread Kevin Peuhkurinen
Folks, I checked my last 20,000 spam emails and found that 250 of them had bogus "X-Mozilla-Status" headers. I have found no instances of these headers in ham, although I admit that I don't keep nearly as large a corpus of ham as I do spam. I have created a new bugzilla entry for this: http:/

Re: rule idea for catching 'zombie spam relays' and question of my logic

2004-09-20 Thread Bob Apthorpe
Hi, On Mon, 20 Sep 2004, Sherwood Botsford wrote: > > > In my logic, there is no valid reason that a remote > > > sender would connect directly to our SMTP server from > > > their dynamic/DSL/cable IP to send our customer's an > > > email ... I think ? Valid 'remote to local' emails > > > being

Re: Mozilla Headers

2004-09-20 Thread Kevin Peuhkurinen
[EMAIL PROTECTED] wrote: David Brodbeck wrote: On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 headers to all emails they recieve. I do not believe they are ever added to outgoing emails, even if you are forwarding

Re: Mozilla Headers

2004-09-20 Thread Kevin Peuhkurinen
[EMAIL PROTECTED] wrote: David Brodbeck wrote: On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 headers to all emails they recieve. I do not believe they are ever added to outgoing emails, even if you are forwarding

RE: Mozilla Headers

2004-09-20 Thread Matthew.van.Eerde
David Brodbeck wrote: > On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote >> Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 >> headers to all emails they recieve. I do not believe they are ever >> added to outgoing emails, even if you are forwarding an email that >> alrea

Re: bayes problem after Berkeley DB upgrade

2004-09-20 Thread Theo Van Dinter
On Mon, Sep 20, 2004 at 12:47:21PM -0400, Dan wrote: > I upgraded Berkeley DB from db3 to db4 recently (as well as upgrading > Perl, Postfix, installing Amavis, and a score of modules) and now > Spamassassin is giving an error about the bayes db's: > > My assumption is that the bayes db's need to

bayes problem after Berkeley DB upgrade

2004-09-20 Thread Dan
I upgraded Berkeley DB from db3 to db4 recently (as well as upgrading Perl, Postfix, installing Amavis, and a score of modules) and now Spamassassin is giving an error about the bayes db's: Cannot open bayes_path /root/.spamassassin/bayes R/O: Inappropriate ioctl for device My assumption is that

Re: rule idea for catching 'zombie spam relays' and question of my logic

2004-09-20 Thread Stewart Nelson
The school I work at is some 20 km from the nearest phone exchange. DSL, ADSL, Cable are all non-starters here. We connect through DirecPC oneway. So our outbound connection is thorugh Telus, our local phone company. They refuse to give out a static IP. Ok, so run your smtp through their s

add_header Level intermittent.

2004-09-20 Thread Sherwood Botsford
Ok, I'm confused: In local.cf I have the line: add_header all Level _STARS(+)_ _HITS_ And if I grep through my current mail spool, I have a block with this tag present, but of today's mail, it is present in 2 messages out of 30 or so. Also, I have rewrite_subject 1 report_safe 0 subject_ta

Re: Errors in procmail.log

2004-09-20 Thread Matt Kettler
At 11:34 AM 9/20/2004, [EMAIL PROTECTED] wrote: Hey all, posed this question a week ago, never got an answer, so Im trying again. Redhat and Sendmail and the procmail get this occasionally: mkdir .: Permission denied at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin.pm line 825 procmail: Progr

RE: SPF Fails on SA 3.0rc5 because of lack of HELO ?

2004-09-20 Thread Avi Shatz
> And since nothing is special about my own MS SMTPSVC (Win2k3 SMTP > Server), I believe the behavior of received.pm should be changed to > allow SA running on those machines to properly detect the EHLO > string, and thus allow SPF Detection to properly execute. So what *do* your mail headers loo

Re: rule idea for catching 'zombie spam relays' and question of my logic

2004-09-20 Thread Jack L. Stone
At 09:25 AM 9.20.2004 -0600, Sherwood Botsford wrote: > >> > In my logic, there is no valid reason that a remote >> > sender would connect directly to our SMTP server from >> > their dynamic/DSL/cable IP to send our customer's an >> > email ... I think ? Valid 'remote to local' emails >> > being s

Re: SPF Fails on SA 3.0rc5 because of lack of HELO ?

2004-09-20 Thread Kris Deugau
Avi Shatz wrote: > The only thing I wanted to prove with this is that line, that is > created by my local mail server (the last hop, and the most important > one for SPF), does indeed contains the EHLO string that isn't > detected correctly by SA 3.0rc5. OK... > And since nothing is special about

Errors in procmail.log

2004-09-20 Thread [EMAIL PROTECTED]
Hey all, posed this question a week ago, never got an answer, so Im trying again. Redhat and Sendmail and the procmail get this occasionally: mkdir .: Permission denied at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin.pm line 825 procmail: Program failure (70) of "/usr/bin/spamassassin" proc

Re: [sa-list] Re: rule idea for catching 'zombie spam relays' and question of my logic

2004-09-20 Thread Dan Mahoney, System Admin
On Mon, 20 Sep 2004, Sherwood Botsford wrote: In this case, you should get a "smart host" on some other mail server, and authenticate against that. You are still an endpoint, and should not be directly talking to mail servers. Only mail servers should talk to mail servers. -Dan In my logic,

Re: rule idea for catching 'zombie spam relays' and question of my logic

2004-09-20 Thread Sherwood Botsford
> > In my logic, there is no valid reason that a remote > > sender would connect directly to our SMTP server from > > their dynamic/DSL/cable IP to send our customer's an > > email ... I think ? Valid 'remote to local' emails > > being sent from these DSL/cable/dialup IP would > > normally be rel

Re: Mozilla Headers

2004-09-20 Thread Raymond Dijkxhoorn
Hi! Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 headers to all emails they recieve. I do not believe they are ever added to outgoing emails, even if you are forwarding an email that already has them. (And the little light goes on...) Is this why I've been receiving spam that's

Re: Mozilla Headers

2004-09-20 Thread David Brodbeck
On Mon, 20 Sep 2004 10:40:39 -0400, Kevin Peuhkurinen wrote > Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 > headers to all emails they recieve. I do not believe they are ever > added to outgoing emails, even if you are forwarding an email that > already has them. (And the li

Re: Mozilla Headers

2004-09-20 Thread Kevin Peuhkurinen
Mozilla Mail and Thunderbird add X-Mozilla-Status and Status2 headers to all emails they recieve. I do not believe they are ever added to outgoing emails, even if you are forwarding an email that already has them. David Hooton wrote: Hi All, Can anyone tell me if the following headers are ever

Re: Replacing Header Info?

2004-09-20 Thread Spam Admin
>>> For the sake of spam/virus elimination, I wouldn't say that there IS a "standard" in add-ons. Fair enough... I'm using Suse Linux server 8.1, Postfix, Amavis-d, SA 2.64, Razor, Rules_Du_Jour (most of them, but not all), SpamCop URI, and manual Bayes learning (via IMAP and a shared folder). Thi

Mozilla Headers

2004-09-20 Thread David Hooton
Hi All, Can anyone tell me if the following headers are ever legitimately created by a mail client? X-Mozilla-Status: 0001 X-Mozilla-Status2: I seem to be able to find them only in my spam corpus.. -- Regards, David Hooton

Re: Replacing Header Info?

2004-09-20 Thread Dan Mahoney, System Admin
On Mon, 20 Sep 2004, Spam Admin wrote: So, any clue where in my setup I'm missing the part where it over-writes any existing header info? I'm using Postfix, Amavis, and all the other standard add-ons... One minor point of contention here. For the sake of spam/virus elimination, I wouldn't say that

Replacing Header Info?

2004-09-20 Thread Spam Admin
I've noticed some spam getting through over the last few days; the only common thread is that it *appears* as if my header info is not replacing some that already exists in the email. To further clarify, the "X-Spam-Status:" and "X-Spam-Level:" are there, and even the subject line was edited with "

Re: Spammers adding SA Headers?

2004-09-20 Thread Matt Kettler
At 01:15 AM 9/20/2004 -0400, Eggleton, Michael wrote: My question is: Is it spamassassin that is seeing the other X-Spam-Status header and using it over again? or is it SA-Qmail-Scanner? It's not spamassassin.. try it yourself on the command line.. SA always clobbers the existing X-Spam-Status

Re: Unsubscribing

2004-09-20 Thread Matt Kettler
At 02:16 PM 9/20/2004 +0200, Andy wrote: You already had a look to the headers? Andy, that's doubtful. Julia's on an exchange box, and last I heard, Outlook hides list-* headers from users. Maybe they've fixed that since the List-* headers are an RFC standard way of handling lists, but that doesn

Re: Unsubscribing

2004-09-20 Thread Andy
You already had a look to the headers? "McWhirter,Julia" <[EMAIL PROTECTED]> might have typed: How do I get off this list Regards Julia McWhirter

Re: [sa-list] Unsubscribing

2004-09-20 Thread Dan Mahoney, System Admin
On Mon, 20 Sep 2004, McWhirter,Julia wrote: But this list is 100 percent confirmed opt-in! How do I get off this list Regards Julia McWhirter -- "Happy, Sad, Happy, Sad, Happy, Sad, Happy, Intruiged! I've never been so in touch with my emotions!" -AndrAIa as Hexadecimal, Reboot Episode 3.2.3 --

Unsubscribing

2004-09-20 Thread McWhirter,Julia
Title: Message How do I get off this list   Regards Julia McWhirter  

procmail related problem?

2004-09-20 Thread sb ch
Hello, all. I have used spamassassin(2.63 ) well for some months. But some problems occur often about procmail like below. * normal status ->works well. # mail -v root Subject: test test . Cc: root... Connecting to local... root... Sent * abnormal status ->some problem. # mail -v root Subject: t

Chinese translation help for anti-spam effort

2004-09-20 Thread Jeff Chan
We've gotten a couple documents form the Internet Society of China www.isc.org.cn relating to email delivery and I'd like to request some help in translating them: http://www.surbl.org/isc1.doc http://www.surbl.org/isc1.doc The documents are some proposed email delivery standards called "

Spammers adding SA Headers?

2004-09-20 Thread Eggleton, Michael
  I have been using the SA-Qmail-Scanner-1.23     I'm being spammed with a spam message that looks like it targets getting past the quarantine.  This is very frustrating.   This is the header information that it has before Spamassassin ever sees the message:   X-Spam-Checker-Version: SpamAssas

SA --revoke and KMail

2004-09-20 Thread Rob Blomquist
I have a number of mistakenly caught emails that I would like to revoke as spam. I use KMail with in maildir format. I am using SA version 2.63. I have tried running "spamassassin --revoke .Mail/Stuff/cur/*" which only seems to hang. I have also tried "spamassassin --revoke .Mail/Stuff/cur/1

Re: Negative #s

2004-09-20 Thread William Stearns
Good evening, Doug, On Sun, 19 Sep 2004, Doug Wolfgram wrote: > This has probably been covered here before, but I missed it. I have been > swamped in the past few weeks with spam that scores around -4.9. What is > this and how to I get rid of it??? Is there some parameter that says never

Re: Negative #s

2004-09-20 Thread Loren Wilton
-4.9 is probably something like BAYES_00. It sounds like you have bayes trained to recognize spam as ham. Loren

Negative #s

2004-09-20 Thread Doug Wolfgram
This has probably been covered here before, but I missed it. I have been swamped in the past few weeks with spam that scores around -4.9. What is this and how to I get rid of it??? Is there some parameter that says never go negative? These spammers are smart enough now to create negative scores

[SARE] Rule updates

2004-09-20 Thread Robert Menschel
Just a quick note that several rules files have been updated: Headers -- 70_sare_header*.cf, files 0, 1, 2, 3 -- a few additions, several score changes, a few old rules moved from files 0 and 1 to files 2 and 3. URI -- 70_sare_uri.cf -- minor improvement to one rule, migrated two rules from ratwa