SM wrote:
At 08:54 01-12-2004, John Hardin wrote:
However, this sounds like it might be useful in Spamassassin: attempt to
contact the sender on port 25, and add a little to the spamminess score
if the connection is refused or times out.
That was the first thought through my mind when I read the o
Thanks for the tip. However, that doesn't seem to work - still not seeing
the autolearn.
I'm taking this over to the amavisd-new list.
> -Original Message-
> From: Bill Landry [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, December 01, 2004 13:26
> To: users@spamassassin.apache.org
> Subje
On Wed, 2004-12-01 at 14:35, Chris Santerre wrote:
> We are seeing an increase in throw away domains being used to reroute
> to other domains that will NEVER show up directly in a spam. All in
> attempts to get passed SURBL.
I'm going to bring up this idea again, in a slightly different context
th
At 06:06 PM 12/1/2004, [EMAIL PROTECTED] wrote:
>I think Earthlink uses Brightmail. If that is so then Brightmail
>statistics are VERY bad. I doubt I had any false alarms - lost email.
>But it only got about 75% or less of the spam. I used it while on the
>road the last two weeks. I might comment t
On Tue, 30 Nov 2004 22:37:53 -0800, "jdow" <[EMAIL PROTECTED]> wrote:
>I think Earthlink uses Brightmail. If that is so then Brightmail
>statistics are VERY bad. I doubt I had any false alarms - lost email.
>But it only got about 75% or less of the spam. I used it while on the
>road the last two w
At 02:31 PM 12/1/2004, Johnson, S wrote:
I've got two rules next to each other in the config:
body REPLICA_WATCH /replicas of rolex/i
score REPLICA_WATCH 5
body SAVE_UP_TO /save up to/i
score SAVE_UP_TO2
When I have a message that I've been t
At 05:28 PM 12/1/2004, Jimmy Hayes wrote:
Hi I am running SpamAssassin version 2.63 with mimedefang v 1.438. my
question is lately I have been getting a lot of spam e-mails getting
thorugh To the users on the network.=20
And every night I run this command on cron sa-learn --spam -C
/etc/mail/spamas
On Wed, 01 Dec 2004 11:12:27 -0800, you wrote:
>Matias Lopez Bergero wrote:
>> I'm also running clamav with clamav-milter, and I would like to hit the
>> best performance, that's why I was asking for comments :)
The absolute top performance improvement that you can do to your mail
server is to g
Yeah this is a definite candidate for SURBL. This is the
Huntsville-consulting spam gang:
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL20528
353+ domains diretly linked. This is going to be the next trend. The final
destination of this pron spam was throatstuffers . com, but it used a throw
away
Hi I am running SpamAssassin version 2.63 with mimedefang v 1.438. my
question is lately I have been getting a lot of spam e-mails getting
thorugh To the users on the network.=20
And every night I run this command on cron sa-learn --spam -C
/etc/mail/spamassassin --showdots --mbox /var/mail/bad-ma
BAYES_00
Your Bayes filter thought there was a VERY strong indication that this
message was ham. I'd suggest the filter is in serious need of training
or else the message was extraordinarily well constructed.
{^_^}
- Original Message -
From: "Smart,Dan" <[EMAIL PROTECTED]>
> Attached i
Attached is the spam that got through. I changed the porn URL to not
offend. It's a little mangled as it was forwarded by the user via Outlook,
and tags got mangled by my Sanitizer.
I capture the headers of all files, and here is what they look like. The
bayes = 0 is what got this through.
<>
A few ways to look into this...
1. Check the amavisd.conf file (should be something
like /etc/amavisd.conf) for a line similar to this:
# Run the daemon in the specified chroot jail if
nonempty:$daemon_chroot_dir = $MYHOME; # (default is undef, meaning:
do not chroot)
2. Check for a /var
- Original Message -
From: "Kurt Buff" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, December 01, 2004 12:44 PM
Subject: autolearn header not showing - amavis or spamassassin?
> Another problem for me to solve
>
> SpamAssassin 3.0.1, amavisd-new 2.2.0
>
> Amongst others, the autolearn he
Thanks to all - now up and running just fine :)
Regards,
Martyn
Martyn Drake wrote on 01 December 2004 18:57:
> Hi,
>
> What's happened to the RulesDuJour site? Unfortunately not able to
> access it as it seems to have disapeared off the face of the Earth!
>
> http://www.exit0.us/ind
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
John Hardin wrote:
| On Wed, 2004-12-01 at 03:30, Paul L Daniels wrote:
|
|>An interesting idea was floated by my eyeballs recently for combatting
|>invalid email (especially since zombie machines are now rather
|>prevailant), what if you could fingerpr
Gosh… I’m not the one that set
this up. How do I know if this is the case? It looks like the local.cf only
exists in the /etc/mail/spamassassin directory.
From: Yackley, Matt
[mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 01, 2004
2:39 PM
To: users@spamassassin.apache
On Wed, Dec 01, 2004 at 02:25:08PM -0600, Brian Byers wrote:
> Not sure what happened, but I have version 1.18 of the script. I've been
> attempting to look for an update, but, as you mentioned, the site is
> broken.
>
> http://www.cbbyers.net/rules_du_jour.txt
The url that rules_du_jour checks
Another problem for me to solve
SpamAssassin 3.0.1, amavisd-new 2.2.0
Amongst others, the autolearn header is not showing up in any email I've
seen so far, although the bayes_* files are current and obviously being
utilised.
The following is all that shows
--snip--
X-Spam-Sta
Quick question, are you running amavisd in chroot
mode? If so make sure that your chroot location for /etc/mail/spamassassin
also has the updated files, then restart amavis.
-matt
From: Johnson, S
[mailto:[EMAIL PROTECTED] Sent: Wednesday, December 01,
2004 2:20 PMTo: Chris S
Not sure what happened, but I have version 1.18 of the script. I've been
attempting to look for an update, but, as you mentioned, the site is
broken.
http://www.cbbyers.net/rules_du_jour.txt
--
Brian Byers
[EMAIL PROTECTED]
On Wed, 1 Dec 2004, Martyn Drake wrote:
> Date: Wed, 1 Dec 2004 18:57
Yes, I restarted the whole server…
The configs are in the local.cf file.
From: Chris Santerre
[mailto:[EMAIL PROTECTED]
Sent: Wednesday, December 01, 2004
2:03 PM
To: Johnson, S;
users@spamassassin.apache.org
Subject: RE: Rules still not
hitting right
Yes it does
Hi John,
At 08:54 01-12-2004, John Hardin wrote:
Interesting idea. It sounds a little heavy to be doing for every inbound
message, though, and it assumes that you're letting fingerprinting
traffic out of your network - I, for example, block all NetBIOS and
similar ports at my boundary, so fingerpri
Yes it does
require spamd to be restarted. Having restarted it and it still isn't working
must be something else. Where exactly are these rules
located?
--Chris
-Original Message-From: Johnson, S
[mailto:[EMAIL PROTECTED]Sent: Wednesday, December 01, 2004
2:40 PMTo: Chris S
Does adding a rule require restarting?
From what I was reading, all you needed to do is run spammassassin –lint.
But I’m not 100% sure on that…
Anyway, I did reboot yesterday afternoon
just to be sure and it’s still missing the messages…
From: Chris Santerre
[mailto:[EMAIL
I believe you
have to restart Amavis?
--Chris
-Original Message-From: Johnson, S
[mailto:[EMAIL PROTECTED]Sent: Wednesday, December 01, 2004
2:31 PMTo: users@spamassassin.apache.orgSubject: Rules
still not hitting right
I'm now running Spam Assassin
3.1
I've
I’m now running Spam Assassin 3.1
I’ve got two rules next to each other in the config:
body REPLICA_WATCH /replicas of rolex/i
score REPLICA_WATCH 5
body SAVE_UP_TO /save up to/i
score SAVE_UP_TO 2
When I have a me
Matias Lopez Bergero wrote:
I'm also running clamav with clamav-milter, and I would like to hit the
best performance, that's why I was asking for comments :)
MIMEDefang will tie into both SpamAssassin and ClamAV, plus any of a
dozen other virus scanners, plus run its own tests. You can configure
Hi,
What's happened to the RulesDuJour site? Unfortunately not able to access
it as it seems to have disapeared off the face of the Earth!
http://www.exit0.us/index.php?pagename=RulesDuJour
redirects to beta.exit0.us and that doesn't exist as a host:
[EMAIL PROTECTED] [~]# host beta.exit0.us
H
Hello Robert,
Wednesday, December 1, 2004, 10:29:12 AM, you wrote:
JRF> Could the SARE team provide a guideline regarding the best SARE
JRF> and WIKI rules sets to work in an environment that supports the
JRF> following languages?
Unfortunately, the SARE team is heavily North American, and as su
>-Original Message-
>From: Robert Menschel [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, December 01, 2004 9:56 AM
>To: Johnson, Robert F; users@spamassassin.apache.org
>Subject: Re[2]: Japanese False Postives with Spam Assassin 3.01 and RH
WS
>3.0
>
>Hello Robert,
>
>Tuesday, November 30, 20
>-Original Message-
>From: Martin Hepworth [mailto:[EMAIL PROTECTED]
>Sent: Wednesday, December 01, 2004 4:39 AM
>To: Smart,Dan
>Cc: users@spamassassin.apache.org
>Subject: Re: Image Composition Analysis
>
>
>Dan
>
>I find the surbl.org URIRBL list provides very good protection against
>
Hello Robert,
Tuesday, November 30, 2004, 9:25:52 PM, Daniel wrote:
DQ> The problem doesn't sound like it's SpamAssassin despite the subject
DQ> line of this email, rather it's third-party rulesets.
I agree.
DQ> "Johnson, Robert F" <[EMAIL PROTECTED]> writes:
>> Based on spt checking of a coup
On Wed, Dec 01, 2004 at 11:06:12AM -0600, Smart,Dan wrote:
> I believe a SPAMD problem has be pinpointed with SMP kernels using
> hyperthreading. Look through the bug list.
>
Huh? I disagree. I push 4-5 msgs a sec through my hyperthreaded
machine without a problem. Please do not spread such FU
On Wed, 2004-12-01 at 09:05, Jason Philbrook wrote:
> On Wed, Dec 01, 2004 at 08:54:00AM -0800, John Hardin wrote:
> > However, this sounds like it might be useful in Spamassassin: attempt to
> > contact the sender on port 25, and add a little to the spamminess score
> > if the connection is refuse
I believe a SPAMD problem has be pinpointed with SMP kernels using
hyperthreading. Look through the bug list.
<>
> -Original Message-
> From: Jason Philbrook [mailto:[EMAIL PROTECTED]
> Sent: Wednesday, December 01, 2004 10:59 AM
> To: Dimitry Peisakhov
> Cc: 'users@spamassassi
On Wed, Dec 01, 2004 at 08:54:00AM -0800, John Hardin wrote:
> On Wed, 2004-12-01 at 03:30, Paul L Daniels wrote:
> > An interesting idea was floated by my eyeballs recently for combatting
> > invalid email (especially since zombie machines are now rather
> > prevailant), what if you could fingerpr
While the queue is building up, run a top and see what's holding things
up. dstat is another handy program for this sort of work.
Since it's a dual processor, I'd suggest building a 2.6 series kernel
for it, since that handles smp much nicer.
On Wed, Dec 01, 2004 at 05:14:02PM +1100, Dimitry Pe
On Wed, 2004-12-01 at 03:30, Paul L Daniels wrote:
> An interesting idea was floated by my eyeballs recently for combatting
> invalid email (especially since zombie machines are now rather
> prevailant), what if you could fingerprint the sending server and
> (say) deny all Win XP/95/98 machines fro
On Wednesday, December 1, 2004, 8:17:14 AM, Ronan Ronan wrote:
> how do i check whether SA is using
> the locally stored file or whether is still querying the surbl.org DNS?
> Is there an easy way if your not a bind / DNS guru?
A dig may tell what name server it thinks it's using.
Jeff C.
--
Je
Martin Hepworth wrote:
Ronan wrote:
Ok well I hounded or DNS guys to finally put multi.surbls.org into the
dns(as a master), watched him HUP named and then
should i notice a difference??
im still getting 10+ seconds scantime on some messages..
how do i tell if its working?
well granted i sh
Matt Kettler wrote:
At 01:34 PM 11/30/2004 -0300, you wrote:
I'm running SA with sendmail using milter-spamc to connect them.
It's working ok, but I would like to know about your experiences using
SA and milter, and which one you think is the best to use. I have not
seeing many people trough the
Ronan wrote:
Ok well I hounded or DNS guys to finally put multi.surbls.org into the
dns(as a master), watched him HUP named and then
should i notice a difference??
im still getting 10+ seconds scantime on some messages..
how do i tell if its working?
message size issues???
if you can trap on
Lito A. Lampitoc wrote:
> I'm having problem unsubscribing to this list, I send e-mail to
> [EMAIL PROTECTED] but it
> says
"this list" is users@spamassassin.apache.org not
[EMAIL PROTECTED] So I think you just have the wrong
list. Try again using the users list.
> I'm sure that this the e-mai
Rick Beebe wrote:
Ronan wrote:
Hey list,
I am in the quite sureal situation of being given a blank
cheque by my boss to buy 2 new servers for SA. They were so
impressed with the upgrade to v3 + SURIBLS et al that when i said
that our current setup was hitting load max they found some cas
Ronan wrote:
Hey list,
I am in the quite sureal situation of being given a blank
cheque by my boss to buy 2 new servers for SA. They were so impressed
with the upgrade to v3 + SURIBLS et al that when i said that our
current setup was hitting load max they found some cash for me... :D
We
At 01:34 PM 11/30/2004 -0300, you wrote:
I'm running SA with sendmail using milter-spamc to connect them.
It's working ok, but I would like to know about your experiences using SA
and milter, and which one you think is the best to use. I have not seeing
many people trough the list using milter-sp
I'm having problem unsubscribing to this list, I send e-mail to
[EMAIL PROTECTED] but it
says
[EMAIL PROTECTED]
was not on the announce mailing list when I received
your request and is not a subscriber of this list.
I'm sure that this the e-mail address that I used.
Anyone?
news <[EMAIL PROTECTED]> wrote on 11/30/2004
01:34:59 PM:
> Hello,
>
> I'm running SA with sendmail using milter-spamc to connect them.
>
> It's working ok, but I would like to know about your experiences using
> SA and milter, and which one you think is the best to use. I have
not
> seeing m
Thanks everyone for your useful and informative input. We are currently
re-evaluating our email services and your feedback has been a great
help.
Richard
---
This email from dns has been validated by dnsMSS Managed Email Security and is
free from
Dan
I find the surbl.org URIRBL list provides very good protection against
this kind of message, along with othe rules in www.rulesemporium.com I
don't recall seeing one slip through for ages..
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Smart,Dan wrote
Kurt
yeah ran into a similar problem with --lint option...not very nice error
messages. Must check bug list one this one...
I'd double check all the syntax for the options against the docs...
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Kurt Buff wrote:
A
I'm completely new to Perl, but that didn't
put me off from following the guide on this page: http://www.spamblogging.com/archives/69.html
Now I am assuming this works with Exchange 5.5 on
Windows 2000? I've followed this page through, but when I run Install_ESA_Sink.bat
I get nothi
On Tuesday 30 November 2004 01:27 pm, Smart,Dan wrote:
> Catching image only E-mail with pornographic images is really difficult.
> My users are offended when they get one, and wonder how I could not catch
> it. Explaining that the document was text, filled with bayes poison, and
> the one porn
On Tuesday 30 November 2004 10:57 am, Jerry wrote:
> >>I have some AWL's listed in my local.cf.
> >
> > You do? That's not likely true..
>
> In my local.cf I have the line"whitelist_from [EMAIL PROTECTED]"
>
> Does this not keep all messages coming from our domain clear from being
> marked as s
Could your MTA be the bottleneck?
On 1/12/04 5:14 PM, "Dimitry Peisakhov" <[EMAIL PROTECTED]>
wrote:
> Hi Guys,
>
> I wrote to the list a few weeks ago asking for advice on spamd
> performance. I got some, and have implemented it, but dont know if i'm
> seeing a performance improvement. The p
I wonder what kind of a load it is on the filtering machine.
{^_-}
- Original Message -
From: "Smart,Dan" <[EMAIL PROTECTED]>
> Messagelabs made a big deal of their option of using First 4 Internet's
> Image Composition Analysis tool to detect pornographic images. Is anyone
in
> the ope
Daniel Quinlan wrote:
"Johnson, Robert F" <[EMAIL PROTECTED]> writes:
Based on spt checking of a couple of dozen examples, I didn't see any
significant pattern of out of the box rules being involved, mostly SARE
or WIKI rules. The most heavily implicated were the following:
(MANGLED and SARE_SUB_
I think Earthlink uses Brightmail. If that is so then Brightmail
statistics are VERY bad. I doubt I had any false alarms - lost email.
But it only got about 75% or less of the spam. I used it while on the
road the last two weeks. I might comment that I was very unimpressed.
{^_^}
- Original Me
Hi Guys,
I wrote to the list a few weeks ago asking for advice on spamd
performance. I got some, and have implemented it, but dont know if i'm
seeing a performance improvement. The performance i'm getting is far from
other people are reporting, it seems.
I'm running spamassassin 3.0.1 wit
"Johnson, Robert F" <[EMAIL PROTECTED]> writes:
> Based on spt checking of a couple of dozen examples, I didn't see any
> significant pattern of out of the box rules being involved, mostly SARE
> or WIKI rules. The most heavily implicated were the following:
> (MANGLED and SARE_SUB_CASH_CHAR were
>-Original Message-
>From: alan premselaar [mailto:[EMAIL PROTECTED]
>Sent: Tuesday, November 30, 2004 5:55 PM
>To: Johnson, Robert F
>Cc: users@spamassassin.apache.org
>Subject: Re: Japanese False Postives with Spam Assassin 3.01 and RH WS
3.0
>
>Johnson, Robert F wrote:
>> Hi,
>>
>> I h
Johnson, Robert F wrote:
Hi,
I have been having a high occurrence of Japanese false positives since
upgrading from Spam Assassin 2.64 on RedHat 7.3 with MimeDefang 2.31 to
Spam Assassin 3.01 on RedHat Workstation 3.0 installed site wide via
MimeDefang 2.44. I am wondering if this is due to the pro
Hi,
I have been having a high occurrence of Japanese false positives since
upgrading from Spam Assassin 2.64 on RedHat 7.3 with MimeDefang 2.31 to
Spam Assassin 3.01 on RedHat Workstation 3.0 installed site wide via
MimeDefang 2.44. I am wondering if this is due to the problem with Red
Hat 9.0 Un
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
mine were all discussions of spam :( doh! I'll have to remember --
*never* mark spam discussions as ham, even if you can't spot a spamsign.
- --j.
Theo Van Dinter writes:
> On Wed, Nov 24, 2004 at 01:19:49AM -0500, Matt Kettler wrote:
> > Quite f
At 07:44 PM 11/30/2004, Daniel Quinlan wrote:
Carlos Perez wrote:
>> Feature request to SA developers: turn off default SC reporting in
the next
>> release. No need to consume bandwidth as the generic reporting address is
>> not used.
I regularly talk to Julian about the reporting and it *is* b
Carlos Perez wrote:
>> Feature request to SA developers: turn off default SC reporting in the next
>> release. No need to consume bandwidth as the generic reporting address is
>> not used.
I regularly talk to Julian about the reporting and it *is* being used.
It just took Julian and the SpamCop
At 07:15 PM 11/30/2004, Smart,Dan wrote:
So Razor differs from DCC in that respect.
Razor and DCC differ quite a bit when you get into the details.
Particularly now that razor has the e8 algorithm, which is more like SURBL
than it is like DCC.
I gave up on Razor long ago due to delays due to sl
So Razor differs from DCC in that respect.
I gave up on Razor long ago due to delays due to slow Razor response, and
repeated Razor outages. Is it more reliable today?
<>
> -Original Message-
> From: Matt Kettler [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, November 30, 2004 5:12
69 matches
Mail list logo
