RE: Blacklists entries not getting blocked

2005-04-28 Thread Antonio DeLaCruz
I actually don't know if I'm using the * in the headers. How do I check that? Thanks, Antonio DeLaCruz Quoting martin smith <[EMAIL PROTECTED]>: M>-Original Message- M>From: Antonio DeLaCruz [mailto:[EMAIL PROTECTED] M>Sent: 28 April 2005 23:12 M>To: Pettit, Paul M>Cc: users@spamassassin.a

RE: Blacklists entries not getting blocked

2005-04-28 Thread martin smith
M>-Original Message- M>From: Antonio DeLaCruz [mailto:[EMAIL PROTECTED] M>Sent: 28 April 2005 23:12 M>To: Pettit, Paul M>Cc: users@spamassassin.apache.org M>Subject: RE: Blacklists entries not getting blocked M> M>Attached is a file that contains the header information and M>the preview o

Re: OT?: If you need proof that spammers use the same resources as us...

2005-04-28 Thread Richard Ozer
Obviously from "a man with wealth and taste"... - Original Message - From: "Evan Platt" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, April 28, 2005 7:38 AM Subject: Re: OT?: If you need proof that spammers use the same resources as us... At 07:32 AM 4/28/2005, you wrote:

RE: Blacklists entries not getting blocked

2005-04-28 Thread Antonio DeLaCruz
Attached is a file that contains the header information and the preview of the message as spamassassin modified it. From the body of the e-mail, you can clearly see that it is looking at my blacklist, it just isn't doing anything with it. Well, after ramming my head into the wall to knock some se

Re: Getting 3.0.3 to scan the emails

2005-04-28 Thread Mike Chambers
On Thu, 2005-04-28 at 17:58 -0400, Matt Kettler wrote: > Ok, is spamd running? Yep.. root 17321 0.4 5.9 26972 22800 ?Ss 16:50 0:02 /usr/bin/spamd -d -c -m5 -H root 17323 0.0 5.9 26972 22800 ?S16:50 0:00 spamd child root 17324 0.0 5.9 26972 22800 ?

Re: Getting 3.0.3 to scan the emails

2005-04-28 Thread Matt Kettler
Mike Chambers wrote: >On Thu, 2005-04-28 at 17:35 -0400, Matt Kettler wrote: > > > >>1) Is the mail being delivered locally, or relayed to another server? >> >> > >Locally to my email server, then pop3'd to my client. > > > >>2) What things have you tried in /etc/procmailrc? >> >> > >B

Re: Getting 3.0.3 to scan the emails

2005-04-28 Thread Mike Chambers
On Thu, 2005-04-28 at 17:35 -0400, Matt Kettler wrote: > 1) Is the mail being delivered locally, or relayed to another server? Locally to my email server, then pop3'd to my client. > 2) What things have you tried in /etc/procmailrc? Below is what worked before I reinstalled.. DROPPRIVS=yes :0

Re: Getting 3.0.3 to scan the emails

2005-04-28 Thread Matt Kettler
Mike Chambers wrote: >I reinstalled my server about a week or two ago, and for the life of me >can't get spamassassin to check my emails (or if they are, it isn't >being processed as Spam). > >I have the following version installed (running FC4 Test 2 currently, >but previously installed this was

Getting 3.0.3 to scan the emails

2005-04-28 Thread Mike Chambers
I reinstalled my server about a week or two ago, and for the life of me can't get spamassassin to check my emails (or if they are, it isn't being processed as Spam). I have the following version installed (running FC4 Test 2 currently, but previously installed this was all working, just think I'm

solved (Re: bogusmx.rfc-ignorant.org)

2005-04-28 Thread wolfgang
In an older episode (Wednesday 27 April 2005 01:29), wolfgang wrote: > I noticed that DNS_FROM_RFC_BOGUSMX appears not to be working with SA 3.0.2 my mistake, it is working. regards, wolfgang

Re: OT?: If you need proof that spammers use the same resources as us...

2005-04-28 Thread Matt Kettler
Evan Platt wrote: > At 07:32 AM 4/28/2005, you wrote: > >> Notably one which catches a common "allow me to >> introduce myself" style opening. >> It was not particularly clever, simply searching for the 2-word phrase >> "introduce myself", but lo and behold this week I get: >> >> "allow me to intr

Re: OT?: If you need proof that spammers use the same resources as us...

2005-04-28 Thread Evan Platt
At 07:32 AM 4/28/2005, you wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Call me paranoid, but a few weeks back I posted a couple of rules on this list and to the exit0 wiki which were designed to catch a common phrase seen in many 419 spams. Notably one which catches a common "allow me to i

Re: OCR and SA

2005-04-28 Thread Matt Kettler
Johnson, S wrote: > Has anyone attempted to write an OCR filter (optical character > recognition) for jpg or gif files that contain spam words? > Not that I'm aware of, but it's been mentioned MANY times. Really I think it largely boils down to being more CPU load than it's worth. Even the best

Re: Autolearn with exchange or groupwise

2005-04-28 Thread Matt Kettler
Johnson, S wrote: > I’m working on getting things optimized fully in our filter. I think > the spammers have been working over time lately. > > Once the message has left the linux spamassassin and forwarded onto a > mail server, say exchange or groupwise. > Many have made suggestions about Exchang

RE: Autolearn with exchange or groupwise

2005-04-28 Thread Matthew.van.Eerde
> From: Johnson, S > Once the message has left the linux spamassassin and forwarded onto a > mail server, say exchange or groupwise. How can I save the message > so that SA could autolearn the message? The headers and such are not > saved if I copy and paste the mail into a text file. I also don

RE: Autolearn with exchange or groupwise

2005-04-28 Thread Kang, Joseph S.
Title: Message I've done it via a pair of public folders under MS Exchange (FPs and FNs).  Then I use a perl script that can access those folders via IMAP from the Linux box.  If you look on the SA wiki, I think there is a link to a script.  I have it set up to run automatically every few ho

OCR and SA

2005-04-28 Thread Johnson, S
Has anyone attempted to write an OCR filter (optical character recognition) for jpg or gif files that contain spam words? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Confidentiality Notice If the information in this electronic communication relates to an individual pupil, it is a confidential

Autolearn with exchange or groupwise

2005-04-28 Thread Johnson, S
I’m working on getting things optimized fully in our filter.  I think the spammers have been working over time lately.   Once the message has left the linux spamassassin and forwarded onto a mail server, say exchange or groupwise.  How can I save the message so that SA could autolearn the

RE: Custom rules not hitting

2005-04-28 Thread Johnson, S
Yes, I am running spamd. The process I use is: modify rule in .cf file spamassassin --lint -D service spamassassin restart (to restart daemon) Thanks for the troubleshooting tip. This is JUST what I needed. However, I am confused as the test did hit it. =/ Thanks much. -Original Messag

Re: Custom rules not hitting

2005-04-28 Thread Matt Kettler
Johnson, S wrote: > Hello, > > I’m on SA version 3.0.2 > > Even to test, I set the score to 10 and sent a message with just > “penis size” in it and it was completely missed. > > All of the default rules are working fine. > > Can anyone see any issues with that rule or point me in a direction of >

RE: Custom rules not hitting

2005-04-28 Thread Bret Miller
Did you restart spamd or whatever is running spamassassin for your mta?   Are you sure the MTA is picking up its local.cf from the same folder in which you created your rule files? From: Johnson, S [mailto:[EMAIL PROTECTED] Sent: Thursday, April 28, 2005 9:45 AMTo: users@spamassassin.apache.or

Custom rules not hitting

2005-04-28 Thread Johnson, S
Hello,   I’m on SA version 3.0.2    I created a fairly extensive set of rules to hit the type of spam we’re seeing.  I prefixed the rules with a ZXC_, ZXM_ , or ZXS_ to be able to search in the maillog for the occurrence of the rules quickly.     When I run spamassassin –lint –D I see

RE: If you need proof that spammers use the same resources as us ...

2005-04-28 Thread Chris Santerre
>-Original Message- >From: Randal, Phil [mailto:[EMAIL PROTECTED] >Sent: Thursday, April 28, 2005 11:27 AM >To: users@spamassassin.apache.org >Subject: RE: If you need proof that spammers use the same resources as >us ... > > >Jim Maul wrote: > >> Chris Santerre wrote: > >>> Hi Mr. Spammy

RE: If you need proof that spammers use the same resources as us ...

2005-04-28 Thread Randal, Phil
Jim Maul wrote: > Chris Santerre wrote: >> Hi Mr. Spammy! >> >> --Chris (I'm Al Pachino!) >> >> > > Ahem, its Pacino Mr. Santerre ;) > > -Jim He spelt it like that to get past the "Pacino" spam filters ;-) Phil Phil Randal Network Engineer Herefordshire Council Hereford, UK

Re: If you need proof that spammers use the same resources as us ...

2005-04-28 Thread Jim Maul
Chris Santerre wrote: -Original Message- From: Craig McLean [mailto:[EMAIL PROTECTED] Sent: Thursday, April 28, 2005 10:33 AM To: users@spamassassin.apache.org Subject: OT?: If you need proof that spammers use the same resources as us... -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Call me

RE: add_header

2005-04-28 Thread Geoff Manning
They are both called in similar fashion: Headers Work Server: SPAMDOPTIONS="-d -c -m20 -H" Headers Don't Work Server: SPAMDOPTIONS="-d -s local5 -c -m20 -H" What is happening is that I get headers in SPAM emails from both servers. For HAM emails, I am only getting it in the header from on

RE: If you need proof that spammers use the same resources as us ...

2005-04-28 Thread Chris Santerre
>-Original Message- >From: Craig McLean [mailto:[EMAIL PROTECTED] >Sent: Thursday, April 28, 2005 10:33 AM >To: users@spamassassin.apache.org >Subject: OT?: If you need proof that spammers use the same resources as >us... > > >-BEGIN PGP SIGNED MESSAGE- >Hash: SHA1 > >Call me para

OT?: If you need proof that spammers use the same resources as us...

2005-04-28 Thread Craig McLean
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Call me paranoid, but a few weeks back I posted a couple of rules on this list and to the exit0 wiki which were designed to catch a common phrase seen in many 419 spams. Notably one which catches a common "allow me to introduce myself" style opening. I

Re: SA against RazorGate

2005-04-28 Thread Larry Rosenman
On Thursday 28 April 2005 09:10 am, Nestor Burma wrote: > Hello, > > We are currently looking RazorGate (Mirapoint) > appliances, for their anti-spam function. > Has anyone of you any feedback on those boxes, > compared to SA ? You can point us to links on the net, > of course. I eval'ed one at $Pr

SA against RazorGate

2005-04-28 Thread Nestor Burma
Hello, We are currently looking RazorGate (Mirapoint) appliances, for their anti-spam function. Has anyone of you any feedback on those boxes, compared to SA ? You can point us to links on the net, of course. Sincerely, NB

Re: Ignoring future date in syslog

2005-04-28 Thread Tremaine
Probably just time to rotate your logs. It's seeing December in your log which is forward (or future) from the current date. Cheers, Tremaine On 4/27/05, John Fleming <[EMAIL PROTECTED]> wrote: > Would someone please help me understand the problem indicated by the > following: > > WARNING: ign

Re: add_header

2005-04-28 Thread Matt Kettler
At 08:48 AM 4/28/2005, Geoff Manning wrote: The local.cf file is the same on both. There are no user_prefs files getting in the way that are altering the behavior of the add_header (that I can see). Where else should I look? How is spamassassin called? Is it the same on both, or does the one that's

routing spamd clusters net tests

2005-04-28 Thread Ronan McGlue
here is a thought for which i hope there is a solution. I have a small (1 user - me) test smtp relay with SA3.02 et all running, through which all mail addressed to me from our hubs (main in/out for uni) is routed which then scans etc and then routes on to our staffmail imap server. I have this

add_header

2005-04-28 Thread Geoff Manning
I have gone ahead and made the change I asked about yesterday and it works perfectly (on one machine only!). We have two mail servers scanning the mail before passing it onto exchange and one of them is adding the headers but the other isn't. I've checked everything I can think of: SpamAssassin v

Re: Simply don't run spam for Mailing Liste

2005-04-28 Thread Chris Lear
* arnaud wrote (27/04/2005 23:06): > Kris Deugau wrote: > [...] >> In my case, for instance, SA is called from procmail just before the >> message is written to a mailbox. In my .procmailrc file, I have a >> number of procmail recipes that look something like this: >> >> # SATalk >> :0: >> * ^Li

Re[2]: Need help interpretting score

2005-04-28 Thread Robert Menschel
Hello Joe, Tuesday, April 26, 2005, 8:31:43 AM, you wrote: JK> On another server or two I have disabled the auto white-list. Is JK> this acceptable practice? Now that I am into this I recall seeing JK> this issue before and thus decided to disable it. Comments on this JK> practice? My personal p

Re: --Lint parse error with always_add_headers

2005-04-28 Thread Robert Menschel
Hello Geoff, Wednesday, April 27, 2005, 6:34:32 AM, you wrote: GM> When I run spamassassin --lint I receive a parse error as shown GM> belowhow do I fix it? It looks like it is the right syntax. GM> # spamassassin --lint GM> config: SpamAssassin failed to parse line, skipping: always_add_he

Re: Site-wide training with same message, different recipients and different classification

2005-04-28 Thread Robert Menschel
Hello ks, Wednesday, April 27, 2005, 3:50:04 AM, you wrote: > we're evaluating SpamAssassin 3.02 on a mail gateway on Linux. The > mailboxes are not on this gateway but on a Lotus Notes Server to > where the mail is forwarded. Training is done via copying mails into > a different Mailfolder, whic