Re: Still need to work on Mail SpamAssassin 3.1.0

2005-07-07 Thread The Doctor
On Tue, Jul 05, 2005 at 09:01:25PM -0600, The Doctor wrote: > On Tue, Jul 05, 2005 at 10:23:45PM -0400, Matt Kettler wrote: > > At 08:41 PM 7/5/2005, The Doctor wrote: > > >Spam Assassin 3.0.4 works with milter-spamc 0.25, smf-spamd and MailScanner > > >Current. > > > > > >Spam Assassin 3.1.0 only

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Steven Dickenson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 7, 2005, at 10:59 PM, Loren Wilton wrote: > Procmail will act as the pop3 server Not quite. My belief (and Joanne set this up, so she has the actual details) is that Fetchmail is feeding procmail, possibly going through Sendmail to do

Re: SA training

2005-07-07 Thread Steven Dickenson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Jul 7, 2005, at 9:30 PM, Jean-Paul Natola wrote: Here's what I did, Installed Freebsd, then installed exim, then clamav and finally SA, All were done via passive ftp The default Exim configuration files do not do any SA scanning, so you must

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
We have 9 site and around 20 users who need e-mail on average per site. What I really want in the end is a SpamAssassin, ClamAV, setup. I want to make it so that the users can either grab their filtered mail from a linux box inside each site that has already pulled their mail from the ISP's mail se

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Loren Wilton
> All we hope for is that a system is in place by the time half of > LaPalma slides into the ocean. If the predictions are correct, our > gulf coast/florida real estate will need all new maps. The > Indonesian tsunami was a ripple in the bathtub in comparison > according to some doomsayers.

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Loren Wilton
> Procmail will act as the pop3 server   Not quite.  My belief (and Joanne set this up, so she has the actual details) is that Fetchmail is feeding procmail, possibly going through Sendmail to do this. Procmail has a 2-line recipe that calls SA as part of the delivery process for local delie

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Gene Heskett
On Thursday 07 July 2005 22:16, Daryl C. W. O'Shea wrote: >Gene Heskett wrote: >> On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: >>>Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. >The p

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread jdow
From: "Gene Heskett" <[EMAIL PROTECTED]> > On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: > >Justin Mason wrote: > >> however, it'd be nice to get a copy with full headers so we could > >> think about whitelisting it ;) > >> > >> - --j. > >> > >>>The problem arises if the open source fi

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread jdow
No, it doesn't. We go fetchmail to procmail to mailbox and local POP3 server. AV filtering is done on the local machines via a standard AV tool that is maintained up to date automatically. I don't trust tools like ClamAV to be as up to the minute as the email scanners. (Besides, SA filters here as

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Daryl C. W. O'Shea
Gene Heskett wrote: On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed straight out of the box; the

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
Loren, So with doing it this way and setting up user accounts for each e-mail account on the linux box and using Fetchmail which is installed on the Linux box to grab each users mail from the ISP, Procmail will act as the pop3 server to allow these users to grab their mail internally from the linu

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Gene Heskett
On Thursday 07 July 2005 21:15, Daryl C. W. O'Shea wrote: >Justin Mason wrote: >> however, it'd be nice to get a copy with full headers so we could >> think about whitelisting it ;) >> >> - --j. >> >>>The problem arises if the open source filter is installed straight >>> out of the box; the message

RE: SA training

2005-07-07 Thread Jean-Paul Natola
I wish I can Answer That with 100% certainty, Here's what I did, Installed Freebsd, then installed exim, then clamav and finally SA, All were done via passive ftp -Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 8:33 PM To: users@spamassas

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Daryl C. W. O'Shea
Justin Mason wrote: however, it'd be nice to get a copy with full headers so we could think about whitelisting it ;) - --j. The problem arises if the open source filter is installed straight out of the box; the messages (usually written in upper case) are not considered spam. According to

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 07:24:02PM -0500, Kenneth S. wrote: > Skip DNS tests (Default option = 0) > ->Skip Razor, Pyzor and DCC checks and the above tests (option = 1) > ->Skip all checks (option = 2) > > How does that look? Also what would the option be called? This really belongs on dev,

Re: Tsunami warning hits the spam barrier

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 yeah, I saw that -- the message scores 3.7 according to the report, well under 5. It's pretty reckless to lower the threshold enough to cause that to hit as spam. however, it'd be nice to get a copy with full headers so we could think about whitelis

RE: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread lists
Hello, Man, I can't wait till these kinds of features get implemented. Another similar idea would be to stop SA scanning if the score gets to a certain number. On heavily hit mail servers, these kinds of features would help with CPU usage. As it stands now, SA goes through all of the scannning

Tsunami warning hits the spam barrier

2005-07-07 Thread Dan Kohn
http://www.computerworld.com.au/index.php/id;1807582661;fp;16;fpid;0 Tsunami warning hits the spam barrier Michael Crawford 07/07/2005 07:29:27 The first live run of the Indian Ocean Tsunami warning system earlier this month turned out to be a bit of a disaster. Not a natural disaster, but

Re: SA training

2005-07-07 Thread Loren Wilton
> at the header like this one for example which I don't know WHY it says > "possible spam" as it scored a ZERO > > X-Spam-Score: 0.0 (/) Is that directly out of SA? Or do you have sometrhing else like qmail or some such in the path? If that is straight out of SA, something looks broken as all h

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Loren Wilton
I don't immediately see that anyone more knowledgable replied, so I'll toss out some possibilities/confirmations:   Yes, you need something like a Linux box.  It will run SA, and will retrieve mail using pop3 from your current provider.  Pop3proxy is one possibility.  Another possibility is F

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kenneth S.
Well this works out. I started putting something together after Theo's response. I already have it working and skipping the checks based on ALL_TRUSTED but did not add any debug code. Since it looks like this is something that you want in SA I'll add debug code and put a patch together. I w

RE: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Sander Holthaus - Orange XL
I think that is an excellent idea! I call spamc from maildrop, so I can filter out some message's that do not need to be processed by SpamAssassin. But it would be much easier for most installations if such behaviour can be done from within SpamAssassin. You might want to add even an extra option

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kelson
Theo Van Dinter wrote: On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Not without modifying code. You could probably create a set of meta-rules to counteract the scor

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: > > Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it > > skips the Razor, DCC and Pyzor tests? > > Not without modifying code. However, i

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread Daryl C. W. O'Shea
[EMAIL PROTECTED] wrote: Sorry for the slight delay, replies inline: At 01:39 07-07-05, Daryl C. W. O'Shea - [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted) SMTP;

Re: SA training

2005-07-07 Thread Stuart Johnston
Jean-Paul Natola wrote: -Original Message- From: JamesDR [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 5:42 PM To: users@spamassassin.apache.org Subject: Re: SA training Jean-Paul Natola wrote: OK I found the documentation for using IMAP2mbox to train, Now its quite simpl

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread rns . spamassassin . n . semba
Sorry for the slight delay, replies inline: At 01:39 07-07-05, Daryl C. W. O'Shea - [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted) SMTP; 1 Jul 2005 10:00:52 +0100

Re: ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 04:34:03PM -0500, Kenneth S. wrote: > Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it > skips the Razor, DCC and Pyzor tests? Not without modifying code. -- Randomly Generated Tagline: "It is far more impressive when others discover your good qu

RE: SA training

2005-07-07 Thread Jean-Paul Natola
-Original Message- From: JamesDR [mailto:[EMAIL PROTECTED] Sent: Thursday, July 07, 2005 5:42 PM To: users@spamassassin.apache.org Subject: Re: SA training Jean-Paul Natola wrote: > OK I found the documentation for using IMAP2mbox to train, > > Now its quite simple to tell a user "if i

Re: SA training

2005-07-07 Thread JamesDR
Jean-Paul Natola wrote: OK I found the documentation for using IMAP2mbox to train, Now its quite simple to tell a user "if its spam , drag it here" But how is the user to know if they have a false positive, unless they look at the header like this one for example which I don't know WHY it say

ALL_TRUSTED and Razor, DCC and Pyzor

2005-07-07 Thread Kenneth S.
Is there anyway to configure SA so that if the ALL_TRUSTED rule is hit it skips the Razor, DCC and Pyzor tests? Thanks, Kenneth

RE: SA training

2005-07-07 Thread Jean-Paul Natola
OK I found the documentation for using IMAP2mbox to train, Now its quite simple to tell a user "if its spam , drag it here" But how is the user to know if they have a false positive, unless they look at the header like this one for example which I don't know WHY it says "possible spam" as it sc

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Matt Kettler
Dr Robert Young wrote: > I am just becoming familiar with SpamAssassin, so I am sure this may > appear to be an "obvious" issue to those familiar with the tool. I am > just learning the ins and outs however. > > I downloaded many of the SARE rulesets (not bigevil however), and I am > running "sp

Re: SORBS_DUL and NJABL_DUL

2005-07-07 Thread Daryl C. W. O'Shea
Rick Macdougall wrote: Daryl C. W. O'Shea wrote: [EMAIL PROTECTED] wrote: Received: from host-212-158-194-14.bulldogdsl.com (HELO phoenix.example.com) (212.158.194.14) by secure.example.name with (DHE-RSA-AES256-SHA encrypted) SMTP; 1 Jul 2005 10:00:52 +0100 What SMTP service generates

RE: spamassassin --lint ....how long does it take?

2005-07-07 Thread Sander Holthaus - Orange XL
> I downloaded many of the SARE rulesets (not bigevil > however), and I am running "spamassassin -D --lint". It > seems like it is taking a very long time to run. Is this > typical or am I "hosed"? I am running it on a test system > (non-production) so it is not currently a serious problem,

Re: SA training

2005-07-07 Thread Stuart Johnston
JamesDR wrote: Jean-Paul Natola wrote: Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Since you are forwarding onto an excha

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: "Jim Maul" <[EMAIL PROTECTED]> > Theo Van Dinter wrote: > > On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: > > > >>eh, Theo, --lint doesn't require a message, it uses one of its own! > > > > > > Oh. Hahaha. I forgot about that. ;) > > Never mind me, brain is scattered rig

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: "Theo Van Dinter" <[EMAIL PROTECTED]> > I think you're not passing it a message so it's waiting on STDIN. > Try "spamassassin -D --lint < /dev/null". Er, Theo, --lint does not take any parameters. {o.o}

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread jdow
From: "Dr Robert Young" <[EMAIL PROTECTED]> > I am just becoming familiar with SpamAssassin, so I am sure this may > appear to be an "obvious" issue to those familiar with the tool. I am > just learning the ins and outs however. > > I downloaded many of the SARE rulesets (not bigevil however),

Re: SA training

2005-07-07 Thread JamesDR
Jean-Paul Natola wrote: Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Jean-Paul Natola Network Administrator Info

SA training

2005-07-07 Thread Jean-Paul Natola
Hi everyone, I'm new to SA so I need a bit of help in configuring /training SA- The problem I have is that I do not keep any mail in the SA box- it forwards to my mail server- What method can I use to train it? Jean-Paul Natola Network Administrator Information Technology Family C

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Jim Maul
Theo Van Dinter wrote: On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: eh, Theo, --lint doesn't require a message, it uses one of its own! Oh. Hahaha. I forgot about that. ;) Never mind me, brain is scattered right now due to work. My second suggestion is to do local-only in

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 11:43:10AM -0700, Justin Mason wrote: > eh, Theo, --lint doesn't require a message, it uses one of its own! Oh. Hahaha. I forgot about that. ;) Never mind me, brain is scattered right now due to work. My second suggestion is to do local-only in case there's a network che

Re: rules_du_jour & SA_RESTART interpretation?

2005-07-07 Thread Chris Thielen
Allo, Dr Robert Young wrote: In configuring the rules_du_jour script for rule updates, I am a bit concerned over my interpretation of the SA_RESTART parameter. It sounds like it is a call to the routine to "stop and then re-start" the spamd daemon. But the rules_du_jour example "kills" the

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Theo Van Dinter writes: > On Thu, Jul 07, 2005 at 02:27:32PM -0400, Dr Robert Young wrote: > > I downloaded many of the SARE rulesets (not bigevil however), and I am > > running "spamassassin -D --lint". It seems like it is taking a very > > long

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Kevin W. Gagel
> I am just becoming familiar with SpamAssassin, so I am > sure this may appear to be an "obvious" issue to those > familiar with the tool. I am just learning the ins and > outs however. > > I downloaded many of the SARE rulesets (not bigevil > however), and I am running "spamassassin -D --li

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Michele Neylon:: Blacknight
Dr Robert Young wrote: > I am just becoming familiar with SpamAssassin, so I am sure this may > appear to be an "obvious" issue to those familiar with the tool. I am > just learning the ins and outs however. > > I downloaded many of the SARE rulesets (not bigevil however), and I am > running "sp

Re: spamassassin --lint ....how long does it take?

2005-07-07 Thread Theo Van Dinter
On Thu, Jul 07, 2005 at 02:27:32PM -0400, Dr Robert Young wrote: > I downloaded many of the SARE rulesets (not bigevil however), and I am > running "spamassassin -D --lint". It seems like it is taking a very > long time to run. Is this typical or am I "hosed"? I am running it on > a test syst

spamassassin --lint ....how long does it take?

2005-07-07 Thread Dr Robert Young
I am just becoming familiar with SpamAssassin, so I am sure this may appear to be an "obvious" issue to those familiar with the tool. I am just learning the ins and outs however. I downloaded many of the SARE rulesets (not bigevil however), and I am running "spamassassin -D --lint". It seems

rules_du_jour & SA_RESTART interpretation?

2005-07-07 Thread Dr Robert Young
In configuring the rules_du_jour script for rule updates, I am a bit concerned over my interpretation of the SA_RESTART parameter. It sounds like it is a call to the routine to "stop and then re-start" the spamd daemon. But the rules_du_jour example "kills" the spamd process with killall (ie

Re: How can I correctly detect these spams?

2005-07-07 Thread Chris Thielen
Andy Jezierski wrote: Chris Thielen <[EMAIL PROTECTED]> wrote on 07/07/2005 01:15:24 AM: > Hi Thomas, > > Your email scored nearly 25 on my system. Chickenpox contributed 4.2, > uribls contributed tons. > > HTH :) > As has been pointed out, make sure your network tests are turned on. I a

Re: How can I correctly detect these spams?

2005-07-07 Thread Andy Jezierski
Chris Thielen <[EMAIL PROTECTED]> wrote on 07/07/2005 01:15:24 AM: > Hi Thomas, > > Your email scored nearly 25 on my system.  Chickenpox contributed 4.2, > uribls contributed tons. > > HTH :) > As has been pointed out, make sure your network tests are turned on. I am surprised that I only

Re: RFKINDY false positives on faxes

2005-07-07 Thread Bjorn Jensen
Martin Lee wrote: We've had some false positives with the X_LIBRARY, MIME_BOUND_RKFINDY rules being tripped on e-faxes received through www.myvfm.com. Fairly obviously the service has been built using the Indy.Sockets library (www.indyproject.org). The Indyproject knowledge base admits that head

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
OK. This is what I thought I needed to do. Just to clarify, SAproxy is the same as pop3proxy.pl correct? I've looked around and can't find a download for these. It looks like they have been discontinued. I saw that a new one which is only windows based has sprung up called SpamFu. I need it to be L

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Paolo Cravero as2594
Jesse Shumaker wrote: Let me try and summarize what I have recieved from all these e-mails as [...] use and am trying to piece it all together. Correct, except that the remote POP3 server is specified on client configuration and not wired statically on the pop3 proxy box. At least with the

Re: (14.6) How can I correctly detect these spams?

2005-07-07 Thread Chris Thielen
Hi Thomas, Your email scored nearly 25 on my system. Chickenpox contributed 4.2, uribls contributed tons. HTH :) Thomas Booms wrote: Spam detection software, running on the system "ns1.sandgnat.com", has identified this incoming email as possible spam. The original message has been attac

Re: SpamAssassin w/POP3 & SMTP outsourced e-mail server...

2005-07-07 Thread Jesse Shumaker
Let me try and summarize what I have recieved from all these e-mails as well as put together myself. Then you guys could give me some feedback if I'm on the right trail. What I need to do is install SpamAssassin w/pop3proxy on a linux box. Then setup the pop3proxy to point to my external pop3 serve