Re: trusted_networks?

2005-10-25 Thread Daryl C. W. O'Shea
Cami wrote: Daryl C. W. O'Shea wrote: Cami wrote: Matt Kettler wrote: Cami wrote: I'm not treating them as such. All I'm trying to do is stop RBL checks happening for the 196.0.0.0/8 network. trusted_networks 196.0.0.0/8 165.165.0.0/16 165.146.0.0/16 internal_networks 196.2.50.0/24

Re: trusted_networks?

2005-10-25 Thread Cami
Daryl C. W. O'Shea wrote: Cami wrote: Matt Kettler wrote: Cami wrote: I'm not treating them as such. All I'm trying to do is stop RBL checks happening for the 196.0.0.0/8 network. trusted_networks 196.0.0.0/8 165.165.0.0/16 165.146.0.0/16 internal_networks 196.2.50.0/24 I have done so,

RE: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Kevin W. Gagel
- Original Message - >I'm trying to work in a broader context - I find OOO >replies annoying in any situation, not just those I get as >a result of my (or others) posting to a list. Certainly >sending OOO or vacation messages to a list is heinous, but >even those I get from people with whom

Re: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Gene Heskett
On Tuesday 25 October 2005 18:58, [EMAIL PROTECTED] wrote: >Kurt Buff wrote: >> Differentiating between personal accounts and company email systems, >> how do you all classify OOO messages? >> >> For my personal account (on gmail.com) I consider these things spam, >> and report them to gmail as suc

Re: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Gene Heskett
On Tuesday 25 October 2005 18:53, Kurt Buff wrote: >> - Original Message - >> From: [EMAIL PROTECTED] >> To: [EMAIL PROTECTED] >> Sent: Tuesday, October 25, 2005 5:47 PM >> Subject: Out of Office AutoReply: *SPAM* Re: Stupid spammer >> rule > >Let's take this one farther afield, sha

Re: trusted_networks?

2005-10-25 Thread Daryl C. W. O'Shea
Cami wrote: Matt Kettler wrote: Cami wrote: I'm not treating them as such. All I'm trying to do is stop RBL checks happening for the 196.0.0.0/8 network. trusted_networks 196.0.0.0/8 165.165.0.0/16 165.146.0.0/16 internal_networks 196.2.50.0/24 I have done so, yet i still fail to see

RE: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Kurt Buff
I'm trying to work in a broader context - I find OOO replies annoying in any situation, not just those I get as a result of my (or others) posting to a list. Certainly sending OOO or vacation messages to a list is heinous, but even those I get from people with whom I correspond directly are quite a

Re: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread mouss
[EMAIL PROTECTED] a écrit : I think considering them spam is a little strong. While it is not spam, it is undesirable and annoying. more annoying is the fact that this problem is known since a long time but people keep misconfiguring their systems (or reinventing broken vacation programs).

Re: Where do I change...

2005-10-25 Thread Roland Corrigal
I was a binary program called MPP that is used to in conjunction with scanners to filter email. I found out that the actual binary calls it up and can't be changed without a recompile... that's as far as I got so far anyways... later On 25-Oct-05, at 4:50 PM, Matt Kettler wrote: Roland C

Re: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Kevin W. Gagel
It should depend on the list rules. If the list rules prohibit them then it should be treated as spam. If the list rules has nothing in them about these annoying little creatures then the list owner should just suspend the account. - Original Message - From: Kurt Buff <[EMAIL PROTECTED]>

RE: Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Matthew.van.Eerde
Kurt Buff wrote: > Differentiating between personal accounts and company email systems, > how do you all classify OOO messages? > > For my personal account (on gmail.com) I consider these things spam, > and report them to gmail as such. > > I haven't started to do anything with them at work, but

Sorta OT - was: RE: Out of Office AutoReply

2005-10-25 Thread Kurt Buff
> - Original Message - > From: [EMAIL PROTECTED] > To: [EMAIL PROTECTED] > Sent: Tuesday, October 25, 2005 5:47 PM > Subject: Out of Office AutoReply: *SPAM* Re: Stupid spammer rule Let's take this one farther afield, shall we? Differentiating between personal accounts and comp

Re: Where do I change...

2005-10-25 Thread Matt Kettler
Roland Corrigal wrote: > OK, I found out what was starting it now. Thanks for all your help! I > had to grep all of 'usr' to find it.. > Was it Some kind of script in /usr/local/etc/? or was it something weirder than that? ("Enquiring minds want to know!")

Re: Where do I change...

2005-10-25 Thread Roland Corrigal
OK, I found out what was starting it now. Thanks for all your help! I had to grep all of 'usr' to find it.. On 25-Oct-05, at 4:22 PM, Roland Corrigal wrote: That's the funny thing... There is no direct 'spamassassin' or 'spamd' script in the init directory, and I did do a "grep -r spamd /

Re: Where do I change...

2005-10-25 Thread Roland Corrigal
That's the funny thing... There is no direct 'spamassassin' or 'spamd' script in the init directory, and I did do a "grep -r spamd /etc/" and it didn't find it anywhere relevant. I installed it from Perl. It's seems to be somehow starting up with 'amavisd'. I've searched all of those files

SARE german rules version 1.00

2005-10-25 Thread Michael Monnerie
Hello list, I tried hard to receive more german text SPAM, and succeeded :-) Therefore, I was able to start to write german text based rules, which I put in an extra file. This file already contains the actual netbanking.at phishing rules, and should be quite helpful. I'd like to make it availa

Re: Where do I change...

2005-10-25 Thread Matt Kettler
On most sites it starts via /etc/init.d/spamassassin or /etc/init.d/spamd. However, it could be started via anything. It all depends on how it was set up. I can hand-hack a startup for it into almost anything in the whole bootup if I wanted, and if it's been hand-hacked you might just need to do a

Re: Stupid spammer rule

2005-10-25 Thread Matt Kettler
Fred wrote: > Hrmm something is wrong here, I updated this file on 10/14/2005 the very > first day I seen this sign. What date are you showing on your copy of the > random file? > > I also updated this file this morning to increase the score for this rule > but I forgot to change the last modifie

auto-spammer [Was: Fabrice LEGRAND/GIA est absent(e).]

2005-10-25 Thread mouss
[EMAIL PROTECTED] a écrit : Je serai absent(e) du 24/10/2005 au 28/10/2005. So they - autorespond to mailing lists, - could set the date, but not the gender (see the '(e)')... - and include 13 silly disclaimer lines for 2 lines of text but now the best (I'll ignore some sentences that are

RE: Where do I change...

2005-10-25 Thread Roland Corrigal
Sorry for another email, I meant.. "can't find how it starts up" Thanks again, RC Where do I change the user that spamd starts up with... I searched all my startup scripts and can find how it even starts up. Thanks, RC

Where do I change...

2005-10-25 Thread Roland Corrigal
Where do I change the user that spamd starts up with... I searched all my startup scripts and can find how it even starts up. Thanks, RC

Fw: Out of Office AutoReply: *****SPAM***** Re: Stupid spammer rule

2005-10-25 Thread Fred
Title: Out of Office AutoReply: *SPAM* Re: Stupid spammer rule Can we have this account removed from the list...    - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, October 25, 2005 5:47 PM Subject: Out of Office AutoReply: *SPAM* Re:

Re: Stupid spammer rule

2005-10-25 Thread Fred
Hrmm something is wrong here, I updated this file on 10/14/2005 the very first day I seen this sign. What date are you showing on your copy of the random file? I also updated this file this morning to increase the score for this rule but I forgot to change the last modified date and also forgot t

Fabrice LEGRAND/GIA est absent(e).

2005-10-25 Thread f . legrand
Je serai absent(e) du 24/10/2005 au 28/10/2005. Je répondrai à votre message dès mon retour. Ce message et toutes les pièces jointes sont établis à l'intention exclusive de ses destinataires et sont confidentiels. Si vous le recevez par erreur, merci d'en avertir l'expéditeur et de le d

Re: trusted_networks?

2005-10-25 Thread Cami
Matt Kettler wrote: Cami wrote: I'm not treating them as such. All I'm trying to do is stop RBL checks happening for the 196.0.0.0/8 network. Yes you are. You're trying to use them as an RBL whitelist, and it doesn't work that way. You can use them to deal with the DUL RBLs, but these settings

Re: Stupid spammer rule

2005-10-25 Thread Matt Kettler
Currently 70_sare_random.cf is rather old and doesn't contain any rules for these variants. It's got %FROM_NAME, but not %NAME_FROM. It doesn't have anything close to %NAME_TO. Perhaps Fred Tarasevicius needs to make an update. Adding NAME_FROM is easy: header __RANDH_7B ALL =~ /%FROM_NAME/ ra

Re: trusted_networks?

2005-10-25 Thread Matt Kettler
Cami wrote: > Matt Kettler wrote: > >> >> First, neither trusted nor internal networks is a whitelist. Don't try >> to treat >> them as such. > > > I'm not treating them as such. All I'm trying to do is stop > RBL checks happening for the 196.0.0.0/8 network. Yes you are. You're trying to use t

Re: Stupid spammer rule

2005-10-25 Thread M.Lewis
Are you using 70_sare_random.cf ? 70_sare_random.cf Description: 70_sare_random.cf tries to detect common mis-fires on bulk mail software. Many signs are found like: %RND_NUMBER, etc Mike Kenneth Porter wrote: Been getting a few of these: From: "{%NAME_FROM}" <[EMAIL PROTECTED]> To: "{%NA

Re: trusted_networks?

2005-10-25 Thread Cami
Matt Kettler wrote: First, neither trusted nor internal networks is a whitelist. Don't try to treat them as such. I'm not treating them as such. All I'm trying to do is stop RBL checks happening for the 196.0.0.0/8 network. According to the docs: Trusted rela

Stupid spammer rule

2005-10-25 Thread Kenneth Porter
Been getting a few of these: From: "{%NAME_FROM}" <[EMAIL PROTECTED]> To: "{%NAME_TO}" <[EMAIL PROTECTED]> Anyone have a rule to nuke them?

Re: How to disable a ruleset?

2005-10-25 Thread Carlos Zottmann
OK !! Thanks everyone for the tips !! Regards, Carlos. 2005/10/25, Matt Kettler <[EMAIL PROTECTED]>: > Carlos Zottmann wrote: > > Hi!! > > > > We are using amavisd-new indeed, and that was the problem. > > > > Doing a "ps aux | grep spam", i get just the processes below, wich are > > started by

Re: How to disable a ruleset?

2005-10-25 Thread Matt Kettler
Carlos Zottmann wrote: > Hi!! > > We are using amavisd-new indeed, and that was the problem. > > Doing a "ps aux | grep spam", i get just the processes below, wich are > started by a "spamassassin" service that we have on /etc/initd. > > spamd15804 0.0 1.6 30868 24992 ? Ss Oct21

Re: Using spam tools for viruses

2005-10-25 Thread Nix
On Mon, 24 Oct 2005, [EMAIL PROTECTED] whispered secretively: > I'm not sure what the SA folks think about this now a days. A while > back, they removed the checks for MS executables as being spam > indicators even though the test actually is a very good indicator of > spam. That's because it did

Re: How to disable a ruleset?

2005-10-25 Thread Carlos Zottmann
Hi!! We are using amavisd-new indeed, and that was the problem. Doing a "ps aux | grep spam", i get just the processes below, wich are started by a "spamassassin" service that we have on /etc/initd. spamd15804 0.0 1.6 30868 24992 ? Ss Oct21 0:00 /usr/bin/spamd -x -u spamd -H /hom

Re: trusted_networks?

2005-10-25 Thread Matt Kettler
Cami wrote: > Hi All, > > I'm using SpamAssassin v3.1.0 and amavisd-new 2.3.3. > > Oct 23 15:59:53 spamwall03.mweb.co.za amavis[32425]: (32425-01-69) SPAM, > <[EMAIL PROTECTED]> -> <<[EMAIL PROTECTED]>, Yes, Hits=7.734 > tag1=3.0 tag2=7.5 kill=7.5, > tests=DATE_IN_FUTURE_06_12=1.668,FM_NO_STYLE=0

RE: spamd --max-spare ignored

2005-10-25 Thread Matthew.van.Eerde
Robert Blayzor wrote: > [EMAIL PROTECTED] wrote: >> I'm running spamd with --max-spare, but as soon as I start it, it >> spawns --max-children children and keeps it there. >> ... >> --round-robin \ ... >> --max-spare=5 \ ... > Because you have specified "--round-robin". That tells sp

Re: spamd --max-spare ignored

2005-10-25 Thread Robert Blayzor
[EMAIL PROTECTED] wrote: > I'm running spamd with --max-spare, but as soon as I start it, it spawns > --max-children children and keeps it there. > > I'm running 3.10 with these options: > > /usr/bin/spamd \ > --daemonize \ > --username=spamd \ > --round-robin \ > --m

spamd --max-spare ignored

2005-10-25 Thread Matthew.van.Eerde
I'm running spamd with --max-spare, but as soon as I start it, it spawns --max-children children and keeps it there. I'm running 3.10 with these options: /usr/bin/spamd \ --daemonize \ --username=spamd \ --round-robin \ --max-children=20 \ --max-spare=5 \

RE: POP3 proxy with SA 3.x?

2005-10-25 Thread Raimonds Aronietis
Hi, I think you should check out P3Scan. It works fine for me. Raimonds -Original Message- From: Paolo Cravero as2594 [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 25, 2005 3:23 PM To: SpamAssassin Users Subject: POP3 proxy with SA 3.x? Hi, I have successfully used a Perl POP3proxy

POP3 proxy with SA 3.x?

2005-10-25 Thread Paolo Cravero as2594
Hi, I have successfully used a Perl POP3proxy on a Linux box with SA 2.6.x . I have now migrated to 3.x, and some internal functions have been dropped or renamed, so that Perl program doesn't work anymore. Does anyone know of a (Linux) POP3 proxy that supports SA 3.x? TIA, Paolo

trusted_networks?

2005-10-25 Thread Cami
Hi All, I'm using SpamAssassin v3.1.0 and amavisd-new 2.3.3. Oct 23 15:59:53 spamwall03.mweb.co.za amavis[32425]: (32425-01-69) SPAM, <[EMAIL PROTECTED]> -> <<[EMAIL PROTECTED]>, Yes, Hits=7.734 tag1=3.0 tag2=7.5 kill=7.5, tests=DATE_IN_FUTURE_06_12=1.668,FM_NO_STYLE=0.9,HTML_40_50=0.496,HTML_