Re: commerce Antispam Products

2006-09-14 Thread Patrick Sneyers
Have a look at MPP. Excellent software, nice people, great support. http://www.messagepartners.com And you can use SpamAssassin with it. Patrick Sneyers Op 14-sep-06, om 15:37 heeft Jeff het volgende geschreven: hello,lists, We're looking for a commerce antispam product.It should be high p

ApacheCon 2006 and SpamAssassin

2006-09-14 Thread Michael Parker
Howdy, This year ApacheCon will be held in Austin, Texas. http://www.us.apachecon.com/index.html In addition to all of the other Apache Software Foundation related talks there will be at least two SpamAssassin talks: High Performance Apache SpamAssassin Extending Apache SpamAssassin Using Plug

Re: Message containing bitmaps with random lines not being blocked

2006-09-14 Thread Theo Van Dinter
On Thu, Sep 14, 2006 at 06:27:36PM -0500, Logan Shaw wrote: > >&Mail::SpamAssassin::Util::secure_tmpdir called at > > Since Mail::SpamAssassin::Util::secure_tmpdir is part of the > SpamAssassin install. Sounds like you may have an out of > date version of SpamAssassin that isn't new enough to hav

Re: Gee, first time I've seen these headers in a received message! ;-)

2006-09-14 Thread Chris
On Thursday 14 September 2006 6:05 am, Loren Wilton wrote: > I wonder what a "False-Spam-Checker" might be? > > Loren > > > Return-Path: <[EMAIL PROTECTED]> > Received: from lost.lost.hu ([212.52.166.101]) > by mx-pigeons.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id > 1gnDqV1l

Re: commerce Antispam Products

2006-09-14 Thread jdow
Anthony, when Jeff remarked "millions" I thought of his countryman who was here awhile back and talked about taking at least the rules engine from SpamAssassin into C language, This limited rules a little, But it made everything run somewhat faster, which was desperately needed because they were s

Re: commerce Antispam Products

2006-09-14 Thread jdow
From: "Jim Maul" <[EMAIL PROTECTED]> Richard Collyer wrote: We're looking for a commerce antispam product.It should be high performance and has the strong ability to capture spams. Could you recommend me a good product about it?We are an ISP,have millions of users. (Please don't say Symantec's

Re: Message containing bitmaps with random lines not being blocked

2006-09-14 Thread Logan Shaw
On Fri, 15 Sep 2006, Robert S wrote: FuzzyOCR - visit the wiki plugins page. It helps. {^_^} Thanks. Done that. A couple of things. I get this message: [8321] dbg: plugin: registering glue method for fuzzyocr_check (FuzzyOcr=HASH(0xf2f140)) [8321] warn: rules: failed to run FUZZY_OCR test,

Re: spamassassin setup

2006-09-14 Thread Dhaval Patel
Theo Van Dinter <[EMAIL PROTECTED]> said: > On Thu, Sep 14, 2006 at 10:00:31PM -, Dhaval Patel wrote: > > Is there any info on how to enable/disable/write my own rules? > > Yes. Enabling is simple, just have the rule in place. Disabling is simple, > just set the score for the rule to 0. Wr

Re: Message containing bitmaps with random lines not being blocked

2006-09-14 Thread Robert S
FuzzyOCR - visit the wiki plugins page. It helps. {^_^} Thanks. Done that. A couple of things. I get this message: [8321] dbg: plugin: registering glue method for fuzzyocr_check (FuzzyOcr=HASH(0xf2f140)) [8321] warn: rules: failed to run FUZZY_OCR test, skipping: [8321] warn: (Undefined sub

Re: spamassassin setup

2006-09-14 Thread Logan Shaw
On Thu, 14 Sep 2006, Dhaval Patel wrote: SpamAssassin comes with a whole bunch of rules by default. The best thing is to look at those rules and see what they're doing. There's probably real documentation somewhere, but there is so much example code that you may not need it. I did not see much

Re: spamassassin setup

2006-09-14 Thread Logan Shaw
On Thu, 14 Sep 2006, Dhaval Patel wrote: 3. I did not clear explaination on how exactly the rbl_checks work. Can I specify which rbl to use and not use? I also could not find any information on which connections to allow on the firewall to allow these checks. Our server is not allowed to make

Re: spamassassin setup

2006-09-14 Thread Theo Van Dinter
On Thu, Sep 14, 2006 at 10:00:31PM -, Dhaval Patel wrote: > Is there any info on how to enable/disable/write my own rules? Yes. Enabling is simple, just have the rule in place. Disabling is simple, just set the score for the rule to 0. Writing your own is a little harder... If you do a "per

Re: spamassassin setup

2006-09-14 Thread Dhaval Patel
> > 3. I did not clear explaination on how exactly the rbl_checks work. Can I > > specify > >which rbl to use and not use? I also could not find any information on which > >connections to allow on the firewall to allow these checks. Our server is > >not allowed > >to make any outgoing connecti

Can i use MySQL pref when i call spam from amavisd ?

2006-09-14 Thread Num ber
good evening all , all my question was on the subject. Can i use MySQL pref when i cal spamd from amavisd ? And if i can, how can i use it ? Because i have seen sa can use Mysql when it's called with -q.. I don't call SA but spamd it is the same ? Thanks for your reply, and have a good night :-

Re: spamassassin setup

2006-09-14 Thread Dhaval Patel
> SpamAssassin comes with a whole bunch of rules by default. > The best thing is to look at those rules and see what they're > doing. There's probably real documentation somewhere, but > there is so much example code that you may not need it. I did not see much in the local.cf after a fresh inst

Re: spamassassin setup

2006-09-14 Thread John D. Hardin
On Thu, 14 Sep 2006, Dhaval Patel wrote: > I found the following which contains rules. http://bl.csma.biz/csma.cf > > From looking at these rules, it would seem that my server would > query bl.csma.biz to see if the IP the email came from is on their > list. Which means that I would have to allow

Re: spamassassin setup

2006-09-14 Thread Theo Van Dinter
On Thu, Sep 14, 2006 at 09:34:35PM -, Dhaval Patel wrote: > 1. From reading the docs I think using spamd and spamc (not spamassassin) > would be the > best. Is that what people in this group would recommend? Any reasons why not? Generally speaking you want to use spamc/spamd instead of spamas

spamassassin setup

2006-09-14 Thread Dhaval Patel
I am looking to install and configure spamassassin on my debian sarge server with about 15 users. We have been getting lots of spam lately and spambayes is not cutting it. We need to use the rbl_check feature with spambayes to reduce the spams getting to our inbox. I have a few questions: 1. F

Re: SpamAssassin add

2006-09-14 Thread hamann . w
>> On Thursday, September 14, 2006 9:06 AM + Michele Petrazzo >> <[EMAIL PROTECTED]> wrote: >> >> > always, when I install spamassassin to my custumers, I create them a imap >> > account (called normally spam), that has two folders, spam and no-spam, >> > where the users move the "not sign

Re: FORGED_YAHOO_RCVD

2006-09-14 Thread John D. Hardin
On Thu, 14 Sep 2006, Ben Wylie wrote: > The FORGED_YAHOO_RCVD rule seems to hit falsely. > I am using SpamAssassin 3.1.2 on Windows 2003 Server. > > Can anyone see why the following headers hit this rule? > The email was a genuine yahoo email from a friend telling me about a > photo album he had

Re: Why is ALL_TRUSTED fireing here?

2006-09-14 Thread Carsten
OK, solved by an upgrade to 3.1.4 -- View this message in context: http://www.nabble.com/Why-is-ALL_TRUSTED-fireing-here--tf2272019.html#a6313754 Sent from the SpamAssassin - Users forum at Nabble.com.

RE: Fishing

2006-09-14 Thread Bowie Bailey
Loren Wilton wrote: > > Correction! That should be: > > > > /htt(p|ps):\/\/.*?\/.*\.com$/i > > > > and slightly more efficient (doesn't capture backreference): > > > > /htt(?:p|ps):\/\/.*?\/.*\.com$/i > > Or maybe more simply and readably: > > m'https?://.*/.*\.com$'i > > But the .* thing

Re: commerce Antispam Products

2006-09-14 Thread qqqq
| > We're looking for a commerce antispam product.It should be high performance | > and has the strong ability to capture spams. Could you recommend me a good | > product about it?We are an ISP,have millions of users. (Please don't say | > Symantec's brightmail,it's fairly good,but it's too expensi

Re: SpamAssassin add

2006-09-14 Thread Kenneth Porter
On Thursday, September 14, 2006 9:06 AM + Michele Petrazzo <[EMAIL PROTECTED]> wrote: always, when I install spamassassin to my custumers, I create them a imap account (called normally spam), that has two folders, spam and no-spam, where the users move the "not signed has spam, or signed h

Re: Re: commerce Antispam  Products

2006-09-14 Thread Theo Van Dinter
On Thu, Sep 14, 2006 at 10:01:29PM +0800, Jeff wrote: > Sorry for the trouble for others.I just know many antispam tech-hackers here > including some antispam company's guys.So I ask it here,:-) My guess is that the majority of people would say use SpamAssassin, probably with some form of third-p

Re: Fishing

2006-09-14 Thread John Thompson
On 2006-09-13, Fábio Gomes <[EMAIL PROTECTED]> wrote: > I didn't mean removing EXE attachments, but blocking/high scoring messages > with links to executables in its body. > > Is it possible? I would think it would be a little tricky, as the filter would have to follow the link to determine if

RE: postcard exploit email

2006-09-14 Thread Benny Pedersen
On Tue, September 12, 2006 13:31, Michael Scheidell wrote: >> http://www.canaltv.org/postcard.gif.exe";> > And if anyone knows the people at clamav, I have submitted this nasty > thing several times to them and they still don't have a sig for it. i know this is in clamav, look back on this threa

Why is ALL_TRUSTED fireing here?

2006-09-14 Thread Carsten
Hi, I am wondering, why for a certain email, ALL_TRUSTED is still fireing. Sometimes, it works. Sometimes not. I use fetchmail by the way to fetch mail from a provider. I put 127 and my local net into internal, these plus the provider into trusted. I put below some headers and a snip from my l

Re:  commerce Antispam  Products

2006-09-14 Thread Joseph Okech
Your answer thus: spamassassin rgds, Joseph On Thursday 14 September 2006 17:01, Jeff wrote: > Sorry for the trouble for others.I just know many antispam tech-hackers > here including some antispam company's guys.So I ask it here,:-) > > -jeff > > > > > > > -原始邮件- > 发件人:"Jim Maul" > 发送时间

Re: commerce Antispam Products

2006-09-14 Thread Joseph Okech
We are an ISP and we proudly use amavisd + spamassassin setup and works extremely good, and we spend just the effort to tune it. regards, Joseph On Thursday 14 September 2006 16:37, Jeff wrote: > hello,lists, > > We're looking for a commerce antispam product.It should be high performance > and

Re: commerce Antispam Products

2006-09-14 Thread Martin Hepworth
Sipos Gabor wrote: hello,lists, We're looking for a commerce antispam product.It should be high performance and has the strong ability to capture spams. Could you recommend me a good product about it?We are an ISP,have millions of users. (Please don't say Symantec's brightmail,it's fairly goo

Re: commerce Antispam Products

2006-09-14 Thread Anthony Peacock
Hi, Fort Systems Ltd - http://www.fsl.com/ Do a product which uses Mailscanner, SpamAssassin and MailWatch. They even do this in an appliance. Please note that I haven't used their packages, so I can make any recommendations. But I do use MailScanner, SpamAssassin & MailWatch on my servers an

Re: Re: commerce Antispam  Products

2006-09-14 Thread Jeff
Sorry for the trouble for others.I just know many antispam tech-hackers here including some antispam company's guys.So I ask it here,:-)   -jeff       -原始邮件-发件人:"Jim Maul" <[EMAIL PROTECTED]>发送时间:2006-09-14 22:01:15收件人:users@spamassassin.apache.org抄送:(无)主题:Re: commerce Antispam ProductsRi

Re: commerce Antispam Products

2006-09-14 Thread Sipos Gabor
> hello,lists, > > We're looking for a commerce antispam product.It should be high performance > and has the strong ability to capture spams. > Could you recommend me a good product about it?We are an ISP,have millions of > users. > (Please don't say Symantec's brightmail,it's fairly good,but i

Re: commerce Antispam Products

2006-09-14 Thread Jim Maul
Richard Collyer wrote: >> We're looking for a commerce antispam product.It should be high >> performance and has the strong ability to capture spams. >> Could you recommend me a good product about it?We are an ISP,have >> millions of users. >> (Please don't say Symantec's brightmail,it's fairly g

Re: commerce Antispam Products

2006-09-14 Thread Richard Collyer
> We're looking for a commerce antispam product.It should be high > performance and has the strong ability to capture spams. > Could you recommend me a good product about it?We are an ISP,have > millions of users. > (Please don't say Symantec's brightmail,it's fairly good,but it's too > expensi

commerce Antispam Products

2006-09-14 Thread Jeff
hello,lists,   We're looking for a commerce antispam product.It should be high performance and has the strong ability to capture spams. Could you recommend me a good product about it?We are an ISP,have millions of users. (Please don't say Symantec's brightmail,it's fairly good,but it's too expensiv

Re: Fishing

2006-09-14 Thread Fábio Gomes
Em Quarta 13 Setembro 2006 18:00, [EMAIL PROTECTED] escreveu: > >> Bill Randle wrote: > >> > Amavisd-new will also drop attachments with a configurable list > >> > of file extentions, but the question refered to links to exe's, > >> > not actual exe attachments. > >> > >> Good point -- everyone's p

Re: Message containing bitmaps with random lines not being blocked

2006-09-14 Thread Loren Wilton
I have been getting a large number of messages which are not being blocked by SA. Typically they contain a bitmapped text message with things like "THIS ONE JUST STARTED TRADING" or "CRITICAL INVESTOR ALERT FOR ...". Below this there are several paragraphs of meaningless sentences and there is a

Re: Fishing

2006-09-14 Thread Loren Wilton
Correction! That should be: /htt(p|ps):\/\/.*?\/.*\.com$/i and slightly more efficient (doesn't capture backreference): /htt(?:p|ps):\/\/.*?\/.*\.com$/i Or maybe more simply and readably: m'https?://.*/.*\.com$'i But the .* things really should stop on something reasonable like > or \s o

Re: filtering by time

2006-09-14 Thread Toni Casueps
It's true that mail can be delayed and all that, but anyway, legitimate email usuallly has less points than spam and I think they will not go past 5 points. I gave that rule 1.5 points just for that spams that have 4 or 4.5 points I do receive messages from people overseas, and I'm subscribe

Re: Gee, first time I've seen these headers in a received message! ;-)

2006-09-14 Thread jdow
That is one of my hacks in procmail. If mail comes in with SpamAssassin headers I rewrite them to X-False-whatever. I used that for some diagnostics. It was also part of one of the tricks I arranged when spamd was failing on some messages with "full" or "rawbody". I looked for markup and if I didn

Gee, first time I've seen these headers in a received message! ;-)

2006-09-14 Thread Loren Wilton
I wonder what a "False-Spam-Checker" might be? Loren Return-Path: <[EMAIL PROTECTED]> Received: from lost.lost.hu ([212.52.166.101]) by mx-pigeons.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1gnDqV1li3Nl34g0 for <>; Wed, 13 Sep 2006 18:42:17 -0400 (EDT) Received: (qmail 9

Re: Fishing

2006-09-14 Thread Benny Pedersen
On Wed, September 13, 2006 20:48, Fábio Gomes wrote: > I didn't mean removing EXE attachments, but blocking/high scoring messages > with links to executables in its body. > > Is it possible? perldoc Mail::SpamAssassin::Plugin::AntiVirus >> Or - if you are using procmail: >> #Delete all messages w

FORGED_YAHOO_RCVD

2006-09-14 Thread Ben Wylie
The FORGED_YAHOO_RCVD rule seems to hit falsely. I am using SpamAssassin 3.1.2 on Windows 2003 Server. Can anyone see why the following headers hit this rule? The email was a genuine yahoo email from a friend telling me about a photo album he had put up. * 1.8 FORGED_YAHOO_RCVD 'From'

Re: filtering by time

2006-09-14 Thread Matthias Haegele
John Andersen schrieb: On Thursday 14 September 2006 00:21, Toni Casueps wrote: It corresponds to the received header that my MTA adds, so it has the local time when the message arrives. It matches messages that arrive from 00:00:00 to 06:59:59 (i gave it a score of 1.5). So you have no friend

Re: filtering by time

2006-09-14 Thread John Andersen
On Thursday 14 September 2006 00:21, Toni Casueps wrote: > It corresponds to the received header that my MTA adds, so it has the local > time when the message arrives. It matches messages that arrive from > 00:00:00 to 06:59:59 (i gave it a score of 1.5). So you have no friends on the opposite sid

Re: filtering by time

2006-09-14 Thread Toni Casueps
Thanks. I searched the archives and found a link to a site that now redirects to SARE, but I couldn't find a rule for this there. So I finally wrote a rule that seems to work: header RECEIVED_AT_NIGHTReceived =~ /id [^;]+; ..., \d?\d ... \d\d\d\d 0[0-6]:\d\d:\d\d/ This matches hea

Re: Ask about more detail rule description

2006-09-14 Thread L's
John D. Hardin wrote: > > On Wed, 13 Sep 2006, jdow wrote: > >> > A suggestion: one wiki page for each rule where the description is too >> > short to be clear, on which the rule's meaning and rationale is >> > explained in whatever level of detail is considered adequate and >> > clear. >> >>