Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

Adam Wilbraham wrote: On Wed, 29 Nov 2006 08:22:13 -0600 Bookworm <[EMAIL PROTECTED]> wrote: It sounds like you have the spamd bayes database, and then you have the database for whatever user you're actually running the test from. I ran into this problem as well - it's a known issue, and I

Re: Fetchmail/sa-learn timeout (config included) --SOLVED

What IMAP client are you using? It'd pay to forward the bad message to the maintainers so they can fix the hang. It would make a dandy DoS attack. {^_^} - Original Message - From: "Ian Pattison" <[EMAIL PROTECTED]> Turned out to just be a bad message in my IMAP folder. Deleted that on

Re: HTML Source Rule

Bob Newhart wrote: > Hello, I was wondering if there is a way to write a rule for HTML > source code contained in an email. Use rawbody as the rule type. This will match the text after decoding (ie: base64) and line-wrap removal, but before HTML tags are removed.

Re: Score=x+5

Alan Munday wrote: > I've just seen a mail marked as spammy (amavisd-new) where the score > header had Score=x+5 where x was the sum of the SA tests. > > X-Spam-Status: Yes, score=0.917+5 tagged_above=0 required=5 > tests=[AWL=0.727,BAYES_00=-2.599, BOTNET_SERVERWORDS=-0.01, > FORGED_RCVD_HELO=

Re: Installed FuzzyOCR - What am I missing?

On Tue, 28 Nov 2006, Evan Platt wrote: > Thanks to everyone especially Decoder, I think I'm up and running. > > png is the only one not working. > > Any reason NOT to assign 10 points to fuzzy ocr tripped words? > > I mean I wouldn't add 10 points just because someone typed the V word > in an e-ma

MailMarshal at csg.com.au

Can we *please* get csg.com.au unsubscribed? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --

Re: Fetchmail/sa-learn timeout (config included) --SOLVED

Turned out to just be a bad message in my IMAP folder. Deleted that one and the rest came through. >>> "Ian Pattison" <[EMAIL PROTECTED]> 28/11/2006 23:23 >>> Hi All, Forgot to incliude the config last time SuSE 10.1 Spamassassin 3.1.7 (Built from source tarballs) Fetchmail 6.3.2 IMAP serve

Score=x+5

I've just seen a mail marked as spammy (amavisd-new) where the score header had Score=x+5 where x was the sum of the SA tests. X-Spam-Status: Yes, score=0.917+5 tagged_above=0 required=5 tests=[AWL=0.727,BAYES_00=-2.599, BOTNET_SERVERWORDS=-0.01, FORGED_RCVD_HELO=0.135,HTML_MESSAGE=0.001, P0F

Re: SA Rule

On Wed, 29 Nov 2006, Loren Wilton wrote: > > for mangled viagra and other stuff ..is there any simple rule?? > > such as following text... > > Mangled rules are never simple rules. I have a perl script that will take a word list and generate REs for obfuscated versions of those words. http://w

Re: HTML Source Rule

--On Wednesday, November 29, 2006 5:17 PM -0600 Richard Frovarp <[EMAIL PROTECTED]> wrote: I have a few legit messages that are scoring over 5.0 due to SARE_STOCKS and the TVD rules to catch stocks, and this is after ALL_TRUSTED has done its work to reduce the score. These messages of course ha

Re: Stock Spam

Thanks loren..let me invoke bayes and try it out Loren Wilton wrote: > >> Thanks for ur inputs. when i put across SA this is what i get on my pc.. >> Content analysis details: (2.3 points, 4.5 required) >> >> pts rule name description >> -- >>

Re: Stock Spam

Thanks for ur inputs. when i put across SA this is what i get on my pc.. Content analysis details: (2.3 points, 4.5 required) pts rule name description -- -- 1.0 Local_Signup BODY: Body mentions Sign

Re: HTML Source Rule

Bret Miller wrote: Hello, I was wondering if there is a way to write a rule for HTML source code contained in an email. I am getting many of these "Buy This Stock" emails and I am finding that the pictures contained in them all have a portion of a line of source that says... src="cid: Thanks in

Re: Stock Spam

I am recieving lot of stock related spam mails which spam assassin is not able catch as spam. I have added Sare_stcok.cf file. I cant use imageinfo, fuzzy ocr as iam using 2.6o ver of spam assassin i think. I have enclosed the undecoded letter mail of one kind below. Can you plz help me to make th

RE: Stock Spam

Yeah Giampaolo. with 3.1x it should be alright. But my superior is still stick to the old one..:( Giampaolo Tomassoni wrote: > > From: san [mailto:[EMAIL PROTECTED] >> Thanks for ur inputs. when i put across SA this is what i get on my pc.. >> Content analysis details: (2.3 points, 4.5 requi

Re: Stock Spam

It's time to switch to 3.1.7, San. Isn't it? :) giampaolo It was time a long time ago. :-) The upgrade is good. sa-update is a useful tool.

Re: HTML Source Rule

This Stock" emails and I am finding that the pictures contained in them all have a portion of a line of source that says... src="cid: *ANY* inline image of any sort is going to contain that tag. That is what links to the other mime section containing the image. There are quite a number of r

Re: SA Rule

for mangled viagra and other stuff ..is there any simple rule?? such as following text... Mangled rules are never simple rules. The SARE rules contain a lot of these, as does the antidrug stuff in SA itself. It may be that these specific cases aren't caught though. Loren

Re: HTML Source Rule

Bret Miller wrote: pictures contained in them all have a portion of a line of source that says... src="cid: Thanks in advance for any help anyone may be able to provide. So does every message sent from Outlook that includes an image. I'd suspect that you'd end up rejecting a lot of legitimat

RE: Stock Spam

From: san [mailto:[EMAIL PROTECTED] > Thanks for ur inputs. when i put across SA this is what i get on my pc.. > Content analysis details: (2.3 points, 4.5 required) > > pts rule name description > -- > -- >

RE: Stock Spam

Thanks for ur inputs. when i put across SA this is what i get on my pc.. Content analysis details: (2.3 points, 4.5 required) pts rule name description -- -- 1.0 Local_Signup BODY: Body mentions Sig

RE: Stock Spam

From: san [mailto:[EMAIL PROTECTED] > Sent: Wednesday, November 29, 2006 11:33 PM > To: users@spamassassin.apache.org > Subject: Stock Spam > > > > Hi All, > > I am recieving lot of stock related spam mails which spam assassin is not > able catch as spam. I have added Sare_stcok.cf file. I cant

RE: HTML Source Rule

> Hello, I was wondering if there is a way to write a rule for > HTML source code contained in an email. I am getting many of > these "Buy This Stock" emails and I am finding that the > pictures contained in them all have a portion of a line of > source that says... > > src="cid: > > Thanks in adva

Re: Stock Spam

Yes thats true but as of now in my office we are using 2.6x. Is there any rules to catch in 2.6x? Right now the score it is genarating is more than 3 and need another 2 to mark as spam. Theo Van Dinter-2 wrote: > > On Wed, Nov 29, 2006 at 02:33:02PM -0800, san wrote: >> able catch as spam. I h

Re: Stock Spam

On Wed, Nov 29, 2006 at 02:33:02PM -0800, san wrote: > able catch as spam. I have added Sare_stcok.cf file. I cant use imageinfo, > fuzzy ocr as iam using 2.6o ver of spam assassin i think. I have enclosed > the undecoded letter mail of one kind below. Can you plz help me to make > this kind of mai

Stock Spam

Hi All, I am recieving lot of stock related spam mails which spam assassin is not able catch as spam. I have added Sare_stcok.cf file. I cant use imageinfo, fuzzy ocr as iam using 2.6o ver of spam assassin i think. I have enclosed the undecoded letter mail of one kind below. Can you plz help me t

HTML Source Rule

Hello, I was wondering if there is a way to write a rule for HTML source code contained in an email. I am getting many of these "Buy This Stock" emails and I am finding that the pictures contained in them all have a portion of a line of source that says... src="cid: Thanks in advance for any hel

RE: optional score in local.cf is not working

As has been stated multiple times, Amavisd-new does NOT use spamd. Just try out this little test, m'kay? Stop spamd. Don't restart it, just stop it. Now see if amavisd is still scanning for spam. What's that? It is? Whodathunkit! That's why you need to restart amavisd to reload changed confi

Number of email addresses in whitelist_from

SA version is 3.1.7 on Linux. In a user's prefs file, is there an upper limit/maximum number of email addresses using whitelist_from? A user wishes to add about 5000 email addresses from his entire contact database. What is the limit? Can a simple text file be maintained in which any email addre

Re: Anyone else seeing this (remove user from list?)

On Wed, 29 Nov 2006, Matt Kettler wrote: > I personally vote for the removal of this user until they learn to > disable their content filter, or at least make it do the right > thing and not respond to messages with Precedence: bulk or list. +1 -- John Hardin KA7OHZhttp://ww

Naive Keyword Filtering Considered Harmful (was Re: Anyone else seeing this)

This is due to automatic rules that have determined that the message is probably Porn related junk email. If you believe the message was business related please contact [EMAIL PROTECTED] and request that the message be released. If no contact is made within 4 days the message will automaticall

Re: tagging based on score level

beast wrote: Is it possible to make different tag for a different score/classes, for example: high: [SPAM!!!] if score > 50 medium: [SPAM!!] if score between 20 - 50 low: [SPAM] if score between treshold - 20 Depends on how you're calling SpamAssassin and whether SA is doing the markup or

Re: Why no bayes? [FIXED]

YMMV- I am not sure the *proper* way to do this (but I am glad there is no registry- :) ). Here ya go! find /usr/lib/per5 -name SpamAssassin.pm I have deleted mine but you should have 2 listings: /usr/lib/perl5/site-perl/5.8.5/Mail/SpamAssassin.pm /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssas

Re: Cronjob with sa-learn

Markus Braun wrote: Hello, i tried to create a cron job to add spam messages as spamemails. The following command : 0 1 * * * vmail sa-learn --spam /var/opt/vmail/.info/oliver/Maildir/.spam/cur *.* But i get this retourn: archive-iterator: readdir found no mail in 'domain1.de' direct

Re: Installed FuzzyOCR - What am I missing?

Evan Platt wrote: At 02:56 PM 11/28/2006, you wrote: Last month there was a discussion thread on this list about that exact topic. Search either the Apache list archives or the GMANE archives. For example see: http://mail-archives.apache.org/mod_mbox/spamassassin-users/200610.mbox/[EMAIL PROTE

Re: Moving to folder based upon spamassassin score

for the record now tested !! i kicked out te and the coouting is working sorry to have you spamed :) VERBOSE=ON # setting the level #trash TLVL="-20" #quarantine QLVL="-4" #maybe spam MLVL="-2" SL="0" # counting stars :0 * H ?? ()^X-Spam-Level: \/[*]+ { SPAMLEVEL=$MATCH } :0 * 1^1

Re: sa-update installation

Hi Steven, On Wed, Nov 29, 2006 at 07:56:18AM -0600, Steven Stern told us: > after sa-update runs, restart spamassassin and it will use the new rules > in /var/lib/spamassassin. > > I have this as a cron job: > > 30 3 * * * sa-update && spamassassin --lint && /etc/init.d/spamassassin > restart

Re: sa-update question, kinda

On Wed, Nov 29, 2006 at 07:39:10AM -0500, Joe Zitnik wrote: > I know you can use sa-update to download the new sa-rules as they become > available. Are the rules located somewhere that they can be manually > downloaded as they are updated, kind of like rulesemporium? I was > poking around the sa

Re: sa-update installation

* On 29/11/06 15:27 +, Bryan Hepworth wrote: | Steven Stern wrote: | >Odhiambo Washington wrote: | > | >>Hello List, | >> | >>I have successfully (I hope) installed and run sa-update, and | >>I see that it installed files in /var/lib/spamassassin/3.001007/ | >> | >>In my FreeBSD box, I am use

Re: spam is marked as "user_in_whitelist"

hey greg: you got me there i was looking at : Received: from myserver ([127.0.0.1]) by localhost (myserver [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TnlkYt9U0aRr for ; Wed, 29 Nov 2006 06:09:20 -0500 (EST) Received: from 218-171-61-71.dynamic.hinet.net (218-171-61-71.dyn

Re: sa-update installation

* On 29/11/06 07:56 -0600, Steven Stern wrote: | Odhiambo Washington wrote: | > Hello List, | > | > I have successfully (I hope) installed and run sa-update, and | > I see that it installed files in /var/lib/spamassassin/3.001007/ | > | > In my FreeBSD box, I am used to the rules being in | > /u

Re: Moving to folder based upon spamassassin score

öh , ja I shoudnt try to be so quick sorry forget a : and have a false $ # u can use with procmail $VAR a treshhold VERBOSE=ON # setting the level #trash TLVL="-10" #quarantine QLVL="-4" #maybe spam MLVL="-2" SL="0" # counting stars :0 * H ?? ()^X-Spam-Level: \/[*]+ { SPAMLEVEL=$MATCH }

Re: Moving to folder based upon spamassassin score

# third try :) u can use with procmail $VAR a treshhold VERBOSE=ON # setting the level #trash TLVL="-10" #quarantine QLVL="-4" #maybe spam MLVL="-2" SL="0" # counting stars :0 * $ H ?? ()^X-Spam-Level: \/[*]+ { SPAMLEVEL=$MATCH } :0 * 1^1 SPAMLEVEL ?? ()\* { } SL = "$=" # with this y

Re: sa-update installation

Steven Stern wrote: Odhiambo Washington wrote: Hello List, I have successfully (I hope) installed and run sa-update, and I see that it installed files in /var/lib/spamassassin/3.001007/ In my FreeBSD box, I am used to the rules being in /usr/local/share/spamassassin and /usr/local/etc/mail

Re: spam is marked as "user_in_whitelist"

On Wed, Nov 29, 2006 at 10:22:11AM -0500, Stas Khromoy wrote: > *keep getting the following spam > which spamassassin for some reason > give a scrore of -100 or - 70 > keeps saying the user is in whitelist > > > > Subject:* both of those that is of the people, of the Lord your words of > subject

Re: Moving to folder based upon spamassassin score

UUPS i have some syntax errors / fast copy / misssing $ John W Mickevich schrieb: Hi all, I have what is probably a simple question. I know I have seen instructions on this before, but cannot locate them and was hoping someone could point me in the right direction. I am using spamassassin

Re: Moving to folder based upon spamassassin score

John W Mickevich schrieb: Hi all, I have what is probably a simple question. I know I have seen instructions on this before, but cannot locate them and was hoping someone could point me in the right direction. I am using spamassassin with sendmail and am using .procmailrc to direct my in

spam is marked as "user_in_whitelist"

*keep getting the following spam which spamassassin for some reason give a scrore of -100 or - 70 keeps saying the user is in whitelist Subject:* both of those that is of the people, of the Lord your words of subject :me: a certain man that hear O house of man from among the land of our or ot

RE: Cronjob with sa-learn

Markus Braun wrote: > Hello, > > i tried to create a cron job to add spam messages as spamemails. > > The following command : > > 0 1 * * * vmail sa-learn --spam > /var/opt/vmail/.info/oliver/Maildir/.spam/cur *.* > > But i get this retourn: > > archive-iterator: readdir found no mail in

RE: sa-update installation

Jason Frisvold wrote: > On 11/29/06, Steven Stern <[EMAIL PROTECTED]> wrote: > > after sa-update runs, restart spamassassin and it will use the new > > rules in /var/lib/spamassassin. > > > > I have this as a cron job: > > > > 30 3 * * * sa-update && spamassassin --lint && > > /etc/init.d/spama

(no subject)

Re: sa-update question, kinda

Joe Zitnik wrote: > I know you can use sa-update to download the new sa-rules as they become > available. Are the rules located somewhere that they can be manually > downloaded as they are updated, kind of like rulesemporium? I was > poking around the sa site, but couldn't find updated rules, onl

RE: optional score in local.cf is not working

Leon Kolchinsky wrote: > > So, let me get this straight: > - > This is how I see the work of amavis+spamd+clamd: > > 1. As I see it amavis talk to spamd (spamassassin) and clamd (ClamAV) > via appropriate sockets or TCP ports. > In my case - > To clamd via /var/lib/cl

Re: sa-update installation

On 11/29/06, Steven Stern <[EMAIL PROTECTED]> wrote: after sa-update runs, restart spamassassin and it will use the new rules in /var/lib/spamassassin. I have this as a cron job: 30 3 * * * sa-update && spamassassin --lint && /etc/init.d/spamassassin restart Oh? I thought you needed to spec

Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

On Wed, 29 Nov 2006 08:22:13 -0600 Bookworm <[EMAIL PROTECTED]> wrote: > It sounds like you have the spamd bayes database, and then you have > the database for whatever user you're actually running the test > from. I ran into this problem as well - it's a known issue, and I > wish the SA folks wo

RE: This is so obvious...

Yeah this slipped thur as well. Just write a rule for the phone number. I'll see about getting 70_sare_specific.cf updated for this number. --Chris -Original Message- From: Jon D. Slater [mailto:[EMAIL PROTECTED] Sent: Wednesday, November 29, 2006 9:17 AM To: users@spamassassin.apache.o

Moving to folder based upon spamassassin score

Hi all, I have what is probably a simple question. I know I have seen instructions on this before, but cannot locate them and was hoping someone could point me in the right direction. I am using spamassassin with sendmail and am using .procmailrc to direct my incoming email to be sent to s

Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

Adam Wilbraham wrote: To follow up on this, the message in question is flagged as spam if i run it through spamassassin, however if I run it through spamc its not. spamc is what Qmail Scanner invokes. Is there a separate configuration for spamc / spamd to spamassassin? I thought not... It sound

Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

Adam Wilbraham wrote: To follow up on this, the message in question is flagged as spam if i run it through spamassassin, however if I run it through spamc its not. spamc is what Qmail Scanner invokes. Is there a separate configuration for spamc / spamd to spamassassin? I thought not... when

Re: Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

To follow up on this, the message in question is flagged as spam if i run it through spamassassin, however if I run it through spamc its not. spamc is what Qmail Scanner invokes. Is there a separate configuration for spamc / spamd to spamassassin? I thought not... On Wed, 29 Nov 2006 14:00:13 +0

Cronjob with sa-learn

Hello, i tried to create a cron job to add spam messages as spamemails. The following command : 0 1 * * * vmail sa-learn --spam /var/opt/vmail/.info/oliver/Maildir/.spam/cur *.* But i get this retourn: archive-iterator: readdir found no mail in 'domain1.de' directory archive-iterator:

Odd behaviour (?) of my Qmail / Qmail Scanner / SpamAssassin 3.1.3 Setup?

Hi, I've got a bit of an odd situation whereby some obvious spam seems to be slipping through the net of our setup. A prime example would be a "Re: hi" spam which has just come through, an obvious looking spam containing the text Hi and a drugs gif. Looking at the headers after qmail scanner has p

Re: sa-update installation

Odhiambo Washington wrote: > Hello List, > > I have successfully (I hope) installed and run sa-update, and > I see that it installed files in /var/lib/spamassassin/3.001007/ > > In my FreeBSD box, I am used to the rules being in > /usr/local/share/spamassassin and /usr/local/etc/mail/spamassassi

Re: RelayChecker (now Botnet ) 0.4

Rick Macdougall wrote: Those who like SQL might like the stuff at wich includes my SpamAssassin plugin. :-) If I'm reading the docs correctly, it would not be of any use to me since spamd runs on its on separate server and p0f only supports loc

RE: optional score in local.cf is not working

Hi, OK. I did some manual tests and indeed changes in local.cf only catching then I restart amavis. # /etc/init.d/amavis restart Shutting down virus-scanner (amavisd-new):Daemon [9905] terminated by SIGTERM

effectivity with local tests only [auf Viren überprüft]

Hi! My environment is a bit "weired". I get all my Mails from my ISP's relay. So I disabled AWL. I have no direct internet access. I can use HTTP over a proxy cascade and SMTP with the relay host. No external DNS. So I'm stuck with static rules and bayes. I trained SA with 1600 spam mails and 22

Re: Anyone else seeing this (remove user from list?)

Loren Wilton wrote: >> Is anyone else seeing the below when sending a message to the list? > > Yes. Discussed a week or so ago when it seemingly first started > happening. > >Loren > > Yes. Under the subject "[Fwd: Your email message was blocked]" but they didn't talk about anything other

sa-update question, kinda

I know you can use sa-update to download the new sa-rules as they become available. Are the rules located somewhere that they can be manually downloaded as they are updated, kind of like rulesemporium? I was poking around the sa site, but couldn't find updated rules, only full releases.

sa-update installation

Hello List, I have successfully (I hope) installed and run sa-update, and I see that it installed files in /var/lib/spamassassin/3.001007/ In my FreeBSD box, I am used to the rules being in /usr/local/share/spamassassin and /usr/local/etc/mail/spamassassin. Do I just go out for a cold beer and

Re: optional score in local.cf is not working

Leon Kolchinsky wrote: > Hi, > > I thought I was wrong and "amavis restart" didn't really helped there, but > there is an update for this problem I had with configuration in local.cf not > catching. > > It seems that only when I do /etc/init.d/amavis restart, all configs in > local.cf are coming

MX1 server queue mail

I have a problem with my MX1 mail server running sendmail. Some mails are being queued for days eg. [EMAIL PROTECTED] ~]# more /var/log/maillog |grep kAS91uVl019923 Nov 28 11:02:25 mx1 sendmail[19923]: kAS91uVl019923: from=<[EMAIL PROTECTED]>, size=1728, class=0, nrcpts=1, msgid=<[EMAIL PROTECTED

Re: Updated to SA 3.1.3 to get sa-update... But:

Why does your rule not work? It looks good to me, if you're trying to detect a subject consisting of (for example): "hi it's John" or something. Can you give some exact samples of subject lines you're trying to flag? If this string ("hi it's ") is the only thing in those subject fields - no

Re: tagging based on score level

high: [SPAM!!!] if score > 50 medium: [SPAM!!] if score between 20 - 50 low: [SPAM] if score between treshold - 20 Look for the TEMPLATE TAGS section, in particular the _STARS(*)_ tag. Almost, but not exactly what I want since it still has so many possibility (up to 50 stars). I just want

Re: Anyone else seeing this

Is anyone else seeing the below when sending a message to the list? Yes. Discussed a week or so ago when it seemingly first started happening. Loren

Re: tagging based on score level

Craig Morrison wrote: beast wrote: Is it possible to make different tag for a different score/classes, for example: high: [SPAM!!!] if score > 50 medium: [SPAM!!] if score between 20 - 50 low: [SPAM] if score between treshold - 20 The reason is client filter or other redirection program (f

Re: tagging based on score level

beast wrote: Is it possible to make different tag for a different score/classes, for example: high: [SPAM!!!] if score > 50 medium: [SPAM!!] if score between 20 - 50 low: [SPAM] if score between treshold - 20 The reason is client filter or other redirection program (for example to be redir

Re: optional score in local.cf is not working

On Wed, 29 Nov 2006 10:10:58 +0200, "Leon Kolchinsky" <[EMAIL PROTECTED]> wrote: >Hi, > >I thought I was wrong and "amavis restart" didn't really helped there, but >there is an update for this problem I had with configuration in local.cf not >catching. > >It seems that only when I do /etc/init.d

RE: optional score in local.cf is not working

Hi, I thought I was wrong and "amavis restart" didn't really helped there, but there is an update for this problem I had with configuration in local.cf not catching. It seems that only when I do /etc/init.d/amavis restart, all configs in local.cf are coming intact. I've used to an old version