whitelist and blacklist problem

2007-03-28 Thread lalit
i have configure spamassassin with mysql. now it fetch whitelist and blacklist data from userpref table. but mail detect as spam in both cases either user in whitelist or in blacklist. and spam report shows that user in blacklist and user in whitelist case 1 when user in whitelist X-Spam-Status:

Re: OT: lost some mail while updating qmail-scanner

2007-03-28 Thread Bill McCormick
Same thing happened to me recently and it eventually showed up. Although my setup's a little different, I think qmail keeps trying until it finally delivers. Does qmail-cntl -stat show anything? Further OT ... Depending on how you set up your toaster (I used qmailrocks,) the group permissions

OT: lost some mail while updating qmail-scanner

2007-03-28 Thread J.
I had some permissions trouble after updating a few things last night and as a result mail was coming in but not getting to the place where it could be "popped" by the user (me). The mail was coming in and being handled by spamd because I could see action in the log file, but nothing was showing up

sa-learn question

2007-03-28 Thread J.
After about a year of running sa-learn from a user that isn't the user that spamd is running under, I've changed things to allow login to the spamd user account (qscand). So, will running this command now work for helping train my bayes files? sa-learn --showdots --mbox --spam /home/domainmail/mai

Re: Feature Request

2007-03-28 Thread Loren Wilton
I have been using SA since ~2.60 and because I work for an ISP, I need to be more tolerant than most with regards to handling email. With this in mind I have made a few modifications to the STOCK version and have to manually patch with every upgrade, so here are some of the modifications I have ma

Re: email header question

2007-03-28 Thread Chris
On Saturday 24 March 2007 2:23 pm, vruk wrote: > Was there ever an answer to this? > I have every one of my emails from earthlink saying they are suspicious, > using the earthlnk scamblocker analize. > What is noehlo.host? > I finally got the attention of a few people at corp and here is a reply fr

Re: Just a general question

2007-03-28 Thread Chris
On Friday 23 March 2007 4:16 pm, Gary V wrote: > >>>I've been on this mail list only for a few months now, and am wondering > >>>if I am the smallest guy here. > >> > >>No, you're not. > > > >Oh me me me! > > > >1 domain, 1 user. :) > > I think only someone that uses fetchmail could beat that (no d

Re: Who is APEWS.ORG

2007-03-28 Thread Ilya Vishnyakov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 hmm I got this from Whois.sc Domain ID:D135922574-LROR Domain Name:APEWS.ORG Created On:27-Dec-2006 19:25:43 UTC Last Updated On:26-Feb-2007 03:47:58 UTC Expiration Date:27-Dec-2007 19:25:43 UTC Sponsoring Registrar:PSI-USA, Inc. dba Domain Robot (R6

Who is APEWS.ORG

2007-03-28 Thread Marc Perkel
Trying to figure out who these people are Who is APEWS.ORG? They claim to be a blocklist provider to block spam but they are blocking spam filtering services. They also seem to be hiding who is behind it. Who are they? Is this some fake front for uceprotect? Here's what they have on the /24 bl

Re: Feature Request

2007-03-28 Thread Justin Mason
hi -- could you open these as *multiple* *separate* bugs on http://issues.apache.org/SpamAssassin/ ? Some of them will be more likely to get accepted than others. ;) --j. Jorge Valdes writes: > Hi, > > I have been using SA since ~2.60 and because I work for an ISP, I need > to be more toleran

Re: Foreign Languages

2007-03-28 Thread John Thompson
On 2007-03-27, Nathan Brink <[EMAIL PROTECTED]> wrote: > Does SPAM Assassin score what we boarheaded Americans consider to be > "foreign language" email messages the same as it would English? Are you looking for something that would score mail differently depending on the language used? Some of

Re: whitelisting yahoogroups.com

2007-03-28 Thread Ilya Vishnyakov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Ok thank you. Dan Barker wrote: > No, it needs to be: > > whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com > > This covers ALL yahoo groups. You'll need more granularity to > specify the groupname, as that information is in other headers. > > Dan > >

RE: whitelisting yahoogroups.com

2007-03-28 Thread Dan Barker
No, it needs to be: whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com This covers ALL yahoo groups. You'll need more granularity to specify the groupname, as that information is in other headers. Dan -Original Message- From: Ilya Vishnyakov [mailto:[EMAIL PROTECTED] Sent: Wednesday, March

Re: whitelisting yahoogroups.com

2007-03-28 Thread Ilya Vishnyakov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thank you. James E. Pratt wrote: > No as I understand it, whitelist_from_rcvd checks relaying domain, > whitelist_from is a "blanket-whitelist" that only checks from > header - Only mail that matches: [EMAIL PROTECTED] sent from > actual yahoo.com re

RE: whitelisting yahoogroups.com

2007-03-28 Thread James E. Pratt
No as I understand it, whitelist_from_rcvd checks relaying domain, whitelist_from is a "blanket-whitelist" that only checks from header - Only mail that matches: [EMAIL PROTECTED] sent from actual yahoo.com relays will get whitelisted. (Sorry I forgot my "-" before!) It appears this may not work a

Re: Whitelist scoring question

2007-03-28 Thread Mark Adams
Thanks, I did run exactly that, and got the output that I posted. Do you have any idea why I might be getting such a limited output? What do you have set for reporting purposes in your local.cf file? Regards, Mark On Wed, Mar 28, 2007 at 01:31:16PM -0500, maillist wrote: > Mark Adams wrote: > >>

Re: whitelisting yahoogroups.com

2007-03-28 Thread Ilya Vishnyakov
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Does this mean whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com That all mail coming from yahoo will be in the whitelist? I certanly don't want this to happen. James E. Pratt wrote: > But, wouldn't that allow a spammer spoofing using th

RE: whitelisting yahoogroups.com

2007-03-28 Thread James E. Pratt
But, wouldn't that allow a spammer spoofing using that address "full-spammer-access"? I use: whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com regards, jamie -Original Message- From: maillist [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 28, 2007 2:34 PM To: Ilya Vishnyako

Re: whitelisting yahoogroups.com

2007-03-28 Thread maillist
Ilya Vishnyakov wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hmm. Hello Spamassassin Gurus! I'm having difficulties with yahoogroups.com emails. I whitelisted them as [EMAIL PROTECTED] , but emails still get into the spam. Is there any other way that I can whitelist it? I attach 2 scre

Feature Request

2007-03-28 Thread Jorge Valdes
Hi, I have been using SA since ~2.60 and because I work for an ISP, I need to be more tolerant than most with regards to handling email. With this in mind I have made a few modifications to the STOCK version and have to manually patch with every upgrade, so here are some of the modifications

Re: Big trouble

2007-03-28 Thread Justin Mason
Mark Martinec writes: > > > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: > > > > sender on bogons IP block [102.176.29.76 listed in > > > > combined-HIB.dnsiplists.completewhois.com] > > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > > (unlike RCVD_IN_WHOIS_INVALID a

Re: Sa-update problem ?

2007-03-28 Thread Daryl C. W. O'Shea
Theo Van Dinter wrote: On Wed, Mar 28, 2007 at 11:00:37AM -0400, Kevin Plested wrote: I am running SA 3.1.7 on a UNIX box, I haven't received an update since I installed it. Am I doing something wrong ? I have included below the result of "sa-update -D", which shows that 507739 is the latest ver

Re: Whitelist scoring question

2007-03-28 Thread Mark Adams
> > You could run: "spamassassin --test-mode < message", and see what it is > scoring. > Hi There, I have tried this, and get the below result. --_=_NextPart_001_01C7710E.58A560A4-- hits=4.0 required=5.0 test=NO_RDNS,VOWEL_FROM_7 This does not show whitelist hits, should it? Regards, Ma

Re: Sa-update problem ?

2007-03-28 Thread Lance Albertson
Theo Van Dinter wrote: >> I've been all through the website, and it would appear that running >> "sa-update" with no parameters should be all I need to do. I run a separate >> update for SARE updates, and that completes fine. > > Yes, to download/install an update, you can just run sa-update. Yo

Re: Big trouble

2007-03-28 Thread Mark Martinec
> > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: > > > sender on bogons IP block [102.176.29.76 listed in > > > combined-HIB.dnsiplists.completewhois.com] > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > > (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED... > >

Re: Sa-update problem ?

2007-03-28 Thread Theo Van Dinter
On Wed, Mar 28, 2007 at 11:00:37AM -0400, Kevin Plested wrote: > I am running SA 3.1.7 on a UNIX box, I haven't received an update since I > installed it. Am I doing something wrong ? I have included below the result > of "sa-update -D", which shows that 507739 is the latest version, but I'm > pret

Re: Big trouble

2007-03-28 Thread Justin Mason
Mark Martinec writes: > > 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block > > [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] > > I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? > (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOI

Sa-update problem ?

2007-03-28 Thread Kevin Plested
I am running SA 3.1.7 on a UNIX box, I haven't received an update since I installed it. Am I doing something wrong ? I have included below the result of "sa-update -D", which shows that 507739 is the latest version, but I'm pretty sure it isn't. I've been all through the website, and it would appe

Re: /etc/spamassassin or /var/lib/spamassassin?

2007-03-28 Thread Mark Adams
On Thu, Mar 22, 2007 at 04:40:27PM -0400, Bowie Bailey wrote: > Mark Adams wrote: > > On Fri, Mar 02, 2007 at 10:06:51AM -0500, Bowie Bailey wrote: > > > Is it scoring the whitelist lower or is it just not hitting? > > > > > > Can you post your whitelist rule and the headers from an example > > >

Re: /etc/spamassassin or /var/lib/spamassassin?

2007-03-28 Thread Mark Adams
> > Whitelist file is in /etc/spamassassin/ and is called whitelist.cf > > entry; > > > > whitelist_from [EMAIL PROTECTED] > > Is /etc/spamassassin where the rest of your site config is located? Typically > it's /etc/mail/spamassassin, but "spamassassin -D --lint" would tell you. > Hi, Yes /et

Re: List BlackList

2007-03-28 Thread Pablo Allietti
On Tue, Mar 27, 2007 at 06:52:27PM -0400, Matt Kettler wrote: > Pablo Allietti wrote: > > Hi all i need to list all members that i have in blacklist and in > > whitelist with the scores from anyone.. is that possible? > > Do you mean the AWL? That can be done using the check_whitelist script > in

per user scanning

2007-03-28 Thread Ronan McGlue
I am now able to call spamassassin from exim with the users localpart of their email address from within exim. I have tested it and it is calling to spamd with the line user='whatever' however in both AWL and bayes i dont see the user appearing, now im aware that the bayes required a certain m

Re: Big trouble

2007-03-28 Thread Mark Martinec
> 2.4 RCVD_IN_WHOIS_BOGONS RBL: CompleteWhois: sender on bogons IP block > [102.176.29.76 listed in combined-HIB.dnsiplists.completewhois.com] I wonder why score for RCVD_IN_WHOIS_BOGONS is 0 in 3.2.0-rc1 ? (unlike RCVD_IN_WHOIS_INVALID and RCVD_IN_WHOIS_HIJACKED, which are nonzero) r

Re: spamassassin not checking emails correctly.

2007-03-28 Thread Jimmy Stewpot
Loren Wilton wrote: Things are basically working, but you don't seem to have network test enabled, and you haven't trained enough ham/spam messages yet for Bayes to kick in. If you are starting SA using spamd, check for a -L parameter on the command line and remove it. That should enable n

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
> Before anyone can you give you a hint on how to block the > messages, we would need to see what the messages are. > > Same form as before, save the message (with full headers) and > place it somewhere where we can download it. http://www.rocsca.it/INBOX rocsca

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi, Rocco Scappatura wrote: Before anyone can you give you a hint on how to block the messages, we would need to see what the messages are. Same form as before, save the message (with full headers) and place it somewhere where we can download it. http://www.rocsca.it/INBOX There is anothe

RE: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
If you wish to reject at MTA level then please read http://www.postfix.org/uce.html under the section "Client hostname/address restrictions" as you are able to specify a list of RBLs. Regards, UxBoD On Wed, 28 Mar 2007 12:20:16 +0200, "Rocco Scappatura" <[EMAIL PROTECTED]> wrote: >> What MTA

Re: "KAUF-TIPP DER WOCHE" spam getting through

2007-03-28 Thread kshatriyak
On Wed, 28 Mar 2007, Panagiotis Christias wrote: the last days we get a lot of spam like this: KAUF-TIPP DER WOCHE I wrote a few of my own rules especially to catch those stocks scams together with bayes. If you don't have any people who should write you in German you can also use the X-Lan

RE: Big trouble

2007-03-28 Thread Rocco Scappatura
> What MTA are you using ? Postfix+MySQL+Amavisd-new rocsca

Re: Big trouble

2007-03-28 Thread Anthony Peacock
Hi Rocco, Rocco Scappatura wrote: Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c "spamassassin -t < message.mbox" And I get that the score is greater th

Re: Big trouble

2007-03-28 Thread -- [ UxBoD ] --
What MTA are you using ? On Wed, 28 Mar 2007 12:06:55 +0200, "Rocco Scappatura" <[EMAIL PROTECTED]> wrote: > Since some day, It's increased the number of spams which SA doesn't > block. > > Every time I'm going to analyse the message: > > 1) Save the message in mbox format 'message.mbox' > 2) s

Big trouble

2007-03-28 Thread Rocco Scappatura
Since some day, It's increased the number of spams which SA doesn't block. Every time I'm going to analyse the message: 1) Save the message in mbox format 'message.mbox' 2) su - amavis -c "spamassassin -t < message.mbox" And I get that the score is greater the 5.0 and often I get: 1.6 RCVD_IN_

Re: spamassassin not checking emails correctly.

2007-03-28 Thread Loren Wilton
Things are basically working, but you don't seem to have network test enabled, and you haven't trained enough ham/spam messages yet for Bayes to kick in. If you are starting SA using spamd, check for a -L parameter on the command line and remove it. That should enable network tests for you, a

Re: "KAUF-TIPP DER WOCHE" spam getting through

2007-03-28 Thread Loren Wilton
My goodness. That are sending that new format in German too! Could you send me a few of these AS ATTACHMENTS, WITH FULL HEADERS? I'm going to try to get time to write up some rules for the English-language version in the next few days, and if I have some German examples I may be able to writ

Re: "KAUF-TIPP DER WOCHE" spam getting through

2007-03-28 Thread Nigel Frankcom
On Wed, 28 Mar 2007 11:40:53 +0300, "Panagiotis Christias" <[EMAIL PROTECTED]> wrote: >Hello, > >the last days we get a lot of spam like this: > > spam body begins here >Words disputed interview galli provisions raise, eyebrows dead holders! > >KAUF-TIPP DER WOCHE > >LESEN SIE DIE NACHRIC

Re: "KAUF-TIPP DER WOCHE" spam getting through

2007-03-28 Thread -- [ UxBoD ] --
I ran them through our server and scored as follows :- Content analysis details: (9.9 points, 5.0 required) pts rule name description -- -- 0.3 SARE_WEOFFER BODY: Offers Something 3.2 FUZZY_PHARM

"KAUF-TIPP DER WOCHE" spam getting through

2007-03-28 Thread Panagiotis Christias
Hello, the last days we get a lot of spam like this: spam body begins here Words disputed interview galli provisions raise, eyebrows dead holders! KAUF-TIPP DER WOCHE LESEN SIE DIE NACHRICTEN STONEBRIDGE RES EXP Frankfurt: S3C.F Name :STONEBRIDGE RES EXP Kurzel :S3C.F WK

RE: blacklist by default

2007-03-28 Thread Jon Armitage
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > Sent: 28 March 2007 01:16 > To: Caleb Cushing > Cc: users@spamassassin.apache.org > Subject: Re: blacklist by default > > Caleb Cushing wrote: > > Is it possible to configure spamassassin 3.x to consider > all mail spa

Re: spamassassin not checking emails correctly.

2007-03-28 Thread Jimmy Stewpot
--[ UxBoD ]-- wrote: First thing first. Could you run a spamassassin -D --lint as the user which is scanning the email, and post the results please. This will allow people to diagnose the problem more easily. Regards, UxBoD On Wed, 28 Mar 2007 09:12:20 +0100, Jimmy Stewpot <[EMAIL PROTECTED

Re: spamassassin not checking emails correctly.

2007-03-28 Thread Nigel Frankcom
On Wed, 28 Mar 2007 09:12:20 +0100, Jimmy Stewpot <[EMAIL PROTECTED]> wrote: >Hello, > >I have recently installed spamassassin on my new ubuntu distribution >from the apt package. I seem to be having issues where emails that are >obviously spam are not being marked. > >X-Spam-Status: No, score=0

Re: spamassassin not checking emails correctly.

2007-03-28 Thread -- [ UxBoD ] --
First thing first. Could you run a spamassassin -D --lint as the user which is scanning the email, and post the results please. This will allow people to diagnose the problem more easily. Regards, UxBoD On Wed, 28 Mar 2007 09:12:20 +0100, Jimmy Stewpot <[EMAIL PROTECTED]> wrote: > Hello, > >

spamassassin not checking emails correctly.

2007-03-28 Thread Jimmy Stewpot
Hello, I have recently installed spamassassin on my new ubuntu distribution from the apt package. I seem to be having issues where emails that are obviously spam are not being marked. X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=no version=3.1.7-deb Is in the headers of the