Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread mouss
Matt Kettler wrote: John Hardin wrote: On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: Perhaps Verizon is screwing up their DNS? Ahh, yes they are: http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this increasingly-common "feature", perhaps a URIBL/

Re: Bayes and celebrity spam

2008-01-29 Thread Loren Wilton
He is obviously a target, but some of this is very obvious, no? With subject like 'Jennifer Garner showing tits and booty in the shower fbeqxunqpwpjauxekoyx' and body containing... www(dot)prnceleb(dot)com now," Malfoy went on. of metal, and tnlffifuubqrnvrrtneekyntauypuqlecgwjaihf Is this some

Re: Bayes and celebrity spam

2008-01-29 Thread Robert Fitzpatrick
On Tue, 2008-01-29 at 22:16 -0500, Mark Johnson wrote: > I put extreme scores against emails from TW as we don't do business with > anyone from there. If it wasn't for that, this would have made it > through my system as well. I am really surprised bayes scored a 0 as it > did for the original

Re: Bayes and celebrity spam

2008-01-29 Thread Mark Johnson
Theo Van Dinter wrote: On Tue, Jan 29, 2008 at 07:51:03PM -0500, Robert Fitzpatrick wrote: I have some users getting slammed with this spam. Before I start trying to figure out how to intercept, can someone test this message and tell me if your getting a score above 5.0? http://esmtp.webtent.ne

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
John Hardin wrote: On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: Perhaps Verizon is screwing up their DNS? Ahh, yes they are: http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this increasingly-common "feature", perhaps a URIBL/DNSBL rule could be

Re: Bayes and celebrity spam

2008-01-29 Thread Loren Wilton
Can I get some tests now on my properly formatted file by anyone to see if my scoring should be blocking this message? Sorry for the previously posted poorly formatted files...and thanks for the help! http://esmtp.webtent.net/test2.txt Well, my results probably aren't hugely representative, but

FW: [Mimedefang] MD tries to open /root/.spamassassin/user_prefs(was Re: mimedefang-multiplexor and bayes_path)

2008-01-29 Thread James E. Pratt
-Original Message- From: James E. Pratt Sent: Tuesday, January 29, 2008 9:34 PM To: '[EMAIL PROTECTED]' Cc: '[EMAIL PROTECTED]' Subject: RE: [Mimedefang] MD tries to open /root/.spamassassin/user_prefs(was Re: mimedefang-multiplexor and bayes_path) > Kelson wrote: > Since upgrading fro

Re: Bayes and celebrity spam

2008-01-29 Thread Robert Fitzpatrick
On Tue, 2008-01-29 at 18:05 -0800, Loren Wilton wrote: > There is still something wrong with the message you pasted, and possibly > with how you are runing it into SA to test: > > Received: from n6c.bullet.mail.tp2.yahoo.com (n6c.bullet.mail.tp2.yahoo.com > [203.188.202.136]) > \x09by esmtp.ky.

Re: Bayes and celebrity spam

2008-01-29 Thread Loren Wilton
There is still something wrong with the message you pasted, and possibly with how you are runing it into SA to test: Received: from n6c.bullet.mail.tp2.yahoo.com (n6c.bullet.mail.tp2.yahoo.com [203.188.202.136]) \x09by esmtp.ky.webtent.net (WebTent ESMTP Postfix Internet Mail Gateway) with SMT

Re: Bayes and celebrity spam

2008-01-29 Thread Robert Fitzpatrick
On Tue, 2008-01-29 at 20:22 -0500, Theo Van Dinter wrote: > On Tue, Jan 29, 2008 at 07:51:03PM -0500, Robert Fitzpatrick wrote: > > I have some users getting slammed with this spam. Before I start trying > > to figure out how to intercept, can someone test this message and tell > > me if your gett

Re: 3.2.3 to 3.2.4

2008-01-29 Thread Bubuk Gabrok
*PLEASE DISCARD THE EARLIER MESSAGE. SORRY.* On Jan 29, 2008 4:36 AM, Randal, Phil <[EMAIL PROTECTED]> wrote: > Yes, > > That should be fine. > > Don't forget to run sa-update after installing. > > Cheers, > > Phil I am very new at this. I have read the FAQ which stated that updates will be wri

Re: 3.2.3 to 3.2.4

2008-01-29 Thread Bubuk Gabrok
On Jan 29, 2008 5:15 AM, Bubuk Gabrok <[EMAIL PROTECTED]> wrote: > On Jan 29, 2008 4:36 AM, Randal, Phil <[EMAIL PROTECTED]> wrote: > > Yes, > > > > That should be fine. > > > > Don't forget to run sa-update after installing. [EMAIL PROTECTED] lib]# /usr/bin/sa-update --nogpg --channel saupdates.

Re: Bayes and celebrity spam

2008-01-29 Thread Duane Hill
On Tue, 29 Jan 2008 20:22:59 -0500 Theo Van Dinter <[EMAIL PROTECTED]> wrote: > On Tue, Jan 29, 2008 at 07:51:03PM -0500, Robert Fitzpatrick wrote: > > I have some users getting slammed with this spam. Before I start > > trying to figure out how to intercept, can someone test this > > message and

Re: Bayes and celebrity spam

2008-01-29 Thread Theo Van Dinter
On Tue, Jan 29, 2008 at 07:51:03PM -0500, Robert Fitzpatrick wrote: > I have some users getting slammed with this spam. Before I start trying > to figure out how to intercept, can someone test this message and tell > me if your getting a score above 5.0? > > http://esmtp.webtent.net/test.txt > >

Re: Bayes and celebrity spam

2008-01-29 Thread Duane Hill
On Tue, 29 Jan 2008 19:51:03 -0500 Robert Fitzpatrick <[EMAIL PROTECTED]> wrote: > I have some users getting slammed with this spam. Before I start > trying to figure out how to intercept, can someone test this message > and tell me if your getting a score above 5.0? > > http://esmtp.webtent.net/

Bayes and celebrity spam

2008-01-29 Thread Robert Fitzpatrick
I have some users getting slammed with this spam. Before I start trying to figure out how to intercept, can someone test this message and tell me if your getting a score above 5.0? http://esmtp.webtent.net/test.txt I'm getting 4.4 on this particular one, but others less. My bayes still insists on

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread John Hardin
On Tue, 2008-01-29 at 15:25 -0800, John Hardin wrote: > On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: > > Perhaps Verizon is screwing up their DNS? > > > > Ahh, yes they are: > > > > http://www.freedom-to-tinker.com/?p=1227 > > Hrm. > > As a troubleshooting hack for this increasingly-

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread John Hardin
On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: > Perhaps Verizon is screwing up their DNS? > > Ahh, yes they are: > > http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this increasingly-common "feature", perhaps a URIBL/DNSBL rule could be defined that checks

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
David Zinder wrote: Thank you for the response and suggestions. Yes - lists.surbl.org - I was using the link Contacts->mailing lists from www.surbl.org If I understand the request for more info... It seems to get caught by all the lists. Here is an example from an email this morning. I'm not

Re: Redo: Upgrade 3.2.3->3.2.4 breaks rule override

2008-01-29 Thread Karl Boyken
Kris, thanks for the help. It looks to me like the problem may lie in the way MIMEDefang 2.63 is interacting with SpamAssassin. When I run spamassassin -D on a message that causes hits on the SpamHaus tests, it scores correctly. Time to pester the MIMEDefang developers, maybe. Karl Kris De

Spamd Locker/SeLinux issues (v3.1.9)

2008-01-29 Thread Ion Soltan
Dear list members, I have recently upgraded to RHEL5.1 and I am having all sorts of issues with spamassassin (mostly its "locker") and selinux, apparently. When I disable selinux (setenforce 0), everything seems to work fine. My spamassassin is invoked through procmail and my procmailrc looks a

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Theo Van Dinter
On Tue, Jan 29, 2008 at 06:07:08PM +0100, Karsten Bräckelmann wrote: > This looks fishy. Your problem doesn't seem to be specific to SURBL. All > URIBL tests are hitting. http://wiki.apache.org/spamassassin/OpenDnsAndUribls ? -- Randomly Selected Tagline: You will have good luck and overcome ma

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Karsten Bräckelmann
On Tue, 2008-01-29 at 11:34 -0500, David Zinder wrote: > If I understand the request for more info... It seems to get caught by > all the lists. Here is an example from an email this morning. I'm not > sure how to munge, but I think this is what you requested. > > Content analysis details: (5

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread David Zinder
Thank you for the response and suggestions. Yes - lists.surbl.org - I was using the link Contacts->mailing lists from www.surbl.org If I understand the request for more info... It seems to get caught by all the lists. Here is an example from an email this morning. I'm not sure how to munge,

Re: Logging with SA/procmail standalone (no spamd)

2008-01-29 Thread Theo Van Dinter
On Tue, Jan 29, 2008 at 08:50:32AM -0600, Bob McClure Jr wrote: > Probably not. If I understand correctly, you are calling the > stand-alone spamassassin from procmail. At that point, SA is running > as a mere mortal, which never can log to someplace like /var/log. Just to note, you don't need t

Re: Logging with SA/procmail standalone (no spamd)

2008-01-29 Thread Bob McClure Jr
On Tue, Jan 29, 2008 at 02:41:06AM -0500, Jason Antman wrote: > Hi, > > I'm a student at Rutgers University. I've been running SA on my own > mailserver (handling 3 users) for a few years now. I recently came into > some new hardware, and replaced the old mailserver with a new one > running Solari

Re: Can anyone help me?

2008-01-29 Thread Adam Lanier
On Mon, 2008-01-28 at 17:19 -0500, David Zinder wrote: > I think my problem is related to surbl.org, but I can't figure out how > to reach them. list.surbl.org times out, and has for several weeks. > > I had been using Spamassassin 3.1.5 under RHEL 3. Works great, until Jan > 1, 2008. I started

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
Note: I fixed your subject line to try to draw the attention of the right people. Generic subject lines tend to get overlooked by folks with specific interests, since many just skim the subject lines. David Zinder wrote: I think my problem is related to surbl.org, but I can't figure out how to

Re: 3.2.3 to 3.2.4

2008-01-29 Thread Bubuk Gabrok
On Jan 29, 2008 4:36 AM, Randal, Phil <[EMAIL PROTECTED]> wrote: > Yes, > > That should be fine. > > Don't forget to run sa-update after installing. > > Cheers, > > Phil > > -- > Phil Randal > Network Engineer > Herefordshire Council > Hereford, UK Thank you Phil. -- Bubuk

RE: 3.2.3 to 3.2.4

2008-01-29 Thread Randal, Phil
Yes, That should be fine. Don't forget to run sa-update after installing. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: Bubuk Gabrok [mailto:[EMAIL PROTECTED] > Sent: 29 January 2008 12:18 > To: users@spamassassin.apach

3.2.3 to 3.2.4

2008-01-29 Thread Bubuk Gabrok
I installed 3.2.3 from the Mail-SpamAssassin-3.2.4.tar.bz2 tarball. Would it be okay to download Mail-SpamAssassin-3.2.4.tar.bz2 , install it and the new version will overwrite the 3.2.3 version ? Please advise. TIA. -- roger

RE: Spamassassin simscan newbie question

2008-01-29 Thread Thomas Raef
I am very new to SpamAssassin and Simscan , both of which are installed on a server by a previous administer. I want simscan to reject spam mail per domain basis. I tried to modify simcontrol file and ran simscanmk, but it ended up in rejecting even normal mails to some users. I had to revert

Can anyone help me?

2008-01-29 Thread David Zinder
I think my problem is related to surbl.org, but I can't figure out how to reach them. list.surbl.org times out, and has for several weeks. I had been using Spamassassin 3.1.5 under RHEL 3. Works great, until Jan 1, 2008. I started getting false positives from surbl. These are emails I have rec

Import SpamBayes configuration into SpamAssassin

2008-01-29 Thread New SA User
I've been using SpamBayes for Outlook on Windows for 3 years and have a well-trained configuration of spam and ham. This is stored by default in a file called default_bayes_database.db I've enabled SpamAssassin on my shared hosting service. Is there a method of importing the SpamBayes configurat

Spamassassin simscan newbie question

2008-01-29 Thread Femitha Majeed
Hi, I am very new to SpamAssassin and Simscan , both of which are installed on a server by a previous administer. I want simscan to reject spam mail per domain basis. I tried to modify simcontrol file and ran simscanmk, but it ended up in rejecting even normal mails to some users. I had to re

Re: One SPAM that got through

2008-01-29 Thread --[ UxBoD ]--
- "Matt Kettler" <[EMAIL PROTECTED]> wrote: --[ UxBoD ]-- wrote: > Hi, > > I just had this message get through :- > > > and it only scored 5.6. These are the rules it hit :- > > 1.23 ADVANCE_FEE_2 > 0.00 BAYES_50 > 0.72 SARE_URGBIZ Contains urgent matter > -0.00 SPF_P

Re: Tweaking Rules

2008-01-29 Thread Matus UHLAR - fantomas
> On Mon, Jan 28, 2008 at 04:10:39PM -0600, Matt wrote: > > score SPF_FAIL 10 > > score SPF_SOFTFAIL 5 > > score SPF_NEUTRAL 2 On 28.01.08 17:28, Theo Van Dinter wrote: > If you wanted to give a small positive score for these, that might not be > terrible. Anything over 1 is asking for trouble IM