Spam volumes down since last week

2008-06-23 Thread ram
I am seeing a clear downtrend in the number for spams hitting our servers, I am not sure why ? Since Last week spams are at 50% of what they used to be last month. Is this what you all are seeing But the irritant 419's are still coming in ( and some get past SA ), in many new variants. I have

Re: Clamav Plugin for Spamassassin

2008-06-23 Thread metamorph
Randy Ramsdell wrote: > > metamorph wrote: >> James Lay wrote: >> >>> On 6/22/08 9:30 PM, "metamorph" <[EMAIL PROTECTED]> wrote: >>> >>> Spamassassin/Clamav/Ubuntu/PHP5/Apache2/citadel/ I just installed spamassasin and tested it with gtube and it worked, but when

Re: prevent to set a score for a non existend rule

2008-06-23 Thread Benny Pedersen
On Tue, June 24, 2008 01:10, Stefan Jakobs wrote: > I'm guess this doesn't work: > amavis[31206]: (31206-01) SPAM-TAG, <[EMAIL PROTECTED]> -> [EMAIL > PROTECTED]>, Yes, > score=7.88 tagged_above=-999 required=5 tests=[ALL_TRUSTED=-1.8, > BAYES_50=0.001, HTML_MESSAGE=0.001, JM_SOUGHT_3=4, JM_SOU

Re: prevent to set a score for a non existend rule

2008-06-23 Thread John Hardin
On Tue, 24 Jun 2008, Stefan Jakobs wrote: On Monday 23 June 2008 18:13, Benny Pedersen wrote: On Mon, June 23, 2008 14:33, Stefan Jakobs wrote: /etc/mail/spamassassin/sought_rules.cf with this content: score JM_SOUGHT_1 2.2 meta JM_SOUGHT_1_ADJ (JM_SOUGHT_1) score JM_SOUGHT_1_A

Re: prevent to set a score for a non existend rule

2008-06-23 Thread Stefan Jakobs
On Monday 23 June 2008 18:13, Benny Pedersen wrote: > On Mon, June 23, 2008 14:33, Stefan Jakobs wrote: > > /etc/mail/spamassassin/sought_rules.cf with this content: > > score JM_SOUGHT_1 2.2 > > meta JM_SOUGHT_1_ADJ (JM_SOUGHT_1) > score JM_SOUGHT_1_ADJ -0.1 > > > score JM_SOUGHT_2

Re: Fake MX Record(s) Trick

2008-06-23 Thread Benny Pedersen
On Mon, June 23, 2008 21:27, mouss wrote: > 14400 is 4 hours (4*3660) which is a bit low for an MX 86400 (24 > hours) is probably better. nice calc for 4 hours :-) Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Channel ordering?

2008-06-23 Thread Kris Deugau
Justin Mason wrote: The dirs are lexically sorted by the hostname they're downloaded from. So if you name your hosts "zz-local-sa-updates.domain.org" for example, those rules will be loaded after "updates.SpamAssassin.org". Butbutbut that's so *ugly*. (I figured I'd have to do that

Re: Clamav Plugin for Spamassassin

2008-06-23 Thread Randy Ramsdell
metamorph wrote: James Lay wrote: On 6/22/08 9:30 PM, "metamorph" <[EMAIL PROTECTED]> wrote: Spamassassin/Clamav/Ubuntu/PHP5/Apache2/citadel/ I just installed spamassasin and tested it with gtube and it worked, but when I tried to install clamav it still lets the EICAR files through.

Re: Clamav Plugin for Spamassassin

2008-06-23 Thread metamorph
James Lay wrote: > > > On 6/22/08 9:30 PM, "metamorph" <[EMAIL PROTECTED]> wrote: > >> >> Spamassassin/Clamav/Ubuntu/PHP5/Apache2/citadel/ >> >> I just installed spamassasin and tested it with gtube and it worked, but >> when I tried to install clamav it still lets the EICAR files through.

Re: Fake MX Record(s) Trick

2008-06-23 Thread mouss
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam ( http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and I

Re: Fake MX Record(s) Trick

2008-06-23 Thread mouss
Marc Perkel wrote: Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home an

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John GALLET
Re, I excluded the last two rules from my masscheck to avoid FPs as these ESPs/X-Mailers are definitely grey, "import rcpt list and blast" sort of ESPs not black for global use. If you can point me to some more information on how to do that, on-list or off-list, I am interested. I am new to

seekrules over French spam (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John GALLET
Hi, You run "seek-phrases-in-corpus" over the 2 corpora, and it'll spit out the patterns; you can then write rules based on these. I did so, the results are interesting, though I do not really know where to go from there. If I take the first 50 "best" patterns and strip off the obvious stand

Re: Fake MX Record(s) Trick

2008-06-23 Thread Marc Perkel
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and

Re: prevent to set a score for a non existend rule

2008-06-23 Thread Benny Pedersen
On Mon, June 23, 2008 14:33, Stefan Jakobs wrote: > /etc/mail/spamassassin/sought_rules.cf with this content: > score JM_SOUGHT_1 2.2 meta JM_SOUGHT_!_ADJ (JM_SOUGHT_1) score JM_SOUGHT_!_ADJ -0.1 > score JM_SOUGHT_2 2.2 meta JM_SOUGHT_2_ADJ (JM_SOUGHT_2) score JM_SOUGHT

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread Yet Another Ninja
On 6/23/2008 4:36 PM, John GALLET wrote: Hi, First of all, thanks to Justin for patiently helping me to install mass-check and pointing me in the right direction. I will try to run the algorithms tonight to see what they come up with. In the meantime, you can find a hit-frequencies report at

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John GALLET
Thanks for taking this burden upon yourself. One other thing you should be prepared to do, if you're willing to devote long-term responsibility to these rules, is to provide sa-update-compatible feeds of your dynamic rules. This is another thing that Justin can probably help you with. I am hap

Re: prevent to set a score for a non existend rule

2008-06-23 Thread John Hardin
On Mon, 23 Jun 2008, Stefan Jakobs wrote: But now I get a lint warning: # spamassassin --lint [12533] warn: config: warning: score set for non-existent rule JM_SOUGHT_3 The problem is that the sought ruleset has sometimes three rules and sometimes only two rules. But I don't like to change my c

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John GALLET
Re, Looking at the rules, I'm worried about false positives on genuine opt-in advertising. I have a number of users who choose to receive all kinds of advertising blurb, This is one of the reasons why I did not hunt for "click here" and "if you can't see this email in html". Now correct me i

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John Wilcock
John GALLET a écrit : Any feedback on the results (not enough in corpus, bad rules, good rules, etc.) appreciated. Looking at the rules, I'm worried about false positives on genuine opt-in advertising. I have a number of users who choose to receive all kinds of advertising blurb, so I'll run

Re: hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John Hardin
On Mon, 23 Jun 2008, John GALLET wrote: First of all, thanks to Justin for patiently helping me to install mass-check and pointing me in the right direction. Applause for Justin! This is the sort of thing we need to see for many more specialized spam categories... I will try to run the alg

Re: Fake MX Record(s) Trick

2008-06-23 Thread Diego Pomatta
Marc Ferguson escribió: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop

Re: Fake MX Record(s) Trick

2008-06-23 Thread John Hardin
On Mon, 23 Jun 2008, McDonald, Dan wrote: But I'm not convinced that twiddling with fake MX records will reduce your spam level any. Cue Mr. Perkel... :) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECT

hit frequencies (was Re: [Rule Set proposal] French Rules

2008-06-23 Thread John GALLET
Hi, First of all, thanks to Justin for patiently helping me to install mass-check and pointing me in the right direction. I will try to run the algorithms tonight to see what they come up with. In the meantime, you can find a hit-frequencies report at: http://www.saphirtech.fr/spam/freqs_2008

Re: Channel ordering?

2008-06-23 Thread Justin Mason
Kris Deugau writes: > Is it possible to determine the order channel-originated rulesets will > be loaded in? Or *cause* a specific channel's rules to be loaded after > another? > > I'm looking at creating several local channels for distributing local > rules across the collection of mismatche

Re: Fake MX Record(s) Trick

2008-06-23 Thread Alex Woick
Marc Ferguson schrieb am 20.06.2008 16:38: I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and I have the spamassassin plugin so I'm constantly clicking the "junk" icon.

Re: Fake MX Record(s) Trick

2008-06-23 Thread McDonald, Dan
On Fri, 2008-06-20 at 10:38 -0400, Marc Ferguson wrote: > Hi, > I saw on the wiki a trick to use fake mx records in order to weed out > spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using > Evolution at home and on my laptop and I have the spamassassin plugin > so I'm constantly cli

Re: Fake MX Record(s) Trick

2008-06-23 Thread Matus UHLAR - fantomas
On 20.06.08 10:38, Marc Ferguson wrote: > I'm a linux noob and a spam assassin noob so please reply in simplified > language. Thanks. > > I saw on the wiki a trick to use fake mx records in order to weed out spam ( > http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at > home

Fake MX Record(s) Trick

2008-06-23 Thread Marc Ferguson
Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam ( http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and I have the spamassassin p

prevent to set a score for a non existend rule

2008-06-23 Thread Stefan Jakobs
Hello list, I'm using JM's sought ruleset, but the default score is in my opinion to high. That's why I have the following file: /etc/mail/spamassassin/sought_rules.cf with this content: score JM_SOUGHT_1 2.2 score JM_SOUGHT_2 2.2 score JM_SOUGHT_3

Re: 60_whitelist.cf

2008-06-23 Thread Matus UHLAR - fantomas
On 23.06.08 02:02, [EMAIL PROTECTED] wrote: > I am running spamassassin with postfix via amavisd on a FreeBSD Intel box. > Email from Nintendo's Wii service is getting flagged as spam, despite me > entering it into the whitelist. This seems to be the case with other > unrelated entries that I ha

Re: prefork error

2008-06-23 Thread Matus UHLAR - fantomas
On 20.06.08 13:20, raulbe wrote: > Couple new errors now :( > > config: cannot write to /var/spool/uucp/.spamassassin/user_prefs: No such > file or directory > > > spamd[19476]: spamd: processing message <[EMAIL PROTECTED]> > for uucp:10 there are independent on those you reported before... S

Re: how to stop SPF checks from going past trusted host?

2008-06-23 Thread Matus UHLAR - fantomas
> On Jun 20, 2008, at 11:49 AM, John Hardin wrote: > >10.x is (supposedly) not routable on the public internet. If you see > >10.x (or other RFC-1918) traffic coming in from the world, your ISP > >is broken. On 20.06.08 11:57, Jo Rhett wrote: > Does your ISP filter egress packets on your inter

Re: 60_whitelist.cf

2008-06-23 Thread Benny Pedersen
On Mon, June 23, 2008 08:02, [EMAIL PROTECTED] wrote: > whitelist_from_rcvd [EMAIL PROTECTED] bsaa42453.tk.mesh.ad.jp def_whitelist_auth [EMAIL PROTECTED] whitelist_auth [EMAIL PROTECTED] dont use both since its 2 diff scores, and only use the one that are needed here is the spf http://old.ope