On Thu, 2009-03-26 at 19:26 -0700, asimsinan wrote:
> Sorry forgot to add the headers. That is strange.
> mine only has
>2.1 SUBJ_ALL_CAPS Subject is all capitals
> * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable
> relay lines
> * 0.0 HTML_MESSAGE BODY: H
Neil Schwartzman wrote:
>
> Say one is using Postfix and needs SA in front of ~15 aliases. How
> long should this take?
That depends mostly on how you want to integrate SA into postfix.
Installing SA itself should take about an hour if you've never done it
before. Most of that will be reading the
Sorry forgot to add the headers. That is strange.
mine only has
2.1 SUBJ_ALL_CAPS Subject is all capitals
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable
relay lines
* 0.0 HTML_MESSAGE BODY: HTML included in message
What changes should I make to get the
Benny Pedersen wrote:
> On Thu, March 26, 2009 13:22, The Doctor wrote:
>
>> All right then this is really odd!!!
>> The person has always sent me mail from the intranet no problem.
>> I just updated the perl to 5.10.0 threading
>> and then I am like how did AWL change?
>>
>
> spammers begi
On Thu, 2009-03-26 at 19:01 -0700, confusingly, a different anonymous
Nabble user wrote:
> Thank you. Here is a sample spam email
>
> http://pastebin.com/m7f0d60b1
That does not show your SA headers. Anyway, here's mine. Enjoy.
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06
The Doctor wrote:
>
> Key on the word intranet. This sender is from inside the LAN.
>
> This sender should be score -1000 on the AWL and not +30.
>
This is 100% wrong. You're fundamentally thinking of the AWL as a
whitelist. Obviously, you've failed to read the wiki.
The AWL is not a whitelist
Thank you. Here is a sample spam email
http://pastebin.com/m7f0d60b1
Karsten Bräckelmann-2 wrote:
>
> On Thu, 2009-03-26 at 18:43 -0700, the same anonymous Nabble user wrote:
>> But the problem is I know that the email is absolutely spam. It should
>> identify it as spam. And for some spam ema
On Thu, 2009-03-26 at 18:43 -0700, the same anonymous Nabble user wrote:
> But the problem is I know that the email is absolutely spam. It should
> identify it as spam. And for some spam emails, it gives low scores like 1.8,
> 0.3. Should I accept them as false negatives?
Now this is an entirely d
But the problem is I know that the email is absolutely spam. It should
identify it as spam. And for some spam emails, it gives low scores like 1.8,
0.3. Should I accept them as false negatives?
--
View this message in context:
http://www.nabble.com/Spamc-giving-different-scores-tp22734449p227346
On Thu, 2009-03-26 at 18:15 -0700, an anonymous Nabble user wrote:
> I ran spamc a couple of times. It sometimes gives different scores for same
> email. Sometimes it gives higher than 5,sometime lower. What can be wrong?
Can't tell, unless you provide the SA headers for the first and last
run. Ho
On Thu, 2009-03-26 at 17:22 -0700, Kenneth Porter wrote:
> I'd like to score anything in Windows-1251 fairly high, as I don't expect
> to get anything legitimate in that charset. How can I read the charset
> declared in a Subject header, or in a MIME part, for matching in a rule?
ok_locales en
On Thu, 26 Mar 2009 18:15:01 -0700 (PDT), asimsinan
wrote:
>
> I ran spamc a couple of times. It sometimes gives different scores for
> same
> email. Sometimes it gives higher than 5,sometime lower. What can be
wrong?
> --
> View this message in context:
>
http://www.nabble.com/Spamc-giving-diffe
I ran spamc a couple of times. It sometimes gives different scores for same
email. Sometimes it gives higher than 5,sometime lower. What can be wrong?
--
View this message in context:
http://www.nabble.com/Spamc-giving-different-scores-tp22734449p22734449.html
Sent from the SpamAssassin - Users
Say one is using Postfix and needs SA in front of ~15 aliases. How long
should this take?
--
Neil Schwartzman
Director, Accreditation Security & Standards
Certified | Safelist
Return Path Inc.
0142002038
Guido,
> I am trying to configure my system that it can assign user specific
> scores. I therefore set up a table like described in [1]. This runs fine,
> as long as I use spamc to scan mails.
>
> But actually I want to use Amavisd-new using spamassassin. Here
> spamassassin complety ignores the s
On Thursday, March 26, 2009 8:34 PM -0400 Jeff Mincy
wrote:
Try Subject:raw to inhibit decoding?
Thanks! I figured there must be some fine print I was missing.
From: Kenneth Porter
Date: Thu, 26 Mar 2009 17:22:21 -0700
I'd like to score anything in Windows-1251 fairly high, as I don't expect
to get anything legitimate in that charset. How can I read the charset
declared in a Subject header, or in a MIME part, for matching in a rule?
I'd like to score anything in Windows-1251 fairly high, as I don't expect
to get anything legitimate in that charset. How can I read the charset
declared in a Subject header, or in a MIME part, for matching in a rule?
The only tools I see are ok_locales and CHARSET_FARAWAY, but those seem
like
From: Bowie Bailey
Date: Thu, 26 Mar 2009 12:07:23 -0500
Jeff Mincy wrote:
>
>If I'm reading the spamc man page correctly, it will wait 5
>minutes for spamd to process the message, but it will only wait
>about 3 seconds for a connection to spamd (3 tries with
mx1# /usr/local/bin/spamd --allow-tell --vpopmail --username=spamd
--socketpath=/tmp/spamd.sock --debug all
[96985] dbg: logger: adding facilities: all
[96985] dbg: logger: logging level is DBG
[96985] dbg: logger: trying to connect to syslog/unix...
[96985] dbg: logger: opening syslog with unix so
- Original Message -
From: "Kris Deugau"
To: "SpamAssassin Users List"
Sent: Thursday, March 26, 2009 4:04 PM
Subject: Re: Suggestions on Rules and SA config location in Plesk?
Dave Duffner wrote:
OK, apparently when I had an Ensim box it was long ago in a land
far, far away wit
On Thu, 26 Mar 2009, Kenneth Porter wrote:
On Thursday, March 26, 2009 8:10 AM -0700 John Hardin
wrote:
That too is unusual enough to be a good spam sign. There are also
existing rules for high image-to-text ratios.
I wonder if tag-to-text ratio is a good spam sign? Another possible
adv
On Thursday, March 26, 2009 8:10 AM -0700 John Hardin
wrote:
That too is unusual enough to be a good spam sign. There are also
existing rules for high image-to-text ratios.
I wonder if tag-to-text ratio is a good spam sign? Another possible
advantage of having a tag-parsing plugin.
Dave Duffner wrote:
OK, apparently when I had an Ensim box it was long ago in a land
far, far away with a 2.5.X version of SA. So I'm used to that setup,
not what I was just finally decoded to understand is the deal with
Plesk's 3.2.4 version! Maddening!
So two parts:
#1 - I now final
On Thu, 26 Mar 2009, Nuno Fernandes wrote:
I have the following configuration in spamassassin:
whitelist_from *...@domain.com
Bad idea. That's trivially forgeable by spammers. whitelist_from is a last
resort. You should use whitelist_from_*, which aren't easily spoofable.
unwhitelist_from
Hi,
I have the following configuration in spamassassin:
whitelist_from *...@domain.com
unwhitelist_from market...@domain.com
Using debug i can see:
[26305] dbg: eval: all '*From' addrs: market...@domain.com
[26305] dbg: rules: address market...@domain.com matches whitelist or
blacklist regexp:
On Thu, Mar 26, 2009 at 05:18:07PM +0100, Karsten Bräckelmann wrote:
> On Thu, 2009-03-26 at 14:17 +, Arthur Dent wrote:
> > On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
>
> > > Is it possible to get spamassassin to score email addresses with 4 (or
> > > more) nume
On Thu, March 26, 2009 17:26, Chris Barnes wrote:
> I tried that. Didn't seem to help. I think I'll go ahead and just
> rm the files.
rm = Read Manuals ? :=)
--
http://localhost/ 100% uptime and 100% mirrored :)
Jeff Mincy wrote:
>
>If I'm reading the spamc man page correctly, it will wait 5
>minutes for spamd to process the message, but it will only wait
>about 3 seconds for a connection to spamd (3 tries with 1 second
>sleep between them). That's not much of a queue. Or am I missing
>
On Thu, 2009-03-26 at 12:07 -0400, spamassas...@corwyn.net wrote:
> At 11:19 AM 3/26/2009, John Hardin wrote:
> >On Thu, 26 Mar 2009, spamassas...@corwyn.net wrote:
> > >(seems like a lot of our spam comes in for garbage users with user
> > >names that are strings of numbers).
> >
> > ...your MTA
John Hardin wrote:
> On Thu, 26 Mar 2009, Bowie Bailey wrote:
>
> > spamassas...@corwyn.net wrote:
> > > Is it possible to get spamassassin to score email addresses with 4
> > > (or more) numeric digits in sequence in the user name?
> >
> > header BB_NUMERIC_EMAIL To:addr =~ /\d{4...@]*@/
> > des
Greetings,
OK, apparently when I had an Ensim box it was long ago in a land
far, far away with a 2.5.X version of SA. So I'm used to that setup,
not what I was just finally decoded to understand is the deal with
Plesk's 3.2.4 version! Maddening!
So two parts:
#1 - I now finally know wher
From: Bowie Bailey
Date: Thu, 26 Mar 2009 09:55:45 -0500
Jeff Mincy wrote:
>From: Bowie Bailey
>Date: Thu, 26 Mar 2009 08:48:30 -0500
>
>Brian J. Murrell wrote:
>> On Wed, 2009-03-25 at 15:01 -0400, Michael Scheidell wrote:
>> >
>> > Matc
Benny Pedersen wrote:
> On Thu, March 26, 2009 13:22, The Doctor wrote:
> > All right then this is really odd!!!
> > The person has always sent me mail from the intranet no problem.
> > I just updated the perl to 5.10.0 threading
> > and then I am like how did AWL change?
>
> spammers begin to use
On Thu, 26 Mar 2009, Bowie Bailey wrote:
spamassas...@corwyn.net wrote:
Is it possible to get spamassassin to score email addresses with 4
(or more) numeric digits in sequence in the user name?
header BB_NUMERIC_EMAIL To:addr =~ /\d{4...@]*@/
describe BB_NUMERIC_EMAIL Recipient address has 4
Ah, finally, with 1-2 hours delay...
On Thu, 2009-03-26 at 16:03 +0100, Karsten Bräckelmann wrote:
> On Thu, 2009-03-26 at 09:40 -0400, spamassas...@corwyn.net wrote:
> > Is it possible to get spamassassin to score email addresses with 4
> > (or more) numeric digits in sequence in the user name?
Matus UHLAR - fantomas wrote:
No, I don't still have the messages that were incorrectly trained.
So... it appears that wiping out the bayes database is the way to go.
One final question for this then: is there a "sa-learn" option I should
use for this, or is doing a simple "rm bayes*" in the .
On Thu, 2009-03-26 at 14:17 +, Arthur Dent wrote:
> On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
> > Is it possible to get spamassassin to score email addresses with 4 (or
> > more) numeric digits in sequence in the user name?
> If you use procmail before spamassa
At 11:19 AM 3/26/2009, John Hardin wrote:
On Thu, 26 Mar 2009, spamassas...@corwyn.net wrote:
(seems like a lot of our spam comes in for garbage users with user
names that are strings of numbers).
...your MTA should _not_ be accepting invalid recipient addresses
for delivery. Fix your MTA con
On Thu, 26 Mar 2009, Arthur Dent wrote:
On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
Is it possible to get spamassassin to score email addresses with 4 (or
more) numeric digits in sequence in the user name?
(seems like a lot of our spam comes in for garbage users wi
On Thu, March 26, 2009 13:22, The Doctor wrote:
> All right then this is really odd!!!
> The person has always sent me mail from the intranet no problem.
> I just updated the perl to 5.10.0 threading
> and then I am like how did AWL change?
spammers begin to use your friends email addr as sender,
On Thu, March 26, 2009 10:57, Bogdan ?ulibrk wrote:
> "hi m8, here is Bob's email I've mentioned you on today on coffee
> break mailto:b...@yahoo.com";.
gmail uses dkim/spf so whitelist users based on it
freemail hit, but scores default 0.5, and only score more if in body
or reply-to use another
On Thu, March 26, 2009 09:44, JC Putter wrote:
> i am getting spam from google groups
> my only is is 0.5 FREEMAIL_FROM
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com;
> s=s1024; t=1238042388;
dont abuse google, its dkim signed at yahoo.com :)
--
http://localhost/ 100% upti
On Thu, March 26, 2009 01:22, The Doctor wrote:
> All right why is AWL going to score 30+ when it was told to go to
> -1000 as in
> score AWL -1000
AWL cant be static assigned with score
--
http://localhost/ 100% uptime and 100% mirrored :)
On Thu, 26 Mar 2009, spamassas...@corwyn.net wrote:
Is it possible to get spamassassin to score email addresses with 4 (or
more) numeric digits in sequence in the user name?
Yes, however...
(seems like a lot of our spam comes in for garbage users with user names
that are strings of numbers).
On Thu, 26 Mar 2009, Justin Mason wrote:
On Thu, Mar 26, 2009 at 03:48, John Hardin wrote:
Yeah, the documentation lies. multiline rawbody works just fine in 3.2.x
could someone open a bug to fix this? thanks ;)
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6091
--
John Hardin
On Thu, 26 Mar 2009, haman...@t-online.de wrote:
John Hardin wrote:
If 3.2.x does indeed implement multiline rawbody matches, then we'll be
able to have a robust rule for this - e.g. an HTML email with a table
that has more than 30 columns and more than 5 rows. That will be
difficult to obfu
On Wed, March 25, 2009 17:03, Arvid Ephraim Picciani wrote:
> http://codepad.org/W53onqK9
>
> i gave on this kind of spam. its impossible to train bayes and
> changing
> to fast to make custom rules. matching senders doesnt work either
> becouse those are sent using live.com, gmail, sourceforge,
On Wed, 25 Mar 2009, LuKreme wrote:
On 25-Mar-2009, at 19:29, John Hardin wrote:
If 3.2.x does indeed implement multiline rawbody matches, then we'll be
able to have a robust rule for this - e.g. an HTML email with a table that
has more than 30 columns and more than 5 rows. That will be diffic
On 26.03.09 09:40, spamassas...@corwyn.net wrote:
> Is it possible to get spamassassin to score email addresses with 4
> (or more) numeric digits in sequence in the user name?
yes, simple header rule should take care of that. But beware of
false-positives. there are already similar rules in the S
On Thu, 2009-03-26 at 09:40 -0400, spamassas...@corwyn.net wrote:
> Is it possible to get spamassassin to score email addresses with 4
> (or more) numeric digits in sequence in the user name?
Sure...
> (seems like a lot of our spam comes in for garbage users with user
> names that are strings o
Jeff Mincy wrote:
>From: Bowie Bailey
>Date: Thu, 26 Mar 2009 08:48:30 -0500
>
>Brian J. Murrell wrote:
>> On Wed, 2009-03-25 at 15:01 -0400, Michael Scheidell wrote:
>> >
>> > Match your MTA processes to the spamd children. Your MTA will
>send > > 4xx 'busy now, come
On Thu, 2009-03-26 at 10:44 +0200, JC Putter wrote:
> i am getting spam from google groups
Oh, come on -- feel free to actually talk to us, mention details, and
maybe even ask a real question... ;)
[snipp headers]
Please do NOT paste raw messages, snippets or full headers here. Please
DO use a
spamassas...@corwyn.net wrote:
> Is it possible to get spamassassin to score email addresses with 4
> (or more) numeric digits in sequence in the user name?
>
> (seems like a lot of our spam comes in for garbage users with user
> names that are strings of numbers).
#1 - Why are you accepting emai
On 26.03.09 06:55, The Doctor wrote:
> Key on the word intranet. This sender is from inside the LAN.
>
> This sender should be score -1000 on the AWL and not +30.
The most important question from Mark was:
>> Well, was the message really low scoring, despite the +30 AWL score?
you didn't answe
On Thu, 2009-03-26 at 06:55 -0600, The Doctor wrote:
> On Thu, Mar 26, 2009 at 08:45:46AM -0400, Matt Kettler wrote:
> > > > http://wiki.apache.org/spamassassin/AutoWhitelist
> > http://wiki.apache.org/spamassassin/AwlWrongWay
> Key on the word intranet. This sender is from inside the LAN.
>
>
The Doctor wrote:
>
> Key on the word intranet. This sender is from inside the LAN.
This is irrelevant. AWL doesn't care where the mail is coming from. It
only knows that sen...@example.com from XX.XX.XX.XX ip address has an
average spam score of XX. If the next message from that same sender/
From: Bowie Bailey
Date: Thu, 26 Mar 2009 08:48:30 -0500
Brian J. Murrell wrote:
> On Wed, 2009-03-25 at 15:01 -0400, Michael Scheidell wrote:
> >
> > Match your MTA processes to the spamd children. Your MTA will send
> > 4xx 'busy now, come back to play later' message.
On Thu, Mar 26, 2009 at 09:40:34AM -0400, spamassas...@corwyn.net wrote:
> Is it possible to get spamassassin to score email addresses with 4 (or
> more) numeric digits in sequence in the user name?
>
> (seems like a lot of our spam comes in for garbage users with user names
> that are strings of
haman...@t-online.de wrote:
> by the time the detection is ready, you will get the entire message
> as ASCII art inside a or individual letters as ascii art,
> making up a table with one cell for each letter, or the same pattern
> made up of without a table
>
> In the long run we will render
Giampaolo Tomassoni wrote:
> > From: LuKreme [mailto:krem...@kreme.com]
> >
> > On 25-Mar-2009, at 11:24, Giampaolo Tomassoni wrote:
> > > rawbody LARGETABLE
> > > m' > > tr'is
> >
> >
> > Just to be sure my parsing is working correctly, that is flagging if
> > there are 30 or more TDs in a si
Is it possible to get spamassassin to score email addresses with 4
(or more) numeric digits in sequence in the user name?
(seems like a lot of our spam comes in for garbage users with user
names that are strings of numbers).
Thanks!
rick
Rick Steeves
http://www.sinister.net
"The journ
Brian J. Murrell wrote:
> On Wed, 2009-03-25 at 15:01 -0400, Michael Scheidell wrote:
> >
> > Match your MTA processes to the spamd children. Your MTA will send
> > 4xx 'busy now, come back to play later' message. Let the sending
> > MTA queue it back up (or zombies will just go away)
>
> I don
On Wed, March 25, 2009 14:30, Glenn Sieb wrote:
> http://www.wingfoot.org/~ges/spam.txt
> Can't use pastebin or other tools--it gets flagged as spam. :)
super duper :)
--
http://localhost/ 100% uptime and 100% mirrored :)
On Thu, Mar 26, 2009 at 08:45:46AM -0400, Matt Kettler wrote:
> The Doctor wrote:
> > On Wed, Mar 25, 2009 at 10:11:25PM -0400, Matt Kettler wrote:
> >
> >> The Doctor wrote:
> >>
> >>> All right why is AWL going to score 30+ when it was told to go to -1000
> >>>
> >>> as in
> >>>
> >>> sc
The Doctor wrote:
> On Wed, Mar 25, 2009 at 10:11:25PM -0400, Matt Kettler wrote:
>
>> The Doctor wrote:
>>
>>> All right why is AWL going to score 30+ when it was told to go to -1000
>>>
>>> as in
>>>
>>> score AWL -1000
>>>
>> You can't assign static scores to the AWL, this goes a
On Wed, Mar 25, 2009 at 10:11:25PM -0400, Matt Kettler wrote:
> The Doctor wrote:
> > All right why is AWL going to score 30+ when it was told to go to -1000
> >
> > as in
> >
> > score AWL -1000
>
> You can't assign static scores to the AWL, this goes against the
> definition of what it is. It's
> -Original Message-
> From: Bogdan Ćulibrk [mailto:b...@default.rs]
> Sent: Thursday, March 26, 2009 10:58 AM
>
> McDonald, Dan wrote:
> > On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
> >> On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec
> wrote:
> >>> Bogdan,
> >>>
> > The te
McDonald, Dan wrote:
On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec wrote:
Bogdan,
The test is supposed to receive a header as argument, not a body:
thanks for the reply. What I am trying to do is actually have access map
of blacklisted
On Thu, Mar 26, 2009 at 03:48, John Hardin wrote:
> On Wed, 25 Mar 2009, John Hardin wrote:
>
>>> > On Wed, 25 Mar 2009, Giampaolo Tomassoni wrote:
>>> > > So why this actually works to me?
>>> > > > > rawbody LARGETABLE
>>> > >
>>> > > m'>
>> Then the documentation appears to be out of da
On 3/26/2009 9:44 AM, JC Putter wrote:
i am getting spam from google groups
my only is is 0.5 FREEMAIL_FROM
http://www.rulesemporium.com/rules/90_2tld.cf
helps quite a bit
afaik, sa-update will keep it updated via Daryl's channel.
i am getting spam from google groups
my only is is 0.5 FREEMAIL_FROM
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024;
t=1238042388; bh=qIS1L4iJc6kS4EAxGGA7apkYn+LwwewDsELAo62Dcak=;
h=Message-ID:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
b=coeLP
On 25.03.09 11:01, Chris Barnes wrote:
> Thank you for such a good, reasonable answer (it's good to see SOMEONE
> is trying to answer questions with non-flippant responses). :-)
>
> No, I don't still have the messages that were incorrectly trained.
> So... it appears that wiping out the bayes
> -Original Message-
> From: LuKreme [mailto:krem...@kreme.com]
> Sent: Wednesday, March 25, 2009 6:49 PM
>
> On 25-Mar-2009, at 11:24, Giampaolo Tomassoni wrote:
> > rawbody LARGETABLE
> > m' > tr'is
>
>
> Just to be sure my parsing is working correctly, that is flagging if
> there ar
John Hardin wrote:
>
> exactly. they'll just change the html in the next wave. this spam isnt
> new, yet the SA list is once again full of threads about exactly that
> recent wave, becouse old rules dont match.
If 3.2.x does indeed implement multiline rawbody matches, then we'll be
able to ha
75 matches
Mail list logo
