Checking to see if multiple types of headers exist

2010-03-17 Thread Julian Yap
I'm trying to consolidate some rules I have. I'm wondering if there's a way to see if multiple types of headers exist. eg. Currently separate rules: header CMN_LIST_1 exists:X-Campid describe CMN_LIST_1 Mail comes from a common campaign list mailer score CMN_LIST_1 0.5 header CMN_LIST_2 exist

Re: bayes, numbers of tokens and performance

2010-03-17 Thread Mikael Syska
Hi On Thu, Mar 18, 2010 at 1:35 AM, tonjg wrote: > > it's not 'a' spam I'm referring to, it lots of different spams getting > through to my inbox with only 40% of them being identified as spam. Yes, that's awful, I would be killed if that many spams got though our filters What rules does th

Re: bayes, numbers of tokens and performance

2010-03-17 Thread tonjg
it's not 'a' spam I'm referring to, it lots of different spams getting through to my inbox with only 40% of them being identified as spam. This strikes me as a poor success rate. What do you mean by 'crappy mail bayes' ? the bayes learn was done on spam and ham that ended up in my inbox. -- View

Bayes and Plugin Tokens

2010-03-17 Thread RW
The ASN and RelayCountry plugins are supposed to add extra tokens to Bayes. However, I don't see any evidence that this is happening (in 3.3.0). In a test message I see: bayes: header tokens for X-Relay-Countries = " GB GB ** ** GB GB" but don't see any corresponding tokens containing GB I al

Re: bayes, numbers of tokens and performance

2010-03-17 Thread Mikael Syska
Hi, What score does the spam have post it with full header on nomorepasting.com or similar ... then we can try what it hits on out setups ... On Thu, Mar 18, 2010 at 12:47 AM, tonjg wrote: > > I've done a bayes learn on 500 spams and 400 hams, my spam hit threshold is 5 > and I'm getting a

bayes, numbers of tokens and performance

2010-03-17 Thread tonjg
I've done a bayes learn on 500 spams and 400 hams, my spam hit threshold is 5 and I'm getting a success rate of about 40% in identifying spam, and that's after doing an sa-update too. I was hoping to get better results than this. How many spam and ham tokens does SA normally need before it really

Re: [SpamAssassin] 0day spamass-milter again....

2010-03-17 Thread Justin Mason
On Wed, Mar 17, 2010 at 15:07, Daniel Lemke wrote: > Hmm, any comments on this? > > Heise.de just published an article regarding this issue: > http://www.heise.de/newsticker/meldung/Sicherheitsluecke-in-SpamAssasin-Filtermodul-956991.html > > Kind of interesting to me since I >have to< run sa as r

Re: Botnet plugin still relevant?

2010-03-17 Thread RW
On Wed, 17 Mar 2010 17:34:08 -0400 Micah Anderson wrote: > > Hi, > > I've been using the Botnet plugin version 0.8 for some time now, and > the plugin itself has been around since 2003 or so. I'm just curious > to test the waters and see what other's think about the relevance in > 2010 of this

Re: return-path program

2010-03-17 Thread J.D. Falk
On Mar 12, 2010, at 11:20 AM, Alexandre Chapellon wrote: > I would like to know if someone here is part of the returnpath.net > (http://www.returnpath.net/emailserviceprovider/certification/) certification > program? > Does it really increase deliverability of email and to which MSP? > What are

sa-update channels

2010-03-17 Thread Micah Anderson
I'm trying to find out what the current state of the art is for plugins and channel updates. What are people using now days? I just reviewed my plugins and ended up deleting Freemail because it has been pulled into Spamassassin core; removed the postcards plugin because the original source is now

Re: Botnet plugin still relevant?

2010-03-17 Thread John Rudd
Some people need to put in some alternate values for DNS timeouts, but if you've got a local caching name server, you typically don't need that. There aren't any actual bugs in it that I'm aware of, so I haven't released a new version. As I see it, there isn't a need (and that is a somewhat contr

Botnet plugin still relevant?

2010-03-17 Thread Micah Anderson
Hi, I've been using the Botnet plugin version 0.8 for some time now, and the plugin itself has been around since 2003 or so. I'm just curious to test the waters and see what other's think about the relevance in 2010 of this plugin. Does it still contribute in positive ways to your setup? I do not

Re: Low scores

2010-03-17 Thread micah anderson
On Fri, 12 Mar 2010 15:44:21 -1000, Julian Yap wrote: > On Thu, Mar 11, 2010 at 7:58 AM, micah anderson wrote: > > > On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap > > wrote: > > > Just wanted to add that this particular line is incorrect: > > > meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITEL

Re: help with one liners

2010-03-17 Thread Gary
On Wed, Mar 17, 2010 at 07:11:33PM + or thereabouts, Martin Gregorie wrote: > On Wed, 2010-03-17 at 13:26 -0500, Gary wrote: > > Ok, I'll figure out a URI body rule from some examples on the SA website. > > > You're looking at this sort of pattern: > > uri RULENAME /(url1|url2|url3)/i > >

Re: Low scores

2010-03-17 Thread Julian Yap
On Fri, Mar 12, 2010 at 3:44 PM, Julian Yap wrote: > On Thu, Mar 11, 2010 at 7:58 AM, micah anderson wrote: > >> On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap >> wrote: >> > Just wanted to add that this particular line is incorrect: >> > meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITELIST|| >

Re: help with one liners

2010-03-17 Thread Martin Gregorie
On Wed, 2010-03-17 at 13:26 -0500, Gary wrote: > Ok, I'll figure out a URI body rule from some examples on the SA website. > You're looking at this sort of pattern: uri RULENAME /(url1|url2|url3)/i and don't forget to escape dots in the URL ( replace . with \. ), but be warned, this approach ten

Re: [SpamAssassin] 0day spamass-milter again....

2010-03-17 Thread Kai Schaetzl
Daniel Lemke wrote on Wed, 17 Mar 2010 15:07:14 +: > Kind of interesting to me since I >have to< run sa as root under windows ;) spamass-milter runs on Windows? Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: help with one liners

2010-03-17 Thread Gary
Hi Martin, On Wed, 17 Mar 2010 16:35:11 + UTC(3/17/2010, 11:35 AM -0600 UTC my time), Martin Gregorie wrote: >> I have been seeing a lot of spam coming through with just one line of >> spam, and just a URL link to such domains as M> If there's nothing consistent or recognisable in the line o

RE: Upgrading to SpamAssassin 3.3

2010-03-17 Thread R P Herrold
On Wed, 17 Mar 2010, Kaleb Hosie wrote: I do have a test VM so I thought I would go ahead and try out 3.3.0 for now. I ran into a bit of an issue with the NetAddr::IP module. I've installed it but when I try to install the built RPM file it gives me this error: error: Failed dependencies:

RE: Upgrading to SpamAssassin 3.3

2010-03-17 Thread Randal, Phil
How did you install it? From CPAN or via (for example) rpmforge? What does rpm -qa | grep NetAddr tell you? BTW, one other thing necessary with a 3.3.x install is an immediate sa-update to get the rules, which are no longer included in the SA tarball. Cheers, Phil -- Phil Randal | Network

Re: help with one liners

2010-03-17 Thread Martin Gregorie
On Wed, 2010-03-17 at 11:09 -0500, Gary wrote: > I have been seeing a lot of spam coming through with just one line of > spam, and just a URL link to such domains as > If there's nothing consistent or recognisable in the line of spam, or the Subject: and From: headers that you can write a rule for

RE: Upgrading to SpamAssassin 3.3

2010-03-17 Thread Kaleb Hosie
I do have a test VM so I thought I would go ahead and try out 3.3.0 for now. I ran into a bit of an issue with the NetAddr::IP module. I've installed it but when I try to install the built RPM file it gives me this error: error: Failed dependencies: perl(NetAddr::IP) >= 4.000 is needed b

Re: Upgrading to SpamAssassin 3.3

2010-03-17 Thread Dennis B. Hopp
On Wed, 2010-03-17 at 11:35 -0400, Kaleb Hosie wrote: > Hello, > I'm running SA 3.2.5 on CentOS 5.4 and I've noticed that a newer major > release has been released. The server is currently in production so I'm a bit > leery to upgrade. > > Do you feel that it is worth the upgrade to 3.3? Is the

RE: Upgrading to SpamAssassin 3.3

2010-03-17 Thread Randal, Phil
3.3.0 works fine on CentOS 5.4, but 3.3.1 is due out imminently (in the next week or two), so I'd hold back for that. Read the release notes carefully and ensure that 3.3.x's prerequisites are installed. If you have a test VM you can install on, use it. I tested on a CentOS 5.4 VM on my home PC

Upgrading to SpamAssassin 3.3

2010-03-17 Thread Kaleb Hosie
Hello, I'm running SA 3.2.5 on CentOS 5.4 and I've noticed that a newer major release has been released. The server is currently in production so I'm a bit leery to upgrade. Do you feel that it is worth the upgrade to 3.3? Is there anything I should know before I go ahead and upgrade? Thanks f

Re: 0day spamass-milter again....

2010-03-17 Thread Karsten Bräckelmann
On Wed, 2010-03-17 at 15:07 +, Daniel Lemke wrote: > Hmm, any comments on this? It's a bug with the milter, not SA. It is not an issue, if you do not use the -x option with the milter. It also shouldn't be an issue, if you accept mail for known and valid recipients only, IIRC. But others can c

AW: [SpamAssassin] 0day spamass-milter again....

2010-03-17 Thread Daniel Lemke
Hmm, any comments on this? Heise.de just published an article regarding this issue: http://www.heise.de/newsticker/meldung/Sicherheitsluecke-in-SpamAssasin-Filtermodul-956991.html Kind of interesting to me since I >have to< run sa as root under windows ;) -Ursprüngliche Nachricht- Von: B

Re: Filtering eMails with certain subjects

2010-03-17 Thread ram
On Wed, 2010-03-17 at 08:45 +0100, Per Jessen wrote: > Hans-Werner Friedemann wrote: > > > Hi @ all > > > > I have another "Newbee-Question" but i can´t find any information > > about that. > > > > how can I adjust in SA, that eMails with a certain subject > > are listed in my blacklist

Re: Filtering eMails with certain subjects

2010-03-17 Thread Wolfgang Zeikat
Hans-Werner Friedemann wrote: how can I adjust in SA, that eMails with a certain subject are listed in my blacklist and filtered out? Have you read http://wiki.apache.org/spamassassin/WritingRules ? Hope this helps. wolfgang

Re: Filtering eMails with certain subjects

2010-03-17 Thread Per Jessen
Hans-Werner Friedemann wrote: > Hi @ all > > I have another "Newbee-Question" but i can´t find any information > about that. > > how can I adjust in SA, that eMails with a certain subject > are listed in my blacklist and filtered out? > > Thanks for any help! Add this to your ruleset:

Filtering eMails with certain subjects

2010-03-17 Thread Hans-Werner Friedemann
Hi @ all I have another "Newbee-Question" but i can´t find any information about that. how can I adjust in SA, that eMails with a certain subject are listed in my blacklist and filtered out? Thanks for any help!