Re: what's wrong

2014-09-30 Thread Ian Zimmerman
On Tue, 30 Sep 2014 09:47:41 +0200, Matus UHLAR - fantomas wrote: > Do you trust smtp.cesky-hosting.cz? > Even if it's open socks and http proxy server? I wonder if slovensky-hosting.sk does better :-P -- Please *no* private copies of mailing list or newsgroup messages. Local Variables: mode:c

Re: half-OT: please remove spam-markers from subjects

2014-09-30 Thread jdebert
On Mon, 29 Sep 2014 19:19:10 +0200 Reindl Harald wrote: > > Am 29.09.2014 um 19:14 schrieb Nels Lindquist: > > On 9/29/2014 10:54 AM, Reindl Harald wrote: > > > >> please remove markers like [SPAM] if a mesage was flagged before > >> reply - they lead often that a message goes to junk- instead

Re: block invalid From-domains

2014-09-30 Thread Reindl Harald
nevermind - *.tld just works misunderstood the documentation BLOCKED: t...@crap.domain.tld.local FINE:t...@crap.domain.tld.local.com blacklist_from blacklist_from *.119 blacklist_from *.administrator blacklist_from *.admin blacklist_from *.adsl blacklist_from *.arpa blacklist_from *.bac black

block invalid From-domains

2014-09-30 Thread Reindl Harald
Hi today i got a lot of backscatter / spam amplify to my private email after some funny guy decided to forge my sender and Microsoft Exchange still don't get to check the RCPT before accept mail :-( is there a easy way to at least block idiots with a from header like below to save time for enter

Re: Googlasi, blacklotus, etc.

2014-09-30 Thread Axb
On 09/30/2014 10:27 PM, Philip Prindeville wrote: On Sep 30, 2014, at 11:41 AM, David Jones wrote: From: Philip Prindeville Sent: Tuesday, September 30, 2014 12:30 PM To: SpamAssassin Subject: Googlasi, blacklotus, etc. I’m seeing spams like:

Re: Googlasi, blacklotus, etc.

2014-09-30 Thread Philip Prindeville
On Sep 30, 2014, at 11:41 AM, David Jones wrote: > >> >> From: Philip Prindeville >> Sent: Tuesday, September 30, 2014 12:30 PM >> To: SpamAssassin >> Subject: Googlasi, blacklotus, etc. > >> I’m seeing spams like: > >> http://pastebin.com/XXQrNURW >

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread John Hardin
On Tue, 30 Sep 2014, terrygalant.li...@fastest.cc wrote: Chatting in #zimbra about this with one of their main devs, DEV: SA config in 8.0.x and previous is an utter mess ME: Oh, ipgrade to 8.5 to save headaches? DEV: yeah, except spam training is broken in 8.5 for other reasons... DEV: altho

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread terrygalant . lists
Chatting in #zimbra about this with one of their main devs, DEV: SA config in 8.0.x and previous is an utter mess ME: Oh, ipgrade to 8.5 to save headaches? DEV: yeah, except spam training is broken in 8.5 for other reasons... DEV: although it's trivial to fix DEV: https://bugzilla.zimbra.com/sh

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread John Hardin
On Tue, 30 Sep 2014, terrygalant.li...@fastest.cc wrote: This is looking like a ZImbra-specific issue. Is it? Seems to be. It doesn't seem to be processing the learning corpora mailboxes. Is that process scheduled or real-time? If scheduled, is the schedule broken? MANUALLY FORGET, SYN

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread John Hardin
On Tue, 30 Sep 2014, terrygalant.li...@fastest.cc wrote: On Tue, Sep 30, 2014, at 10:57 AM, John Hardin wrote: Did you run the above as user zimbra? This time it is, su - zimbra $ /opt/zimbra/libexec/sa-learn --dbpath /opt/zimbra/data/amavisd/.spamassassin --dump magic 0.000 0

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread terrygalant . lists
This is looking like a ZImbra-specific issue. Is it? MANUALLY FORGET, SYNC, DUMP /opt/zimbra/libexec/sa-learn -D \ -p /opt/zimbra/conf/sa/sausers.cf \ --dbpath /opt/zimbra/data/amavisd/.spamassassin \ --siteconfigpath /opt/zimbra/conf/spamassassin \ --

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread terrygalant . lists
Hi On Tue, Sep 30, 2014, at 10:57 AM, John Hardin wrote: > > http://wiki.zimbra.com/wiki/Zimbra_MTA#Anti-Spam_Training_Filters > > Okay, since it's a packaged solution most of my concerns don't apply. I > would assume Zimbra would internally be Doing the Right Thing. Which is primarily why I u

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread John Hardin
On Tue, 30 Sep 2014, terrygalant.li...@fastest.cc wrote: Hi John On Tue, Sep 30, 2014, at 10:11 AM, John Hardin wrote: How are you training your Bayes database? By submitting the emails to a spam-training email address @ my Zimbra server, http://wiki.zimbra.com/wiki/Zimbra_MTA#Anti-Spam_Tr

Re: Googlasi, blacklotus, etc.

2014-09-30 Thread David Jones
> > From: Philip Prindeville > Sent: Tuesday, September 30, 2014 12:30 PM > To: SpamAssassin > Subject: Googlasi, blacklotus, etc. > I’m seeing spams like: > http://pastebin.com/XXQrNURW > Notice: > * the message is almost always text/plain single part

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread Amir Caspi
On Sep 30, 2014, at 11:11 AM, John Hardin wrote: > How are you training your Bayes database? > > How much have you trained it? It requires a certain minimum amount of both > spam *and* ham before it starts evaluating messages. I have a significantly trained DB and I get the same thing... lots

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread terrygalant . lists
Hi John On Tue, Sep 30, 2014, at 10:11 AM, John Hardin wrote: > How are you training your Bayes database? By submitting the emails to a spam-training email address @ my Zimbra server, http://wiki.zimbra.com/wiki/Zimbra_MTA#Anti-Spam_Training_Filters > How much have you trained it? It requires

Googlasi, blacklotus, etc.

2014-09-30 Thread Philip Prindeville
I’m seeing spams like: http://pastebin.com/XXQrNURW Notice: * the message is almost always text/plain single part; * the only Received: line is the local one, even though it was received on port 25; * the message id contains the string be2aaf2163fd72c9975ec76b00288831, which seems to be a SHA1

Re: many spam getting scored as BAYES_50 -> 'unsure' or 'untrained'. What's broken, and how do I fix it?

2014-09-30 Thread John Hardin
On Tue, 30 Sep 2014, terrygalant.li...@fastest.cc wrote: I use SA spamassassin -V SpamAssassin version 3.4.0 running on Perl version 5.14.2 but in almost ALL cases, report BAYES_50=0.8 How do I fix it? How are you training your Bayes databa

Re: what's wrong

2014-09-30 Thread RW
On Mon, 29 Sep 2014 20:16:28 +0200 A. Schulze wrote: > I wonder why RCVD_IN_SORBS_HTTP and RCVD_IN_SORBS_SOCKS fire up. > https://wiki.apache.org/spamassassin/Rules/RCVD_IN_SORBS_SOCKS tell me >This check tests the IP address of the *last untrusted relay* > > for me the last untrusted relay *

Re: Spamassasin not as effective anymore

2014-09-30 Thread Reindl Harald
Am 30.09.2014 um 02:40 schrieb Lorenzo Thurman: > I looked at those emails again and tried to resolve the sender’s addresses > (dig -x z.z.z.z). They don’t resolve to > valid hostnames, which means they should even reach SA. Postfix should reject > them outright. I’ve changed a couple > of postf

Re: what's wrong

2014-09-30 Thread A. Schulze
Matus UHLAR - fantomas: Do you trust smtp.cesky-hosting.cz? Even if it's open socks and http proxy server? No, I don't. But I initially wonder why sa looked up the external submission host while docu say "last untrusted relay" which it isn't. Andreas

Re: what's wrong

2014-09-30 Thread Matus UHLAR - fantomas
On 29.09.14 20:16, A. Schulze wrote: today I was pointed to a message with these headers: X-Spam-Score: 6.789 X-Spam-Status: Yes, score=6.789 tag=-999 tag2=5 kill=6 tests=[HTML_MESSAGE=0.001, MISSING_MIMEOLE=1.843, RCVD_IN_SORBS_HTTP=2.499, RCVD_IN_SORBS_SOCKS=2.443] Received: from