Re: 83MB auto-whitelist?

2009-05-28 Thread Henry Kwan
Karsten Bräckelmann rudersport.de> writes: > On Thu, 2009-05-28 at 10:50 -0400, Kris Deugau wrote: > > > > > > For more info and the script's link see > > > http://markmail.org/message/qqsm35q5bqpbb3in > > > > (For the lazy, the original hack is at > > http://www.deepnet.cx/~kdeugau/spamtool

83MB auto-whitelist?

2009-05-27 Thread Henry Kwan
Just noticed that my AWL is up to 83MB. Not sure if it should be that large so I ran check_whitelist and it removed the single entries but did not compact the file. I then checked the SA site and it said to use sa-awlUtil but I can't find this utility on my system. Was it included in the standar

Re: Moving ham/spam from Exchange folders to sa-learn?

2008-06-20 Thread Henry Kwan
James Wilkinson aprilcottage.co.uk> writes: > Henry Kwan wrote: > > > Thanks for the script but I don't think I can use it as Exchange2K7 > > has dropped IMAP support for public folders. Or least this blog post > > from MSFT seems to indicate: > > > &g

Re: Moving ham/spam from Exchange folders to sa-learn?

2008-06-19 Thread Henry Kwan
Martin.Hepworth solidstatelogic.com> writes: > > Henry > > Make sure the spam/ham folders are imap folders. Make sure they drag the messages into that folder and not > email them as it'll muck up the headers otherwise. > > Then grab a perl script (heck here's one below) to get messages from th

Moving ham/spam from Exchange folders to sa-learn?

2008-06-19 Thread Henry Kwan
Hi, Currently running SA 3.25 via MailScanner frontend (CentOS5 box in the DMZ) to Exchange2K7. Have setup two public folders for users to dump spam/ham in. What's the usual way of moving these messages back to SA for learning? The volume isn't that high so if there was a way to convert .MSG t

Re: Configuring SA as frontend to Exchange

2008-04-10 Thread Henry Kwan
Vidar Tyldum Hansen tyldum.com> writes: > I'm just doing a rough summary of my process on 2007: > - Use LDAP to check the recipients against Exchange/AD > (remember the proxyAddress attribute) > - On the SA-machine I use Postfix and header_checks after the message > is scanned by amavi

Configuring SA as frontend to Exchange

2008-04-09 Thread Henry Kwan
Hi, Have been running SA on CentOS for a few years now and everything has been working great. But the powers that be want to move to Exchange so I am trying to plan a SA frontend that feeds the Exchange server. As I was thinking over how SA works now and how it might work in the my future setup

Re: How to skip checking emails over a certain size?

2008-01-17 Thread Henry Kwan
Theo Van Dinter apache.org> writes: > > > > spamd[2492]: razor2: razor2 check failed: razor2: razor2 had unknown error > > during check at > > /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Plugin/Razor2.pm line 211, > > line 1. at > > /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Plugin/R

Re: How to skip checking emails over a certain size?

2008-01-10 Thread Henry Kwan
Rick Macdougall ummm-beer.com> writes: > > man spamc > > -s max_size, --max-size=max_size Ah, I didn't realize there was a built in limiter. I tried searching the wiki but I guess my search terms weren't right. So it's just a matter of throwing this: -s 256000 into /etc/mail/spama

How to skip checking emails over a certain size?

2008-01-10 Thread Henry Kwan
Hi, Is there a way to have SA skip messages over a certain size? I tried using this procmailrc recipe: :0fw * < 256000 | /usr/bin/spamc But it resulted in this error: spamd[2492]: razor2: razor2 check failed: razor2: razor2 had unknown error during check at /usr/lib/perl5/site_perl/5.8.5/Mail/

Switching from local delivery to relay for Exchange?

2007-10-04 Thread Henry Kwan
Hi, I'm currently running SA 3.23 on a CentOS 4.5 with sendmail-8.13 box and it's happily filtered spam for a few years now. But we are now looking into acquiring an Exchange server so I was wondering if I can switch from local delivery of mail to relaying it downstream to the Exchange server.

Re: Problem with SA 3.2.2 upgrade (dcc related?)

2007-07-26 Thread Henry Kwan
Justin Mason wrote: > > > hi -- what spamd command line are you using? > Are you running with "-u root" or similar? > > Hi Justin, The options for spamd are: # Set default spamd configuration. SPAMDOPTIONS="-d -c -m8 -H" Thanks. -- View this message in context: http://www.nabble.com/Pr

Problem with SA 3.2.2 upgrade (dcc related?)

2007-07-25 Thread Henry Kwan
Hi, Am trying to upgrade to the new 3.2.2 and everything looked OK during make/test/install but during operation, I'm getting these errors: Jul 25 13:46:53 boxen spamd[25710]: dcc: check failed: util: setuid 0 to 501 failed! at /usr/lib/perl5/site_perl/5.8.5/Mail/SpamAssassin/Util.pm line 1343.

Re: POPAuth plugin & 3.20?

2007-06-06 Thread Henry Kwan
Daryl C. W. O'Shea wrote: > > Daryl C. W. O'Shea wrote: > > The POPAuth plugin for 3.1 works with 3.2 as long as you configure at > least one trusted_network manually. > > http://wiki.apache.org/spamassassin/POPAuthPlugin > Hi Daryl, Good to know. I only had internal_networks set and not

POPAuth plugin & 3.20?

2007-06-01 Thread Henry Kwan
Hi, I've been running the POPAuth plugin on 3.18 with good results but noticed that 3.20 seems to break it. I tried searching the wiki and didn't see an update to the plugin. Is one needed or did I fubar something during 3.18 to 3.20 upgrade? Am currently running CentOS 4.4 with Perl 5.85. Wi

Re: "Malformed UTF-8 character" errors>

2007-05-29 Thread Henry Kwan
Doc Schneider wrote: > > > Not sure how you're using SA but I commented out every reference to > CIALIS2 and just committed 1.00.11 so should be available within the hour. > > Also running CentOS 4.4 you know you can upgrade to perl 5.8.8 by doing > a 'yum --enablerepo=centosplus update perl'

Re: "Malformed UTF-8 character" errors>

2007-05-29 Thread Henry Kwan
Doc Schneider wrote: > > I just now committed more fixes for 70_sare_obfu.cf, obfu0 and obfu1. > These should be available within the hour. > > Please folks if you have a problem with a rule set from SARE please let > us know what rule it is and what rule set it is in. > Hi Doc, I just updat

Re: "Malformed UTF-8 character" errors>

2007-05-28 Thread Henry Kwan
Loren Wilton earthlink.net> writes: > Perhaps a third answer would be to get the latest versions of the rules > files? > Doc fixed those errors about 5-6 days ago. Hmmm... Thanks for the heads up. I guess sare_adult.cf got updated after my last RulesDuJour run. But it seems that sare_obfu.cf

"Malformed UTF-8 character" errors>

2007-05-25 Thread Henry Kwan
Just updated to 3.20 this week and because everything seem to be working fine, I didn't notice my log files getting bloated (up to 8GB!) by errors like this: Malformed UTF-8 character (unexpected non-continuation byte 0x00, immediately after start byte 0xd 2) in pattern match (m//) at /etc/mail/s

Re: Upgrading to 3.20 from 3.18

2007-05-23 Thread Henry Kwan
AbbaComm.Net abbacomm.net> writes: > I noticed a large difference in scoring "behavior" between the versions > 3.1.8 and 3.2.0 myself. > > Yet, after training bayes and then after a few more days of bayes auto > learn, things seem to have "mostly" cleared up. Ok, I'll check again after a few da

Upgrading to 3.20 from 3.18

2007-05-23 Thread Henry Kwan
Hi, Am running 3.18 on a vanilla CentOS 4 box and tried to upgrade to 3.20. The make/make test/make install cycle went fine but I noticed that the scoring is slightly different between the two version. I sent myself an email and here's how they scored: 3.18: X-Spam-Status: No, score=-104.4 re

Re: Negative AWL on a spam & received from localhost?

2006-12-19 Thread Henry Kwan
Matt Kettler verizon.net> writes: > In this case, the past average for the sender was approximately 7.7 > (spam), this message came in at 11.5 (also spam), so the AWL split the > difference and took off 1.9 points to make it 9.6 (still spam). That's > 100% normal. > > See also: > > http://wiki.

Re: Razor2 errors popping up after change to SA?

2006-12-11 Thread Henry Kwan
John D. Hardin impsec.org> writes: > erm. Are you sure you're running spam*D* from procmail? That's not > correct. Either you run spamd as root as a system service and run > spam*C* (the client) from procmail, or you run spamassassin from > procmail and don't run spamd at all... Hi, Sorry, I w

Razor2 errors popping up after change to SA?

2006-12-11 Thread Henry Kwan
Hi, I was checking on some rule changes that I made to my SA box and noticed that I had misconfigured my /etc/procmailrc by not including "DROPPRIVS=yes" so spamd was running as root. I included "DROPPRIVS=yes" and restarted spamd but then I noticed some razor2 errors popping up: Dec 11 11:52:4

Re: Changing WHITELIST_FROM scoring?

2006-11-13 Thread Henry Kwan
Theo Van Dinter apache.org> writes: > > On Mon, Nov 13, 2006 at 09:28:38PM +0000, Henry Kwan wrote: > > Is there a way to change the scoring for WHITELIST_FROM? > > If there were such a rule, yes. whitelist_from and whitelist_from_rcvd share > USER_IN_WHITELIST. >

Changing WHITELIST_FROM scoring?

2006-11-13 Thread Henry Kwan
Hi, Is there a way to change the scoring for WHITELIST_FROM? I tried to stick this in local.cf: score WHITELIST_FROM -10.0 But got this error when I linted: [12804] warn: config: warning: score set for non-existent rule WHITELIST_FROM Thanks.

Re: Conditional Whitelisting?

2006-11-13 Thread Henry Kwan
Henry Kwan designmedia.com> writes: > I can't seem to get this rule to hit. > > I have this in my local.cf > > whitelist_from_spf * designmedia.com > > But I never see the rule in X-Spam-Status. SPF checking seems > to be working since SPF_HELO_PASS &

Re: Conditional Whitelisting?

2006-11-10 Thread Henry Kwan
Kelson speed.net> writes: > > Henry Kwan wrote: > > Is there a way to conditionally whitelist with SPF? That is, I want all > > addresses from a certain domain to be whitelisted only if it passes SPF. > > whitelist_from_spf does exactly what you need. > > I beli

Re: Conditional Whitelisting?

2006-11-09 Thread Henry Kwan
Kelson speed.net> writes: > > Henry Kwan wrote: > > Is there a way to conditionally whitelist with SPF? That is, I want all > > addresses from a certain domain to be whitelisted only if it passes SPF. > > whitelist_from_spf does exactly what you need. > > I b

Conditional Whitelisting?

2006-11-09 Thread Henry Kwan
Hi, Is there a way to conditionally whitelist with SPF? That is, I want all addresses from a certain domain to be whitelisted only if it passes SPF. Or is there a way to do much the same with another mechanism besides SPF? Thanks.

Re: Enabling/testing SPF?

2006-11-03 Thread Henry Kwan
Ramprasad netcore.co.in> writes: > > spamassassin -D < file 2>&1 | grep -i spf > > check the output > > which MTA do you use ? Your MTA must insert an X-Envelope-From: header > ( or similar ) > > Thanks > Ram > Hi, After some more banging my head against the wall, I discovered that SPF ch

Re: Enabling/testing SPF?

2006-11-03 Thread Henry Kwan
Ramprasad netcore.co.in> writes: > > spamassassin -D < file 2>&1 | grep -i spf > > check the output > > which MTA do you use ? Your MTA must insert an X-Envelope-From: header > ( or similar ) > > Thanks > Ram > > Hi. I'm using sendmail so I see that I have to modify sendmail.cf by addin

Enabling/testing SPF?

2006-11-03 Thread Henry Kwan
Am finally getting around to making SPF records for our domains so naturally I was fiddling with SA to see SPF-checking was enabled. Running 3.17 with Mail-SPF-Query-1.999.1 installed. During "make test", it seemed to pass all 36 tests in "t/spf...ok". But when I do a debu

Re: Network test failing on "make test"?

2006-06-27 Thread Henry Kwan
Henry Kwan designmedia.com> writes: > Failed Test Stat Wstat Total Fail Failed List of Failed > --- > t/dcc.t41 25.00% 2 > t/dnsbl.t 234 17.39% 2 9-11 >

Network test failing on "make test"?

2006-06-22 Thread Henry Kwan
Hi, Running SA 3.1.1 on CentOS 4.3. It's been running fine with Razor and DCC. I noticed that SA 3.1.3 is out and went to download & compile. But when I do a "make test", I get the follow errors with network tests enabled: t/dcc...Not found: dcc report = spam reported

Re: SPF tests fail on 3.02?

2004-12-20 Thread Henry Kwan
Theo Van Dinter kluge.net> writes: > > On Mon, Dec 20, 2004 at 10:46:16PM +0000, Henry Kwan wrote: > > t/spf...Not found: helo_pass = SPF_HELO_PASS > > I checked and v3.01's spf test passed and I don't think I changed anything >

SPF tests fail on 3.02?

2004-12-20 Thread Henry Kwan
ailed test 2 in t/SATest.pm at line 530 fail #2 t/spf...FAILED tests 1-2 Failed 2/2 tests, 0.00% okay I checked and v3.01's spf test passed and I don't think I changed anything so what is 3.02 looking for that's new? Thanks. --Henry Kwan

Re: SpamAssassin failed to parse line, skipping?

2004-11-23 Thread Henry Kwan
Theo Van Dinter kluge.net> writes: > > On Tue, Nov 23, 2004 at 11:42:09AM -0800, Henry Kwan wrote: > > [root beans Mail-SpamAssassin-3.0.1]# spamassassin --lint > > config: SpamAssassin failed to parse line, skipping: num_check_received 5 > > lint: 1 issues detecte

SpamAssassin failed to parse line, skipping?

2004-11-23 Thread Henry Kwan
Hi. Just upgraded from 2.64 to 3.01 and everything seems to working fine except that --lint gives me one error: [EMAIL PROTECTED] Mail-SpamAssassin-3.0.1]# spamassassin --lint config: SpamAssassin failed to parse line, skipping: num_check_received 5 lint: 1 issues detected. please rerun with de

Re: Still running as root?

2004-09-14 Thread Henry Kwan
the tip. I looked on the wiki and in the readme file for spamd but didn't see it there. --Henry Kwan P.S. On my other machine, I run some other procmail recipes and DROPPRIVs already was buried in one of those scripts which was why it worked on that machine.

Still running as root?

2004-09-13 Thread Henry Kwan
/usr/bin/spamd -d -c -a -m5 -H Machine 2 (new install): 15886 1 0 14:21 ?00:00:03 /usr/bin/spamd -d -c -a -m5 -H They both invoke spamd from /etc/procmailrc: :0fw | /usr/bin/spamc Anybody run into this issue before? Thanks. --Henry Kwan

MIME_HEADER_CTYPE_ONLY?

2004-09-10 Thread Henry Kwan
Hi. A friend of mine runs a website which allows users to email each other using a form but the email that gets spit out triggers a few of SA's rules. The main culprit seems to be MIME_HEADER_CTYPE_ONLY along with a few others so the total score is around 6-ish, which is just enough to kick it