Re: sa-learn and delete email

2008-07-22 Thread Mike Jackson
Im using freebsd, postfix and spamassassin. I made a script that runs once every night and scans my imap spam folder for emails and if there is any i run sa-learn --spam on the email. My question is, after i scan the email, can i delete the email? Sure, just put it into your script to delete t

Re: MySQL my.cnf file for innodb

2008-05-19 Thread Mike Jackson
Just looking for some my.cnf example files for SA. Server has 4 gigs of ram, dual core CPU. What do I want in my my.cnf file? locate my-huge.cnf :-)

Re: {SPAM?} Many False Positives

2008-03-26 Thread Mike Jackson
Hi, I have an issue where much of my site's incoming mail is being tagged as {SPAM?} when it's not. You're using MailScanner. It's probably in there. Look if you're still using ORDB. :-)

Re: SA-UPDATE How often new updates?

2008-03-24 Thread Mike Jackson
00 * * * * /usr/bin/sa-update --gpgkey 6C6191E3 --channel sought.rules.yerp.org --gpgkey D1C035168C1EBC08464946DA258CDB3ABDE9DC10 --channel saupdates.openprotect.com --channel updates.spamassassin.org --allowplugins Am I missing anything? Beside the other comments, throw something like

Re: [OT] Yahoo Deferred

2008-02-28 Thread Mike Jackson
Not "nearly impossible." I work daily with people who run servers exactly like that, yet spam of all sorts is spewing from their mail queues. Most of the ones I see are SMTP accounts with weak passwords. The spammers authenticate as the users and bam, the server is a spam source. With Exim this

Re: [OT] Yahoo Deferred

2008-02-28 Thread Mike Jackson
I have heavy issues with HOTMAIL since they reject ANY legitim messages as SPAM without any reason. All of my 50 Servers are worldwide and in different subnets. It is nearly impossible that all 50 Servers have spamed HOTMAIL, since my servers accept only authenticated SMTP from clients. Not "n

Re: spamassassin eating lot of RAM

2008-01-14 Thread Mike Jackson
My server has 8GB of ram, around 4 GB is currently used by spamassassin (too many process of /usr/bin/perl -T /usr/local/psa/admin/sbin/spammng -c -C --max-children=1 start). Is this normal? Can I somehow limit the process concurrency of spamassassin or I could limit the amount of RAM it consu

Re: What MTAs to spammers (not) use?

2008-01-10 Thread Mike Jackson
Just a thought. I'm wondering if there are any clues the th received lines that indicate the MTA that might be used for spam detection, or rather ham detection. Do spammers ever use Exim, Qmail, Postfix? Yes, when they compromise someone's SMTP authentication and send with whatever they're usi

Re: Developing a Bayes corpus...

2007-12-18 Thread Mike Jackson
Some approaches I've taken: * Set the autolearn thresholds low enough that most messages would be learned. Not as accurate as human learning, but requires little effort. * Set the minimum and maximum messages learned settings down to about 50 from their default 200. Not as accurate, but requi

Re: Forward Conformed Reverse DNS troubleshooting tool

2007-11-29 Thread Mike Jackson
http://ipadmin.junkemailfilter.com/rdns.php You might want to bookmark this page. Try it out and see if your RDNS is really correct. Or another tool from someone who's not trying to sell you something: http://www.boxcheck.com/ Use the "3-way" check from the middle drop-down. It also confirms

AWL: what would happen if...

2007-10-16 Thread Mike Jackson
I work for a large managed hosting company. One of my fellow techs saw a customer put the following in their /etc/mail/local.cf: score AWL -100 He asked me (I have a reputation as the local SA "expert") what would happen, and I couldn't figure it out. I figure it would either override the dyn

Re: FW: {Spam? Craig} Symantec Mail Security detected that you sent a message with an unscannable attachment or body(SYM:37368083501226969515)

2007-10-04 Thread Mike Jackson
Anyone else getting these when they post? Check the Received headers. There's no server that doesn't have a dweezil.us hostname. It never left your network.

Re: Question - How many of you run ALL your email through SA?

2007-08-16 Thread Mike Jackson
As opposed to preprocessing before using SA to reduce the load. (ie. using blacklist and whitelist before SA) SMTP -> Sendmail, which uses these to reject: GreetPause RBL: zen.spamhaus.org RBL: dynablock.njabl.org RBL: dsn.rfc-ignorant.org RBL: bogusmx.rfc-ignorant.org RBL: bl.

Re: Spamassassin: Best Practices

2007-04-23 Thread Mike Jackson
1) How can we train the spamassassin using bayesian to FILTER ALL OUTGOING AS WELL AS INCOMING messages from my server. That depends on your MTA. Some make it easy (Postfix), some make it difficult (Sendmail), some you just shouldn't be using (Qmail). (That last one was a joke, people.) 2)

Re: Is Bayes Dead? Have the spammers won?

2007-03-23 Thread Mike Jackson
/me continues to wait for the spammers to tire of greylisting I work for a managed hosting provider, and I have seen spam messages get back customers' greylisting setups. It may be isolated, but some spammers are already starting to work around it.

Re: Make Bayes more efficient?

2007-03-10 Thread Mike Jackson
Thanks for everyone's suggestions. I've taken most of them and done some other tuning; I'll have to wait and see how much things have improved. If they haven't improved much, I'll be back on Monday. :) I'm a little late to the party, and this is sorta off-topic, but you may want to check this

Re: help a journalist: What do you wish the CIO understood about fighting spam? (fwd)

2007-01-31 Thread Mike Jackson
***If you could get your CIO (or top management) to understand one thing, just ONE thing, about fighting spam, what would it be?*** This sounds too fatalistic, but I have one simple thing I wished people understood: You cannot stop all spam, at least not without causing collateral damage to

can you trust the MX?

2007-01-29 Thread Mike Jackson
Before my actual question, here's a little background. Right now, I see how pointless SPF is; few domains publish records, even fewer MTAs running in the wild use SPF to accept/reject mail. When I look at the SPF scoring on my server (where I'm running an SPF milter for Sendmail), most of the ma

Re: Should I use greylisting

2007-01-29 Thread Mike Jackson
Until the spammers build in retry into their bots, I'm a firm believer of greylisting. They have. I'm a sys admin at a major hosting provider, and I've seen it in action on at least one customer's box who was using greylisting. Considering spammers have near-infinite resources, it was only a m

Re: Should I use greylisting

2007-01-27 Thread Mike Jackson
Until the spammers build in retry into their bots, I'm a firm believer of greylisting. They have. I'm a sys admin at a major hosting provider, and I've seen it in action on at least one customer's box who was using greylisting. Considering spammers have near-infinite resources, it was only a m

Re: How to examine a system and determine the mail delivery agent.

2006-12-05 Thread Mike Jackson
How would, where would a mail transfer agent tell you the mail delivery agent for a the system at hand?... Just connect to port 25 and observe the banner. Not 100% foolproof, but most of them either identify themselves (Sendmail) or have a recognizable banner (Postfix, Qmail, Exchange).

Re: Help for old-school SA?

2006-12-01 Thread Mike Jackson
First thing: find the patch for the URIBL rules and get that enabled. It will probably catch 90% of the spam making it through. Thanks for the suggestions. Actually, I was mistaken; the server that prompted this request had 2.61 installed. I upgraded him to 2.64, and tracked down the SpamCopU

Help for old-school SA?

2006-12-01 Thread Mike Jackson
I work for a large hosting provider. Some of our hosting accounts are (effectively) stuck using SA 2.63, since they are using older Redhat installs coupled with older versions of the Plesk control panel. (Why stuck? Because Plesk and ES2.1 won't recognize post-2 versions, provide proper startup

Re: The Future of Email is SQL

2006-06-12 Thread Mike Jackson
I can't recall seeing any mention in this thread of DBmail (dbmail.org), which already exists and is an all-in-one SMTP/POP3/IMAP server with MySQL or Postgres message storage (with support for SQLite on the way). It's been in development for three or four years, and from what I remember is used

Re: Why does this rule not hit?

2006-06-09 Thread Mike Jackson
Did you restart whatever service does the spam filtering after you added the rule? - Original Message - From: "Rosenbaum, Larry M." <[EMAIL PROTECTED]> To: Sent: Friday, June 09, 2006 12:04 Subject: Why does this rule not hit? Why does this rule: body ORNL_STOCKT_N2 /H o l l

Re: unsubscribe

2006-05-25 Thread Mike Jackson
Yes, I've received this communication in error. A unsubscribe command never goes to the list. It goes to the unsubscribe address specified in the headers, in this case: It's odd... I think it's been 7 or 8 years since I used a mailing list where subscribe/unsubscribe commands were supposed to

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Mike Jackson
Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create too many false positives. You cannot trust any of the rfc-ignorant.org lists, they list whole TLDs just because they don't like somet

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread Mike Jackson
Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from hotmail.com domain get trigerred for these tests 0.4 DNS_FROM_RFC_ABUSE 1.4 DNS_FROM_RFC_POST Because it's listed on both of those lists at rfc-ignorant.org: http://www.rfc-ignorant.org/tools/looku

Re: Custom SA Filters

2006-05-24 Thread Mike Jackson
>Are you looking to catch a particular type of spam? Most people with an up-to-date SpamAssassin version and a complement of SARE rules are either looking to catch something specific or are looking to fix a mis-configuration. Daryl Im basically trying to build a better spam filtering box then

Re: Setting up my own RBL - How?

2006-05-22 Thread Mike Jackson
So - if I wanted to set up my own RBL for others to query me, how would I do that? I'm seriously thinking about it. Alternatively, I can stream my spam to anyone else who is already doing it. I've modified my spam stream to exclude stuff already listed in several other popular block lists. I'm

combine user and global Bayes with SQL?

2006-05-19 Thread Mike Jackson
I guess the subject line says it all. I'm running SA 3.1.1 with Bayes stored in MySQL. Is it possible to learn messages as a "global" user and have the tokens apply when evaluating individual users' email? (Never mind if it would be truly effective; this is more of a theoretical question.)

Re: Minimizing spamd's memory footprint

2006-05-17 Thread Mike Jackson
Soo.yesterday I decided to get gutsy and use just about all the rules from SARE. Here's my rulesdujour config: TRUSTED_RULESETS="ANTIDRUG BLACKLIST BLACKLIST_URI BOGUSVIRUS RANDOMVAL SARE_ADULT SARE_BAYES_POISON_NXM SARE_BML SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 SARE_EVILNUMBERS2 SARE_FRAUD SA

Re: Increase overall preformance

2006-05-16 Thread Mike Jackson
I agree with the Theo. 3.1 is too low. You don't want to reject real mail. 1) Use the network/dns tests. 2) increase the score on individual rules especially those for URIBL score URIBL_WS_SURBL 5.5 score URIBL_SBL 5.5 score URIBL_OB_SURBL 5.5 score DRUGS_ERECTILE 5.0 Study the mails to see wha

Re: Big Idiot Needs Instructions

2006-05-10 Thread Mike Jackson
I have spent two days trying to figure out how to get the following to work. I have set up Spamassassin and ClamAV, I am running sendmail on the Solaris 10 platform. I would like to be able to scan for all spam and virus (in, out and relayed email). Can someone please point me in the right dire

Re: Latest sa-stats from last week

2006-05-08 Thread Mike Jackson
TOP HAM RULES FIRED RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM 1DNS_FROM_RFC_ABUSE 8894313.50 15.85 12.68 25.27

Re: Silly Question

2006-05-03 Thread Mike Jackson
2. Once the server has received the email, it then scans the email and compares it to a list of rules. Every time a rule is matched, the server adds points to the email. 3. When the server completes the scan of the email, it takes the total number of points assigned to that email and compares tha

Re: Rule to select sender starting with string

2006-04-26 Thread Mike Jackson
We are getting a lot of spam where the sender domain name changes, but the sender always starts with a specific string. We've only done a little bit of custom rule writing. How do we do a rule to get the sender starting with a specific string? You could probably just do something like this:

Re: Should My Install of SA Be Catching These?

2006-04-24 Thread Mike Jackson
I would appreciate any guidance that you feel would make my SA setup stronger. These types of messages (attached) keep squeaking through... is my setup weak or have I broken something? To the layman's eye, they look pretty spammy. I am running v3.0.2 and I just went through all the SARE updates

Re: standard vs SARE rules

2006-04-21 Thread Mike Jackson
pushed it over the required hits threshold. Sound good? So, out of 163 spam messages, here's the files that pushed spams over the edge (files with no rules that pushed over the threshold are omitted): Correction: that should've been 3481 spam messages.

Re: standard vs SARE rules

2006-04-21 Thread Mike Jackson
Mike, I suspect you are using the wrong criterion in removing some of the rules. Unfortunately none of the log readers seem to store the most interesting bit of information. How many times did the SARE rules make a critical difference between marking a spam message as spam? I find they are a criti

Re: standard vs SARE rules

2006-04-21 Thread Mike Jackson
Mike, I suspect you are using the wrong criterion in removing some of the rules. Unfortunately none of the log readers seem to store the most interesting bit of information. How many times did the SARE rules make a critical difference between marking a spam message as spam? I find they are a criti

Re: standard vs SARE rules

2006-04-20 Thread Mike Jackson
That seems fine - I'd expect that for a package like SpamAssassin, the default rules (plus Razor and Pyzor) would be very good at identifying spam. However, this was the part that surprised me: Sorry to reply to my own post, and before anyone had a chance to. I tried this on my personal server

standard vs SARE rules

2006-04-20 Thread Mike Jackson
Matt Kettler's advice in the "Good ruleset" thread made me wonder just how many spams the various rule files I'm using actually catch. So, I wrote a quick Perl script to look at the rule files and check a stat script's output (against today's logs) for the rules that spam messages matched, then

Re: greetpause was Re: xxxl spam

2006-04-11 Thread Mike Jackson
You can also impose this cost on spammers by enabling the GreetPause feature in the more recent versions of sendmail. This tells sendmail not to answer right away when receiving a connection, and to drop the connection if anything is received before the greeting is sent out. This punishes "slammer

Re: Sending spam with Mailman

2006-04-11 Thread Mike Jackson
I suppose I shouldn't be shocked by this but it surprised me to receive some spam sent with Mailman. I have a folder for catching all mailing list mail that doesn't yet have its own procmail rule. The catch-all procmail rule looks for anything with a List-Id header and dumps it in ~/mail/Lists/Un

Re: Which Operating Systems Do You Use and Why?

2006-04-06 Thread Mike Jackson
The question is does FreeBSD make binary package updates, or are security updates source-patch only. From what I've observed, the base OS updates are source-patch only, at least until the next full FreeBSD release. Anything that's in the ports tree should be available as either a source update

Re: Which Operating Systems Do You Use and Why?

2006-04-06 Thread Mike Jackson
My "personal" server runs FreeBSD along with Sendmail, procmail, and Courier-IMAP. My employer's servers run Redhat Enterprise Linux along with Sendmail, procmail, and Courier-IMAP. I'm much more comfortable with FreeBSD, which is why I continue to use it on my own system. At work, we got roped

Re: auto start spamd if dead

2006-04-06 Thread Mike Jackson
I created a script to auto learn spam every hour, I want the script to auto start spamd if its not running. Auto start line is: ps -auxwww | grep spamd | grep -v grep >> /dev/null || '/usr/bin/ spamd -d --syslog=/var/log/spamd.log &' Error I get when running and spamd is off is: /usr/bin/lear

Re: Delirium...

2006-04-03 Thread Mike Jackson
Well, I was off on Vancouver Island for nearly a week, and didn't take a laptop with me... Clearly it caused some major trauma because I had the following hallucinatory idea: I was thinking about the issue in which sending spam isn't a crime in a lot of countries, or if it is that it's poorly

Re: How to: Nightly per-user batch training??

2006-03-28 Thread Mike Jackson
Many thanks to everyone for the helpful suggestions so far! I've managed to patch together a Bash script that is close to what I'd like. Currently it's just dumping out the magic data, for testing purposes. As a note, simplying using the -u doesn't work as sa-learn attempts to use the bayes d

Re: How to: Nightly per-user batch training??

2006-03-28 Thread Mike Jackson
I'm hoping that somebody here has done what I'm attempting to do. My users use a web-mail front end for reading email. There is an option to Mark-As-Spam which moves the message into a SPAM folder and removes it from their current folder. Very easy to train even the most inexperienced users to

Re: SA just stopped working

2006-03-22 Thread Mike Jackson
- Original Message - From: "Liam-PrintingAutomation" <[EMAIL PROTECTED]> To: Sent: Wednesday, March 22, 2006 07:36 Subject: SA just stopped working I installed spamassassin not long ago on our server, and it worked great! Then sometime in the last couple of weeks it appears to have

Re: error after upgraded to 3.11

2006-03-14 Thread Mike Jackson
> You have an older version of the stock rules. Doc fixed this > one a week or two ago, since we knew it was going to come up. Weird. rules_du_jour did not grab the newer version. I had the same issue. I deleted the stock ruleset, ran rules_du_jour again, and everything was fine. Obvious t

Re: Spamc child process limit?

2006-03-13 Thread Mike Jackson
I'm still working on my server that is having problems with running spamassassin 3.10 and exim 4.60. Currently the command I run is spamd -d -c -m 5 to have it use 5 child processes. Is there some sort of recommended ratio to amount of processed email to how many max child processes I should

Re: Via HTTP??

2006-03-10 Thread Mike Jackson
And I note that the .67 machine alias "prop.hfradio.org" includes a comments page. That script could be vulnerable if updates to the OS are not fully installed. I've done quite a bit of buttoning up, here. I'll take a closer look at this, too. Maybe this is obvious, but from experience, mak

Re: server reached --max-clients setting, consider raising it

2006-03-06 Thread Mike Jackson
- Original Message - From: "spamassassin" <[EMAIL PROTECTED]> To: Sent: Monday, March 06, 2006 10:23 Subject: server reached --max-clients setting, consider raising it Hello I'm new to spamassassin and need some help. First spamassassin is version 3.0.1 on mac OSX 10.3.9 running o

Re: prefork: server reached --max-clients setting, consider raising itmessages

2006-03-02 Thread Mike Jackson
Spamd startup options - "-d -q -m 50 -x -- siteconfigpath=/etc/mail/spamassassin -i xxx.xxx.xxx.xxx -A xxx.xxx.xxx. -u spamd" There's a disconnect between the spamd man page and what the error log reports. What you're looking to change is the -m option in your startup. The man page lists that

Re: SORBS unreasonable

2006-02-28 Thread Mike Jackson
I don't believe what SORBS is doing fits the legal definition of extortion... no matter how you spell it. :-) There is no threat of either violence or criminal wrong doing and SORBS is operating a legal service... From dictionary.com: 1. The act or an instance of extorting. 2. Illegal use o

Re: bogusmx.rfc-ignorant.org anybody else using it?

2006-02-23 Thread Mike Jackson
After reading Mike's emailing about AOL, this stuck out: I reject mail at the MTA level that's from IPs or domains listed in Spamhaus (both SBL and XBL) and bogusmx.rfc-ignorant.org (the only one of their lists I trust not to cause false positives when used in this manner). I think xbl-sbl is

Re: (OT, but relevant) Playing with AOL?

2006-02-23 Thread Mike Jackson
I tried that Matthew. It too was changed to [EMAIL PROTECTED] What I haven't tried is removing the @aol.com. In a mailing list manager app I wrote, I simply put a MD5 hash of the address in the headers. Then I have something to check against the subscriber list that AOL would never remove fr

(OT, but relevant) Playing with AOL?

2006-02-23 Thread Mike Jackson
I know this isn't directly related to SpamAssassin, but I'm hoping you sys admins will have some advice to share... Here's the situation. I'm the sys admin for a web hosting/design company. We're using Sendmail, with SpamAssassin invoked from procmail. I reject mail at the MTA level that's fro

Re: spamd & mysql redux

2006-02-22 Thread Mike Jackson
Feb 22 11:45:42 ronin spamd[3322]: bayes: unable to connect to database: Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13) Is that where mysql.sock is located? I don't know where the MySQL RPMs might stick it, but source installs stick it at /tmp/mysql.sock by

Re: Question on long scan times

2006-02-17 Thread Mike Jackson
I am running spamd/spamc and have spamc launching with "-t 55". Yet I'm finding that scans are taking as long as 798 seconds to complete, not alot of them but the question is why isn't it timing out? Any suggestions on what to look for? spamc -t only controls the timeout of the spamc client. s

Re: SpamD won't connect to MySQL if started via init.d

2006-02-16 Thread Mike Jackson
Try adding a -D to the init.d spamd call and see if it gives you any more info on why it's failing. Thanks for the quick reply. I did use the -D option and it doesn't give anymore information at all. Basically the error is contained in these two lines (and I have to paraphrase a little because

Re: How to delete Spam automatically

2006-02-10 Thread Mike Jackson
My hoster offers cpanel to configure spamassassin, which has only a few options to configure, like white and blacklist. But I have shell-access to my account and maybe I could try out how to delete spam automatically. It looks like amavis isn't used on this RedHat machine with kernel 2.4.21-37.

Re: General assistance

2006-02-10 Thread Mike Jackson
I was doing some reading and I am beginning to look into Rules Du Jour. I see there are quite a large number of rulesets to choose from when utilizing this. Does anyone have any advice on what ones would be safe? I use these: SARE_ADULT SARE_BAYES_POISON_NXM SARE_FRAUD SARE_HEADER0 SARE_HEA

Re: RDJ, wget, and proxy

2006-02-09 Thread Mike Jackson
I would rather use wget than curl (curl has too many pre-reqs) Sorry not to answer the question and go off on an tangent, but what requirements does curl have that you can't install? If you build from source, about the only requirement that may not be on any stock system would be OpenSSL, and

Re: SPF check wrong in SA?

2006-02-08 Thread Mike Jackson
> Looking at the headers above, if the SPF record for customer.com does > not allow mail to come from 84.152.113.90, then the check will fail. OK, but how can people ever send e-mail then? That server is very alone somewhere in a dark room, seeing no daylight until the end of his life. Hard to im

Re: Spamassassin Learn

2006-02-07 Thread Mike Jackson
Does anyone have any good techniques for capturing a sample of ham that can be used as the ham corpus. I'm in a corporate environment and am not keen on the idea of intercepting non-spam messages. I will if I have to, but was hoping someone had a better idea. Depending on your MTA/MDA, you m

Re: Spamd Child Forks

2006-02-02 Thread Mike Jackson
spamd: handled cleanup of child pid 19888 due to SIGCHLD spamd[5262]: prefork: child states: II I see a lot of mention of these messages showing up in 3.1, but I have not seen a definitive answer as to if I need to pay more attention to them or they are just a minor/visual annoyance in the logs a

Re: Post your top 10 from sa-stats

2006-01-31 Thread Mike Jackson
RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM 1 HTML_MESSAGE 45870 5.13 27.72 70.37 55.36 Wait... so 27% of all mail is HTML, 70% of spam is HTML, and 55% of ham is HTML? That

Re: Post your top 10 from sa-stats

2006-01-31 Thread Mike Jackson
Kristopher Austin wrote: RANKRULE NAME COUNT %OFRULES %OFMAIL %OFSPAM %OFHAM 1HTML_MESSAGE 45870 5.13 27.72 70.37 55.36 Wait... so 27% of all mail is HTML, 70% of spam is HTML, a

Re: Post your top 10 from sa-stats

2006-01-31 Thread Mike Jackson
sa-stats.pl, there is more than one version. I got mine from the Sare Ninjas as I use daemon tools to run spamd. I don't know where the other one can be found or what the difference is. Google, or use these list archives for more info. I've had one off-list request for this so far, so I'll se

Re: Post your top 10 from sa-stats

2006-01-30 Thread Mike Jackson
I use the other sa-stats script, which I modified to show stats on the rules: Top spam rules:Ham: Spam: % Ham: % Spam: -- RAZOR2_CHECK 90 1098 4.32 68.33 RAZOR

Re: RAZOR or DCC or Pyzor

2006-01-30 Thread Mike Jackson
I want to get some adives about RAZOR / DCC / Pyzor usage ! I don't know how many people is using they but I need some advise ? - I think that DCC and RAZOR will improve spam finding , right ? at this moment I know that querying will take a time but How many spamcleanhouse we should u

Re: hey john spam

2006-01-27 Thread Mike Jackson
This is a new one for me. Today I've received some mail with "hey john" in the subject, and the mail otherwise appears blank. It didn't contain a virus, or it would've been discarded by ClamAV. Are these familiar to you guys? What's the point of them? Headers of one below: Thanks! - John

Re: whitelist mailman lists

2006-01-24 Thread Mike Jackson
we have some lists on a server maintained by mailman. since mails for moderators contains offten spammy content, those mails are rated as spam too. i tried whitelisting with for example: whitelist_from_rcvd [EMAIL PROTECTED] domain whitelist_from_rcvd [EMAIL PROTECTED] domain whitelist_from_rcvd

Re: question about .procmailrc

2006-01-23 Thread Mike Jackson
I am using spamassasin in .procmailrc (unix account). my question is about .procmailrc: is .procmailrc synchronized? I mean, if two new mails are coming to my accout, will the first .procmailrc script execution finish before the second execution will start? I am trying to do something so the or

Re: Block IP source

2006-01-23 Thread Mike Jackson
You could write it as a header rule, like... header ANNOYING_SPAMMER Received =~ /193\.95\.75\.135/ describe ANNOYING_SPAMMER Mark mail from 193.95.75.135 as spam score ANNOYING_SPAMMER 5 If you have control over your MTA, you might investigate using its mechanism to block mail from that IP. Fo

Re: sa-learn done as root.

2006-01-19 Thread Mike Jackson
Hello all.. Novice SA Admin here (well, none of my users complain - wait.. I have none, just me). I recently read something that says sa-learn is learned for the user who runs sa-learn. I've always run sa-learn as root. Is there a easy way to copy the contents of what's been learned from root to m

sa-learn and user preferences

2006-01-19 Thread Mike Jackson
On the servers I admin, the user preferences are stored in SQL, yet sa-learn insists on there being a .spamassassin directory in the users' home directory, creating it and a default user_prefs file if they do not exist. Why? What does it need the prefs for? Can it use the SQL preferences? Is th

Re: Load Balancing with Postfix [and SpamAssassin]

2006-01-18 Thread Mike Jackson
I am wondering if anyone can direct me to any books/sites/etc regarding possibly running postfix on one or more servers accepting mail, processing with SA, then forwarding onto a 3rd machine. Currently my setup only includes one Postfix box, which does all of the mail filtering (with spamassass

Re: how to configure SA to do nothing at all for one single user?

2006-01-18 Thread Mike Jackson
> > how do i tell SA on the other server not to touch my mails at all? > > SA is invoked from within qmail there. > > You would have to tell qmail not to invoke SA for your messages. > > But why is it a problem? When you run SA on your server, it should > automatically remove the markup added by

Re: rules better than bayes?

2006-01-09 Thread Mike Jackson
Do you recommend running airmax as a supplementary ruleset with 3.1.0? This is just my humble opinion, but I don't know if that's a ruleset I would use in production for a multi-user server. A few of the rules use the "f-word" in the rule description line, so it would go out in a verbose repo

Re: SA FP on a gfi newsletter

2005-12-27 Thread Mike Jackson
I recently got an FP for an (opted in) gfi.com newsletter. X-Spam-Status: Yes, score=5.454 required=5 tests=[BLANK_LINES_70_80=1.236, DNS_FROM_RFC_ABUSE=0.479, DNS_FROM_RFC_POST=1.44, DNS_FROM_RFC_WHOIS=0.879, FROM_EXCESS_BASE64=1.052, HTML_MESSAGE=0.001, HTML_TAG_EXIST_TBODY=0.126, MIME_BOUND_

Re: Public Blacklists?

2005-12-21 Thread Mike Jackson
Aaron Boyles wrote: Actually, no, I can't. I get that message with Yahoo as well. I vaguely remember running into this issue before, and it having something to do with using Windows 2K3 server behind NAT. As I recall at the time, it was decided that the 'solution' was far more work than it w

Re: Newbie looking for info...

2005-12-21 Thread Mike Jackson
Personally, I use SpamAssassin on my personal E-Mail server (which is hosted by someone else for me, and is a Linux server) and I love it. I'm particularly depressed that as long as it's been in development, nobody's thought to simplify the install process. Heck, the "installing on windows" p

Re: US winning war on spam ?!?!?!

2005-12-21 Thread Mike Jackson
But the reality of the numbers won't stop the FTC from tooting it's own horn and claiming victory.. Unfortunately for us, this will likely result in some major spammers unleashing a mass-scale deluge just to show they're wrong. The best I think we can hope for is that a few of them might get re

Re: Statistics from logfile to SQL

2005-12-15 Thread Mike Jackson
7;t be too terribly difficult to maintain, and I wouldn't think you'd need to retain history for very long. On 12/15/05 12:48 PM, "Mike Jackson" <[EMAIL PROTECTED]> wrote: I have been trying to find a script which would allow me to copy data from spamd logfile to

Re: Statistics from logfile to SQL

2005-12-15 Thread Mike Jackson
I have been trying to find a script which would allow me to copy data from spamd logfile to MySQL database. It would be usefull, since then I could provide datailed statistics to my users. Does anybody know a way to do it or I will just have to write a small script myself? Has anyone probably don

Re: Stats question...

2005-12-08 Thread Mike Jackson
Someone posted an update to a stats collecting program, I think it was this list I saw it on. The post was about two weeks ago, I don't recall the name of the program but want to take another look at it. Anyone know what I"m talking about?... I don't think this is the one you're thinking of, bu

Re: Storing Global Rules in mysql

2005-12-07 Thread Mike Jackson
is there a way to store global filter rules in mysql? I have written an web frontend for administering spamassassin rules. But at the moment i got the problem to store all rules in one file (it's to big and makes the server slow). i searched with google, but i found just solutions to store userp

Re: X-Spam headers placement issue

2005-12-06 Thread Mike Jackson
When mail is processed by SA ( spamc/spamd from procmail in this example), it adds all the X-Spam headers at the beginning of the mail (prepend). I don't want to be one of those jerks who tells you to read the list archives for an answer, but I know this subject has been raised several times s

Re: mysql & spamassassin

2005-11-30 Thread Mike Jackson
With due respect... if you're not using per-user preferences then you're not using per-user rules either, so what is the point of storing them in MySQL? How often do they need to be edited, and by whom? Good reasons not to: there's no support for it that I know of, so you'll have to write it y

Re: OT? Threats from twtelecom over spam reports

2005-11-30 Thread Mike Jackson
twtelecom is staffed by morons, like most other large providers. Eh, I wouldn't go so far as to say they're morons. They're just near-sighted. They'll do whatever they need to do - and no more - to protect their own interests without considering the implications for others on the net. Take AO

sa-update

2005-11-29 Thread Mike Jackson
Thanks to another thread today, I discovered the sa-update script (which must be new, or I haven't noticed it in 3+ years of using SA). However, when I try to run it on two separate boxes, I get debug output similar to this (when invoked with no command line options other than -D): [8348] dbg:

Re: Fetchmail and SA?

2005-11-28 Thread Mike Jackson
I saw a post earlier today about using fetchmail to grab external emails and run them through your local SA filters. Can anyone explains or point me in the right direction to find out how to do that? I would like to use fetchmail to get mail from an external server and have it run through my serv

Re: Improving sa

2005-11-28 Thread Mike Jackson
When manually applying the filters "Mark as SPAM" or "Mark as HAM", which pipe the message to the command sa-learn --spam or sa-learn --ham respectively, it takes up to a minute to process on a PIV 4.3Ghz HT with 1Gb of RAM, which seems like ages. I've noticed that the SQL backends to Bayes an

Re: score based on MX's IP?

2005-10-10 Thread Mike Jackson
Perhaps this is too much to ask of SpamAssassin, but... My server receives a piece of spam that's undeliverable. It looks up the MX for the sender's address, and finds that the IP is 127.0.0.1. It then complains that there's a configuration problem because it's not set up to handle mail for th

score based on MX's IP?

2005-10-10 Thread Mike Jackson
Perhaps this is too much to ask of SpamAssassin, but... My server receives a piece of spam that's undeliverable. It looks up the MX for the sender's address, and finds that the IP is 127.0.0.1. It then complains that there's a configuration problem because it's not set up to handle mail for th

  1   2   >