Re: change mysql username in bayes_var table

2007-10-14 Thread Rob Mangiafico
On Sun, 14 Oct 2007, Michael Parker wrote: > Rob Mangiafico wrote: > > We're converting a server from per user mysql bayes to sitewide bayes > > using the "bayes_sql_override_username USERNAME" command. We want to use > > the data for one username in the my

change mysql username in bayes_var table

2007-10-14 Thread Rob Mangiafico
We're converting a server from per user mysql bayes to sitewide bayes using the "bayes_sql_override_username USERNAME" command. We want to use the data for one username in the mysql db already that has quite a nice buildup of trained ham and spam. Can we simply change the username in the mysql

Re: Purpose for SpamAssassin using MySQL

2007-10-03 Thread Rob Mangiafico
On Tue, 2 Oct 2007, [iso-8859-2] Micha³ Jêczalik wrote: > There are many. It allows you to share data between user accounts (IMHO it > doesn't make much sense to have separate bayes databases for each account, > at least they are of a 'massive' sort and users are not allowed to feed > their own

Re: question about -lastexternal and trusted_networks / dialup IP

2007-01-09 Thread Rob Mangiafico
On Mon, 8 Jan 2007, Daryl C. W. O'Shea wrote: > Rob Mangiafico wrote: > > On Mon, 8 Jan 2007, Daryl C. W. O'Shea wrote: > >>> User emails from his/her dialup IP directly to trusted_networks server 1 > >>> (which is allowed by access not SMTPAUTH), which

Re: question about -lastexternal and trusted_networks / dialup IP

2007-01-08 Thread Rob Mangiafico
On Mon, 8 Jan 2007, Daryl C. W. O'Shea wrote: > > User emails from his/her dialup IP directly to trusted_networks server 1 > > (which is allowed by access not SMTPAUTH), which then goes to my server. > > It seems this email gets flagged as DUL, PBL, etc... > > > > user1 -> trusted_networks server

question about -lastexternal and trusted_networks / dialup IP

2007-01-08 Thread Rob Mangiafico
It's probably because I need sleep, but I'm confused on this scenario: User emails from his/her dialup IP directly to trusted_networks server 1 (which is allowed by access not SMTPAUTH), which then goes to my server. It seems this email gets flagged as DUL, PBL, etc... user1 -> trusted_networks s

Re: Botnet 0.7 Plugin is available

2006-12-22 Thread Rob Mangiafico
On Fri, 22 Dec 2006, John Rudd wrote: > >>> 8) The file Botnet.variations.txt exists now with different suggested > >>> alternative ways to do Botnet rules. > > > > Thanks for this. We have to use the meta method to have BOTNET not trigger > > when other rules hit to avoid collateral damage on c

Re: Botnet 0.7 Plugin is available

2006-12-21 Thread Rob Mangiafico
On Thu, 21 Dec 2006, John Rudd wrote: > > 1) BOTNET_SOHO -- If the sender's (chosen from Envelope-From, > > Return-Path, or From, in that order) mail domain (the part after the @ > > sign) resolves back to the relay's IP address, or has an MX host which > > resolves back to the IP address, AND t

Re: required_score aggressive ??

2006-12-06 Thread Rob Mangiafico
On Wed, 6 Dec 2006, Ray Anderson wrote: > I use a required_score of 3 and so far have had zero positives (more > than 3 years running). > > I have customers that also run 3 and have opted to have the server > /discard/ the message (not quarantine, but /DISCARD/) if it is > identified as spam.

Re: new Botnet plugin version soon

2006-11-30 Thread Rob Mangiafico
On Thu, 30 Nov 2006, Jonas Eckerman wrote: > John Rudd wrote: > > > Question 1: Someone suggested that, for botnet_pass_domains, I not > > re-invent the wheel. SA already has several whitelist options > > (whitelist* and sare_whitelist* were specifically mentioned). They > > suggested that I

Re: RelayChecker (now Botnet ) 0.4

2006-11-28 Thread Rob Mangiafico
On Tue, 28 Nov 2006, John Rudd wrote: > >> Received: from smtp-out-4101.amazon.com (207-171-180-184.amazon.com > >> [207.171.180.184]) > >> by XXX (8.11.6/8.11.6) with ESMTP id kAS2XrV04185 > >> for ; Mon, 27 Nov 2006 21:33:53 -0500 > > > > This was ugly, but you could put "amazon

Re: RelayChecker (now Botnet ) 0.4

2006-11-27 Thread Rob Mangiafico
On Mon, 27 Nov 2006, Rob Mangiafico wrote: > Great, thanks for confirming. Didn't want to score it that high until I > knew we'd be avoiding our own users. Been running it for a few hours, got > a few 1000 hits so far, sorted by score, and have not found a false > positi

Re: RelayChecker (now Botnet ) 0.4

2006-11-27 Thread Rob Mangiafico
On Mon, 27 Nov 2006, Daryl C. W. O'Shea wrote: > John Rudd wrote: > > Rob Mangiafico wrote: > >> On Thu, 23 Nov 2006, John Rudd wrote: > >>> I've changed RelayChecker's name to Botnet (since that's its real > >>> purpose: identif

Re: RelayChecker (now Botnet ) 0.4

2006-11-27 Thread Rob Mangiafico
On Thu, 23 Nov 2006, John Rudd wrote: > I've changed RelayChecker's name to Botnet (since that's its real > purpose: identify potential botnet submitted messages). Here's the 0.4 > release. > ... > So, let me know what you think. Let me know if you find any bugs, what > your hit/miss/fp stats

DB_File, openwebmail, and Spamassassin

2006-11-18 Thread Rob Mangiafico
Running openwebmail, the docs say to patch the DB_File.pm file with this patch for OWM to work correctly: --- Please modify /usr/lib/perl5/5.8.0/i386-linux-thread-multi/DB_File.pm by adding $arg[3] = 0666 unless defined $arg[3]; before the following text (about line 247) # make recno in Be

Re: FuzzyOCR error on processing gif sample file

2006-08-16 Thread Rob Mangiafico
On Tue, 15 Aug 2006, Rob Mangiafico wrote: > > >>> Downloaded and installed the latest FuzzyOCR 2.1c > > >>> > > >>> Ran the tests and the jpg and png ones worked fine, but for the > > >>> gif sample I received: > > >>> &

Re: FuzzyOCR error on processing gif sample file

2006-08-15 Thread Rob Mangiafico
On Tue, 15 Aug 2006, decoder wrote: > Rob Mangiafico wrote: > > On Tue, 15 Aug 2006, decoder wrote: > >> Rob Mangiafico wrote: > >>> Downloaded and installed the latest FuzzyOCR 2.1c > >>> > >>> Ran the tests and the jpg and png one

Re: FuzzyOCR error on processing gif sample file

2006-08-15 Thread Rob Mangiafico
On Tue, 15 Aug 2006, decoder wrote: > Rob Mangiafico wrote: > > Downloaded and installed the latest FuzzyOCR 2.1c > > > > Ran the tests and the jpg and png ones worked fine, but for the gif > > sample I received: > > > > spamassassin -t > (null): EOF / r

FuzzyOCR error on processing gif sample file

2006-08-15 Thread Rob Mangiafico
Downloaded and installed the latest FuzzyOCR 2.1c Ran the tests and the jpg and png ones worked fine, but for the gif sample I received: spamassassin -t

Re: Image spams getting thru

2006-08-01 Thread Rob Mangiafico
On Mon, 31 Jul 2006, Derek Harding wrote: > rawbody INLINE_IMAGE/src\s*=\s*["']cid:/i > describe INLINE_IMAGE Inline Images > score INLINE_IMAGE 1.5 > > I haven't tested this against the SA corpus so YMMV. Anyone else find this to be a good rule to catch these image stock spams without too

Re: SA 3.1.0 freezing

2005-09-18 Thread Rob Mangiafico
> Rick Macdougall wrote: > > I'm having an issue with SA 3.1.0 freezing, it will run through a > > couple of users (3 - 10) and then lockup. > > ... > > and it just stops there. > > ... > > Any one with any ideas ? > BTW, a reboot fixed it but I still don't know what caused it. We have seen this