On Thu, Oct 2, 2008 at 2:49 PM, Kenneth Porter <[EMAIL PROTECTED]>wrote:
> On Wednesday, September 17, 2008 4:02 PM +0100 Justin Mason <[EMAIL
> PROTECTED]>
> wrote:
>
> This is just in the dev ruleset -- for 3.3.0 -- so you're best off adding
>> it manually. right now it's like this:
>>
>> #
>
>
> anyway, if your SA only misses few spam, there's no need to try to improve
> that with new rules.
>
>
>
Yeah, this is the first spam I've gotten in about a month or maybe two.
Still, I let it bug me too much. That, and it's slow at work today. I
guess I'll just let it go.
>
> sought != sought_fraud.
>
Whoops! Thanks! Got it now, but still no hits in that rule set either.
>>>
>>>
>> I am using bayes, but it didn't catch it. I was quite surprised at
>> that.
>
> h...
>
> Content analysis details: (6.3 points, 5.0 required)
>
>
> pts rule name description --
> --
> 3.5 BAYES_9
>
> Silly question, but is "peloruso" the user that spamd is running as?
> user/database mismatch is a common problem.
>
I'm not using spamd, I call spamassassin from procmail. I'm on a shared
host that doesn't allow users to run their own daemons (although they are
running their own spamd, but no
Sorry about the double post--operator error.
fig: fixed relative path:
/home/peloruso/etc/mail/spamassassin/skip/updates_spamassassin_org/23_bayes.cf
[12541] dbg: config: using
"/home/peloruso/etc/mail/spamassassin/skip/updates_spamassassin_org/23_bayes.cf"
for included file
[12541] dbg: bayes: tie-ing to DB file R/O
/home/peloruso/
fig: fixed relative path:
/home/peloruso/etc/mail/spamassassin/skip/updates_spamassassin_org/23_bayes.cf
[12541] dbg: config: using
"/home/peloruso/etc/mail/spamassassin/skip/updates_spamassassin_org/23_bayes.cf"
for included file
[12541] dbg: bayes: tie-ing to DB file R/O
/home/peloruso/
On Thu, September 18, 2008 9:33 am, John Hardin wrote:
> On Thu, 18 Sep 2008, Skip wrote:
>
>
>> What can I do to increase my chances on spammies like this one:
>> http://pastebin.com/m5f5d11e0
>>
>
> (1) train your bayes with it
>
I am using bayes, but it did
On Thu, September 18, 2008 8:55 am, mouss wrote:
> Skip wrote:
>
>> What can I do to increase my chances on spammies like this one:
>> http://pastebin.com/m5f5d11e0
>>
>>
>
> maybe
>
> header _CTYPE_PLAIN Content-Type =~ m|text/plain| header _CTRANSFER_B
What can I do to increase my chances on spammies like this one:
http://pastebin.com/m5f5d11e0
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
Skip Morrow wrote:
On Sun, September 7, 2008 10:09 am, Skip wrote:
Michael Scheidell wrote:
It was the
firewall. I go that fixed. Now, here's my next problem. I think taint
mode is stopping razor from running on my system. Since I can't
On Sun, September 7, 2008 10:09 am, Skip wrote:
>
> Michael Scheidell wrote:
>>> It was the
>>> firewall. I go that fixed. Now, here's my next problem. I think taint
>>> mode is stopping razor from running on my system. Since I can't be root,
Michael Scheidell wrote:
It was the firewall. I go that fixed. Now, here's my next problem. I
think taint mode is stopping razor from running on my system. Since I
can't be root, I have to install Razor in my home home directory. So
Will the s
Theo Van Dinter wrote:
On Sat, Sep 06, 2008 at 11:32:54AM -0400, Skip wrote:
[EMAIL PROTECTED] [~]# telnet discovery.razor.cloudmark.com 2703
Trying 208.83.137.205...
telnet: connect to address 208.83.137.205: Connection timed out
Trying 208.83.137.117...
telnet: connect to address
Ron Smith wrote:
I think razor is not free anymore.
Ron Smith
[EMAIL PROTECTED]
"Having an email problem is painful, but character-building."
Unless there is something newer than this, I believe Razor is free.
http://sourceforge.net/forum/forum.php?forum_id=576145
--
Get my PGP Public ke
8.83.137.117: Connection timed out
Should I be able to telnet to discovery.razor.cloudmark.com on port
2703? If my system is blocking that port for some reason, can other
ports be used and where is that configured? I don't know how successful
I would be at getting my server to unblock that
Skip wrote:
can you be more explicit. you got FPs with how many ','? did you have
an FP with 100?
Sure. When I ran it against my inbox, with 4587 "good" emails, I had
130 hits on MATCH20 and 2 hits on MATCH50, or 2.877% (0 with
MATCH100). The interesting thing is, i
can you be more explicit. you got FPs with how many ','? did you have
an FP with 100?
Sure. When I ran it against my inbox, with 4587 "good" emails, I had
130 hits on MATCH20 and 2 hits on MATCH50, or 2.877% (0 with MATCH100).
The interesting thing is, if you think about it, people who rou
perl script.pl *
That did it! Thanks! I would definitely have had some FPs now that I
have checked.
Just thinking aloud here: wouldn't it be a good idea to also the the CC
headers for the same conditions?
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
describe TO_TOO_MANY To: too many recipients
header TO_TOO_MANY To =~ /(?:,[^,]{1,80}){20}/
describe TO_WAY_TOO_MANY To: way too many recipients
header TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){50}/
The {20} variant will cause "normal" FPs. I don't think the {5
John Hardin wrote:
On Sun, 2008-08-31 at 14:33 -0400, Skip wrote:
describe TO_HARVESTED To: obviously harvested
header TO_HARVESTED To =~ /\@(?:(?:(?:example|your|
some)\.domain)|(?:(?:example|your\.domain)\.com)|your\.favou?rite
\.machine)\b
example
(in my case I would use pelorus.org, so feel free to demonstrate with that)
How can google let this go out?
I was wondering that too. Did it really come from gmail?
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
This one only scored a 2.9 on my installation, as you can see. I do
have some custom rules (Saught and SARE) but no hits there.
Skip
Oops... I meant to include this the first time. These were the rules
that it triggered on my installation:
X-Spam-Report:
* 2.5 HEAD_LONG Message
Got this one today. Never seen anything like this before.
http://pelorus.org/mix
(I couldn't even paste into pastebin--their spam catcher caught it)
This one only scored a 2.9 on my installation, as you can see. I do
have some custom rules (Saught and SARE) but no hits there.
Skip
-
;ve been using TB since the early 1930's and don't
remember seeing any regular expression type search options.
Well, maybe not the 30's but I've been using it a long time.
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
ts raised here are
quite valid, but I'm not the guy to fix them.
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
Scored well here:
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10)
X-Spam-Level: x
X-Spam-Status: Reqd:5.0 Hits:17.1 Learn:disabled Tests:JM_SOUGHT_2=4,
JM_SOUGHT_3=4,SG_EXECUTABLE_URI=3,UNPARSEABLE_RELAY=0.001,
URIBL_AB_SURBL=1.613,URIBL_BLACK=1
, but just barely.
Anything I could have done to increased my chances on this one? Perhaps
something about linking to an exe? That can't be good.
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
Skip wrote:
Noel Jones wrote:
On Mon, Aug 11, 2008 at 12:30 PM, Skip <[EMAIL PROTECTED]>
wrote:
Randal, Phil wrote:
I
see no
whitelist_from_dkim *@ebay.com emarsys.net
in your list.
Not that I'm sure that&#x
Noel Jones wrote:
On Mon, Aug 11, 2008 at 12:30 PM, Skip <[EMAIL PROTECTED]>
wrote:
Randal, Phil wrote:
I see no
whitelist_from_dkim *@ebay.com emarsys.net
in your list.
Not that I'm sure that's the problem.
A
whi
l
Networks Engineer
Herefordshire Council
Hereford, UK
*sigh* that whitelist_from_dkim rule didn't do it. That
whitelist_from_rcvd rule however did do the trick, but I am still
interested in figuring out how to get the dkim rule working. Any other
ideas?
Skip
--
Get my PGP Public
g: dkim: policy: performing lookup
[5464] dbg: dkim: policy result neutral: o=~
would you believe that the following google search has zero hits?
http://www.google.com/search?num=100&hl=en&safe=off&q=%22failed+author+signature%22+dkim&btnG=Search
Thanks in advance!
Skip
Randal,
or is there a
better way? In concept, this seems like a great way to ensure one does
not get spoofed emails, but gosh, it sure is hard to set up the rules
for it. Unless I'm missing something simple
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
to tell sa-update to look somewhere
else (like the --siteconfigpath option for the spamassassin command). I
do not have access to my /etc directory, so moving my rules there is not
an option. Am I missing something in the sa-update command that will
get me going?
Cheers!
Skip
[EMAIL PROTECTE
ith many (helpful, I hope) comments.
http://pastebin.com/f743e7daa
Like I said, if any of you smart guys out there see ways to improve
this, I sure would appreciate the feedback.
Thanks.
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
not work.
According to the documentation, the trusted_networks settings shouldn't
affect this, but here are mine just in case someone else thinks it makes
a difference.
internal_networks 192.168/16
internal_networks 69.89.22.106
Skip
--
Get my PGP Public key here:
http://pelorus.
for <[EMAIL PROTECTED]>; Thu, 24 Jul 2008 21:53:15 -0400
Received: from [192.168.1.113] ([68.231.250.115])
by eastrmimpo03.cox.net with bizsmtp
id u1tE1Z0062W8SQ4021tEyq; Thu, 24 Jul 2008 21:53:14 -0400
Message-ID: <[EMAIL PROTECTED]>
Date: Thu, 24 Jul 2008 21:53:05
Karsten Bräckelmann wrote:
On Mon, 2008-07-21 at 17:58 -0400, Skip wrote:
I thought you guys would like a little humor. Here's what I sent my
host and what I got in response. *sigh*
Maybe tomorrow I'll have better luck with them.
FROM: <[EMAIL PROTECTED]>
SITE:
ld be reached
I would like to use the spamhaus services with my spamassassin setup,
but for some reason, I can't connect to them at all from my box. Any ideas?
Skip
And their response..
Good day,
Since we are not SPAMHAUS.ORG we are not sure why you would be unable to
connect to the
mouss wrote:
Skip wrote:
mouss wrote:
Skip wrote:
[snip]
Anyway, please bear with me as I do have a few more questions. In
this thread before, some people thought I should look at a possible
DNS problem, or perhaps my system is exceeding the daily threshold
for spamhaus. All they say
mouss wrote:
Skip wrote:
[snip]
Anyway, please bear with me as I do have a few more questions. In
this thread before, some people thought I should look at a possible
DNS problem, or perhaps my system is exceeding the daily threshold
for spamhaus. All they say at the spamhaus FAQ is that
Sahil Tandon wrote:
Skip <[EMAIL PROTECTED]> wrote:
But I want to stop the test from even being done at all. I guess I should
have included more of the previous post. Sorry :(
Please do not top-post (google if you are unfamiliar with the term). And as
already advised, ju
But I want to stop the test from even being done at all. I guess I
should have included more of the previous post. Sorry :(
Skip
Raymond Dijkxhoorn wrote:
Hi!
I was actually thinking the same thing about configuring SA to use a
different resolver, but could not find such a configuration
A to use a
different resolver, but could not find such a configuration option.
Skip
What is the generally approved way to disable individual RBL checks? I
can easily disable all of them, but I haven't figured out how to disable
individual ones.
Skip
--
Get my PGP Public key here:
http://pel
Kai Schaetzl wrote:
Skip wrote on Thu, 17 Jul 2008 16:19:07 -0400:
As for too many connection per day, my domain certainly does not
generate anywhere near the 100,000 connections spamhaus considers as the
cutoff, but I'll be my host (bluehost) does. If all they check is
originati
Richard Frovarp wrote:
mouss wrote:
Skip wrote:
Periodically I have seen spam come in my inbox and after reviewing
the headers, I'd see that it didn't hit any of the DNS/URL BL
checks. So I left SA running in debug mode for a while and saw some
strange entries (sorry for the
t was
successful in testing the message, and if not, do it again. Something
like that, perhaps???
Skip
Here are the logs:
Went well
[28851] dbg: async: escaping: lost or timed out requests or responses
[28851] dbg: async: aborting after 22.349 s, past original deadline:
DNSBL-A, dns:A:250.101.133.
But recently I am seeing an
increase in spam reaching my end users.
Is there something more that I can be doing? Maybe I need to start updating
from some additional rule sets?
- Skip
> That option wasn't removed from SA.. it was removed from the main conf
> docs, as all of the AWL is now a plugin. That option is documented in the
> docs for the AWL plugin, which is where it really belongs. (if the option
> isn't valid without the plugin, then it in theory shouldn't be in the ma
spamassassin, I pass it the -p
option with my own configuration file, and I should be able to pass it
the -C or --siteconfigpath options to set admin settings. Any help?
Skip
--
Get my PGP Public key here:
http://pelorus.org/[EMAIL PROTECTED]
a hold of in tech support, they don't even know what their own
boxes are running and doing.
Justin Mason wrote:
Skip writes:
What do you know? I got permission from my web and email hosting
company (BlueHost) to run my own spamd process. Cool! Now I can have a
lot more control
By the way, this is version 3.2.4.
Skip wrote:
What do you know? I got permission from my web and email hosting
company (BlueHost) to run my own spamd process. Cool! Now I can have
a lot more control over the processing of my incoming mail, and I have
access to the logs! Well, after
What do you know? I got permission from my web and email hosting
company (BlueHost) to run my own spamd process. Cool! Now I can have a
lot more control over the processing of my incoming mail, and I have
access to the logs! Well, after starting spamd, I was surprised after a
couple of minut
Matt Kettler wrote:
Skip wrote:
One more dumb question (and this really is more of a linux question
than a SA question), but if I start spamd -d from a console, and then
quit that console, won't the daemon quit too?
No, that's what makes it a daemon.. it detaches from the console
x27;s a real
kludge and I'd rather not do that.
John Hardin wrote:
On Fri, 21 Mar 2008, Skip wrote:
If I did go this route, how would I make sure that my spamc talks to
my spamd and not the other one that is already running on the box?
Don't use the default network port number.
Justin Mason wrote:
Skip writes:
My email is hosted on a shared hosting site where I don't have much
access to the good stuff, like syslog and /var/*anything*. For that
reason, I believe spamc/spamd is out for me. They do in fact have spamd
running. Here's t
way to get into my logs so I can see what my installation is doing and
not doing.
Thanks in advance.
Skip
Other than the initial reports of performance boost from 3.2.4, I haven't
seen much discussion on it as yet. Perhaps it is still too soon to know,
but has anyone been seeing other benefits - or identified potential
problems?
- Skip
> > > xou4 schrieb:
> > >> Hello,
> > >> I want to remove the mails on which a score above 30
Or for procmail (this rule is for 20, add or decrease \* as appropriate):
:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
/dev/null
> From: Theo Van Dinter
> Typically one would make "all_spam_to" not a global option.
I manage the server at the global level. Users do not have the ability to
modify their procmail or SA settings in any way.
> However, from what you describe, the better method would be
iple recipients (in the to: and/or cc: fields) mail is
delivered to all recipients if that one user is a recipient. Is there a way
to overcome this?
Thanks.
- Skip
Guess this would help:
Using sendmail 8.13.8 with SA 3.2.3
- Skip
> From: Chris 'Xenon' Hanson [mailto:[EMAIL PROTECTED]
>Usually you do this with a combination of trusted_networks
> and exclusion in your scanner.
I have started to run into a small problem due to some communication
internally with emails being flagged as spam. Long question made short:
How to I correctly configure SA to trust communication on our network
without trusting spoofed addresses?
- Skip
r lost business.
- Skip
orrectly) placed on a
blacklist at any point in time.
- Skip
None. I'd rather bump up my system resources than allow a system completely
out of my control to assess whether or not mail should run through my MTA
and SA.
- Skip
I saw one of these nearly a month ago, but that was it. That it comes
addressed to a personal name is a bit disturbing.
- Skip
the other
rule is getting hit.
- Skip
This is probably going to be a stupid question, but how do I go about
implementing patches like this? Should this file be copied in place of the
file located here?:
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/
- Skip
In order to implement something like this, you would need to know the order
of rules processing (which perhaps there is one - but I don't know it). You
would need to be careful if you have rules which will assign negative scores
which typically do so after other rules have already given positive o
--
Basically I am running all mail thru SA, dumping everything with a score
over 8.0 (which you can modify if you aren't comfortable with that number by
adding \* for each additional point - or just delete that rule completely).
All remaining spam goes to whichever account is defined as "spammailbox".
- Skip
I do not have a
country-based solution in place as the vast majority are caught in other
rules.
- Skip
> I used IP::Country::Fast to block everything except canada and usa...
>
> I've only had to add one company to an allow list because
> they are in Italy...
>
> I don
> No need for these settings if you have the above "ok_languages en"
I think you are correct if you assume that emails coming from *.ru (for
example), are written in something other than English, which is rarely the
case. Much of the spam I see from *.ru and *.su is in English.
- Skip
certain which of these would be the correct one to implement.
- Skip
I imagine this depends a little on your distro. Some more details would be
helpful.
> From: Netdynamix [mailto:[EMAIL PROTECTED]
>
> I have SA 3.1.4 running on my server successfully. I want to
> upgrade to
> 3.2.3 for safety sake.
>
> I have NEVER upgraded SA before and am a little scared t
of a handful of scenarios which have pursuaded me to
eliminate their use on my system. Unfortunately, I have no control over the
potential for the above situation repeating itself...
- Skip
r. I don't agree with the methodology of sites like
spamhaus & spamcop so I only use the scoring rules built into SA rather than
just simply give blacklisting control to another service.
- Skip
tus.pm
> line 2140.
> rules: score undef for rule 'EMPTY_MESSAGE' in ''
> 'EMPTY_MESSAGE' at
> /usr/local/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm
> line 2140.
> rules: score undef for rule 'NO_RECEIVED' in '' 'NO_RECEIVED'
> at
> /usr/local/lib/perl5/site_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm
> line 2140.
> ...
> (repeated several times)
>
I got these as well for both upgrades to 3.2.2 and 3.2.3...
- Skip
al/bin/rblsmtpd -b -C -r 'sbl-xbl.spamhaus.org'
> I always considered it to be more efficient this way, would
> this be correct?
If I am not mistaken, this methodology will simply dump any hits on spamhaus
rather than score a hit in combination with other scores. Someone can
correct me if I am wrong.
- Skip
I am currently running 3.1.9 of SA on RHEL3. I've noticed several email the
last few days reporting various issues that users are experiencing with
3.2.2. Is this something to be concerned about? Should I update to 3.2.1
instead or does it have its own issues?
- Skip
sin I saw nothing
being done in the maillog. When I switched back to using spamc it appears
to be working again.
> -Original Message-
> From: jdow [mailto:[EMAIL PROTECTED]
> Yes if you are silly enough.
> {^_^}
> - Original Message -
> From: "S
> Getting a ton of false positives today on spamhaus. Generally
> they never get it wrong. Anyone else seeing this or is it just me?
That's a lot of confidence in a system over which you have no control.
- Skip
These are more appropriately procmail questions, but
Do you know if this ruleset will process before or after attempted delivery
to the user (and thus triggering the .forward file)? Is there a difference
between using /usr/bin/spamassassin versus using /usr/bin/spamc ? And can I
still use this r
> Ahhh. Is sa-update compatible with SpamAssassin 3.0.3? Some of us are
still
> using that version for what we feel is a good reason (still using Debian
> Sarge on servers).
I only recently moved to 3.1.9 so I could implement sa-update. I know I was
on a version later than 3.0.3 and was unabl
, but nothing is
>> indicating that I am missing any other dependencies.
>>
>> - Skip
>
>Bummer
>
> Build which way?
>
>You don't give us enough info about your sys and or opsys to help you
>
> - rh
RHEL3, perl 5.8.8, sendmail 8.13, SA 3.1.9
rpmbuild -tb Mail-SpamAssassin-3.2.2.tar.gz throws the error
Thanks.
- Skip
Just as in 3.2.1, I still get this error when trying to build:
REQUIRED module out of date: HTML::Parser
But I already installed HTML::Parser 3.56 with no errors.
I can't be the only one who has received this error, but nothing is
indicating that I am missing any other dependencies.
- Skip
Not sure I agree about banning all attachments, but I would like to ban all
email with fonts as BIG as people can find and those which use any kind of
background stationary.
> Why is it my responsibility as a holder of a valid email address to accept
> mail from anyone who wants to send me the mail? As the owner of the email
> address or, as the admin of the domain's mail server, I have no obligation
to
> accept your mail at all.
> Obligations should be on the sender.
Steven Stern wrote:
> Did you import his key with sa-update --import his.key.file.here
Yes and I found my problem. I missed the last line where I also had to
include the --gpgkey option. I had been thinking that the --import option
took care of it, but is required both.
st address.
- Skip
updates automatically replace my .cf files in
/etc/mail/spamassassin, where I have always kept my rules?
- Skip
t the GPG signature verification
failed.
channel: GPG validation failed, channel failed
I assume I am not the only one who sees this error (or at least who has seen
it). Has anyone successfully addressed this? Or do you simply use the
--nogpg option when running it?
- Skip
l the plugin?
- Skip
My procmail script is set up to junk all emails with a score over 10.0 and
other "low spammy" emails are directed to a generic corporate spam email
account for review. Depending on the volume of email, you may not want to
wait 3 months. I check mine weekly and typically have close to 2000 emails.
/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 1822.
Any ideas? The install didn't report and dependency issues, so I am not
sure where this problem has arisen from.
- Skip
nt to lose any of my
existing configuration.
Thanks for any and all insight!
- Skip
97 matches
Mail list logo
