RE: Better phish detection

2012-03-16 Thread Aaron Bennett
retty good. Regards, David. --- We use it here; I've got a little python script that parses out recent entries from that project and builds a simple postfix static map to block mail attempts to them. I'm happy to share if anyone's interested. - Aaron Bennett Manage

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Aaron Bennett
> -Original Message- > From: Ted Mittelstaedt [mailto:t...@ipinc.net] > Sent: Friday, December 17, 2010 12:20 PM > To: users@spamassassin.apache.org > Subject: Re: preventing authenticated smtp users from triggering PBL > > why are you using authenticated SMTP from trusted networks? > > T

RE: preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Aaron Bennett
turn that on, can I write a rule based on it, or will SA pick up on it automatically? Thanks, Aaron

preventing authenticated smtp users from triggering PBL

2010-12-17 Thread Aaron Bennett
thenticated SMTP/TLS through the 'cmail' host, how can I prevent it from hitting the PBL? Thanks, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

Re: sane values for size of bayes_token database in MySQL

2010-06-29 Thread Aaron Bennett
On 06/29/2010 11:00 AM, Kris Deugau wrote: Aaron Bennett wrote: 1) Are you supposed to have a global Bayes DB? 2) How many users do you have? 3) If the answer to 1) is "yes", did you set bayes_sql_override_username? If the answer to 1) is no, you're probably not running B

sane values for size of bayes_token database in MySQL

2010-06-28 Thread Aaron Bennett
I'm sort of pulling at straws here, but I'm reading the manpage for sa-learn and it says that sa-learn will try to expire bayes tokens according to this: - the number of tokens in the DB is> 100,000 - the number of tokens in the DB is> bayes_expiry_max_db_size - there is

Re: new kind of spam (apparently from mailer daemon)

2010-04-26 Thread Aaron Wolfe
On Mon, Apr 26, 2010 at 4:27 AM, Lucio Chiappetti wrote: > I have just found a new kind of spam which went through our spamassassin > (actually it got a "banned" notification - we quarantine spam and virus but > let banned be delivered). > > The subject was "Delivery reports about your e-mail", th

Re: Off Topic - SPF - What a Disaster

2010-02-23 Thread Aaron Wolfe
On Tue, Feb 23, 2010 at 4:11 PM, Mike Hutchinson wrote: > Hello, > > My company attempted to adopt SPF before I started working here. I recall it > was a recent event when I joined, and I looked into what went wrong (as I > became the mail administrator not long after). Basically the exact same >

Re: Magical mystery colon

2010-01-30 Thread Aaron Wolfe
wow, based on the subject alone, I thought my SA had missed a very strange spam :) On Sat, Jan 30, 2010 at 3:16 PM, Philip A. Prindeville < philipp_s...@redfish-solutions.com> wrote: > I ran "yum update" on my FC11 machine a couple of days ago, and now I'm > getting nightly cron errors: > > plug

Re: Spamassassin, no new version ?

2010-01-19 Thread Aaron Wolfe
On Tue, Jan 19, 2010 at 1:05 PM, Mikael Syska wrote: > Hi, > > On Tue, Jan 19, 2010 at 6:57 PM, Stephane MAGAND > wrote: >> Hi >> >> Since Jun 2008, he don't have a new version of spamassassin ? the project >> are dead ? > > Are you even reading the mailing list? or  3.3.0 should published soon.

Re: OT: Museum piece...

2009-12-16 Thread Aaron Wolfe
suffering from a huge lack of tlc. > > When someone comes over who can be impressed, I go boot the coco3 up, then > come back to this linux box, and over a bluetooth serial emulation, log into > it with minicom.  Just to impress the frogs of course. > Long live the Coco :) At this mom

Re: well, isnt that special...

2009-11-25 Thread Aaron Wolfe
       LOCAL_URI_C_CONTACT     contains link to constant contact > [dot] com > > Got fed up with these clowns a long time ago so I hammer anything from them > on sight. That score is a bit extreme, but I've also found that a small positive score is appropriate for constantcrap mail. -Aaron

Re: HABEAS_ACCREDITED SPAMMER

2009-11-23 Thread Aaron Wolfe
#x27;re receiving spam > from a safelisted IP. > > -- > J.D. Falk > Return Path Inc > > > > As a sort of intolerant b**ch is my interpretation of what you just > said as "Habeas is useless" a reasonable statement? If not, why not? > > {^_^}    Habeas gets a zero score here now. > Habeas accredited spam has been getting a positive score here for some years. -Aaron

aup examples

2009-11-09 Thread Aaron Wolfe
http://basepath.com/aup/ex/ptutil_8c.html

Re: New to Spamassassin. Have a few ?s...

2009-11-08 Thread Aaron Wolfe
On Sun, Nov 8, 2009 at 11:43 PM, Computerflake wrote: > > > >> Directly? No.. SpamAssassin, by itself, is really just a scanning engine >> with header modification abilities. It does not do email management, >> quarantines, etc at all. It receives a message, evaluates it, and >> modifies it based

Re: Constant Contact

2009-10-17 Thread Aaron Wolfe
On Sat, Oct 17, 2009 at 5:47 AM, rich...@buzzhost.co.uk wrote: > On Fri, 2009-10-16 at 13:29 -0700, John Hardin wrote: >> On Fri, 16 Oct 2009, John Rudd wrote: >> >> > Me.  I work for one of their clients (a University).  One or two of >> > our divisions use them for large mailings to our internal

Re: White lists and white rules

2009-10-12 Thread Aaron Wolfe
On Mon, Oct 12, 2009 at 11:50 AM, Marc Perkel wrote: > > > Warren Togami wrote: >> >> On 10/12/2009 09:18 AM, Marc Perkel wrote: >>> >>> For what it's worth there are really only 3 serious white lists on the >>> planet. I'm surprised no one is >>> testing the emailreg list. There are dozens of bla

Re: MagicSpam

2009-09-23 Thread Aaron Wolfe
On Wed, Sep 23, 2009 at 1:40 PM, linuxmagic wrote: > > Slightly old thread, but we should clear any misconceptions.  MagicSpam is > NOT anything like SpamAssassin.  LinuxMagic has been developing Anti-Spam > solutions for the ISP and Telco markets for quite some time, focusing on the > SMTP transa

Re: Problems with high spam

2009-09-23 Thread Aaron Wolfe
dropping after proper adjustment of SA instances. A lot of the time SA spends with a message is just idling waiting on network checks to finish. A local caching nameserver can speed this up. do you use one? probably worth the ram it takes away from SA. Once you limit the # of instances to work within the available RAM, see if the delay is reasonable. good luck -Aaron

Re: Problems with high spam

2009-09-23 Thread Aaron Wolfe
On Wed, Sep 23, 2009 at 2:06 PM, Jose Luis Marin Perez < jolumape...@hotmail.com> wrote: > Dear Sirs > > A few moments ago I noticed that SA was not assigned any score for SPAM > emails, reviewing the log I see this: > > *...@40004aba627c21bee88c [25630] info: spamd: got connection over > /tm

Re: Problems with high spam

2009-09-22 Thread Aaron Wolfe
On Tue, Sep 22, 2009 at 10:21 PM, LuKreme wrote: > On 22-Sep-2009, at 14:42, Aaron Wolfe wrote: > >> Also consider the invalument block lists, see >> http://dnsbl.invaluement.com/ >> A very, very good list that is usable for blocking. Not free, but >> very affor

Re: Problems with high spam

2009-09-22 Thread Aaron Wolfe
On Tue, Sep 22, 2009 at 4:02 PM, Jose Luis Marin Perez wrote: > Dear Sirs. > > Thank you for your answers > > Qmail-Smtpd have the following RBL configured: > > bl.spamcop.net > cbl.abuseat.org > combined.njabl.org Consider zen. It is excellent. Spamcop and NJABL have caused too many false posi

Re: Problems with high spam

2009-09-21 Thread Aaron Wolfe
e online. If the OP were to follow one of them to the letter, I think the detection rate would be much improved. Also some time spent learning more about SA in general would allow the OP to fine tune his config so that the current manual effort put into creating hammer smashing rules is unneeded. Good luck -Aaron

Re: Problems with high spam

2009-09-18 Thread Aaron Wolfe
2009/9/18 Karsten Bräckelmann : > On Sat, 2009-09-19 at 09:48 +1200, Jason Haar wrote: >> On 09/19/2009 09:13 AM, Jose Luis Marin Perez wrote: >> > For more than 1 emails a day how much memory should be the server? >> > as one can calculate the amount of memory needed? >> >> 10,000 a day means

Re: Barracuda RBL in first place

2009-08-14 Thread Aaron Wolfe
On Fri, Aug 14, 2009 at 9:39 PM, LuKreme wrote: > On 14-Aug-2009, at 18:44, Aaron Wolfe wrote: >> >>                The Spamhaus Block List 21.87% (6.74%)             18405091 >>         The Invaluement SIP Block List 22.14% (5.33%)             14557404 > > > What w

Re: Barracuda RBL in first place

2009-08-14 Thread Aaron Wolfe
the checks in front of them, including Spamhaus. That's massive. Barracuda is not used by a majority of clients and is used after the others, so the low number is not an indication of poor performance. I've actually had pretty good luck with it. -Aaron > --

Re: Any one interested in using a proper forum?

2009-07-30 Thread Aaron Wolfe
On Thu, Jul 30, 2009 at 10:07 PM, John Rudd wrote: > On Thu, Jul 30, 2009 at 17:54, Aaron Wolfe wrote: >> On Thu, Jul 30, 2009 at 5:01 PM, ktn wrote: >>> >>> Actually I think Nabble is great for those of us who can't handle the >>> traffic >>&

Re: Any one interested in using a proper forum?

2009-07-30 Thread Aaron Wolfe
On Thu, Jul 30, 2009 at 5:01 PM, ktn wrote: > > Actually I think Nabble is great for those of us who can't handle the traffic > of the whole mailing list. > This list generates less than 50 messages per day on average: http://gmane.org/plot-rate.php/plot.png?group=gmane.mail.spam.spamassassin.g

Re: Any one interested in using a proper forum?

2009-07-28 Thread Aaron Wolfe
Funny that a request for forums would come from nabble... If nabble users are any indication of what a forum would be like, I think it's pretty obvious that posting quality would be crap. Just my $0.02. -Aaron > -- > View this message in context: > http://www.nabble.com/Any-one-interested-in-using-a-proper-forum--tp24697144p24697144.html > Sent from the SpamAssassin - Users mailing list archive at Nabble.com. > >

boosting PBL score suggestions

2009-07-22 Thread Aaron Bennett
suggestion about raising the RCVD_IN_PBL score? I was thinking of raising it as high as 2 or 3. Another thing I'm considering is a META rule that scores for PBL + BAYES_60, etc. I am generally reluctant to mess much with the default scoring -- but I'm always looking for a better se

Re: FWD offlist reply CONSTANT CONTACT

2009-07-06 Thread Aaron Wolfe
+1 for ending this thread On Mon, Jul 6, 2009 at 2:25 PM, rich...@buzzhost.co.uk wrote: >                              From: > Chris Owen >                                To: > rich...@buzzhost.co.uk >                                Cc: > Tara Natanson >                           Subject: > Re:

Re: constantcontact.com

2009-07-03 Thread Aaron Wolfe
On Fri, Jul 3, 2009 at 10:15 AM, Michael Grant wrote: > In defense of Constant Contact, they are in the business of sending > out mailings for people, they are not themselves spammers.  They > perform a service and they do it as best they can given the > circumstances in which they work. > arms de

Re: constantcontact.com

2009-07-03 Thread Aaron Wolfe
On Fri, Jul 3, 2009 at 6:26 AM, Mike Cardwell wrote: > Aaron Wolfe wrote: > >> I think the point was that the URIBL's are never going to be listing >> these domains, so why waste time looking them up > > m...@haven:~$ host constantcontact.com.multi.uribl.com > con

Re: constantcontact.com

2009-07-03 Thread Aaron Wolfe
On Fri, Jul 3, 2009 at 6:11 AM, rich...@buzzhost.co.uk wrote: > On Fri, 2009-07-03 at 12:06 +0200, Yet Another Ninja wrote: >> On 7/3/2009 11:14 AM, rich...@buzzhost.co.uk wrote: >> > On Fri, 2009-07-03 at 10:06 +0100, Justin Mason wrote: >> >> I've heard that they are diligent about terminating ab

Re: constantcontact.com

2009-07-03 Thread Aaron Wolfe
On Fri, Jul 3, 2009 at 5:06 AM, Justin Mason wrote: > I've heard that they are diligent about terminating abusive clients. > Are you reporting these spams to them? > > --j. > >From what I've seen, most of the traffic from them probably doesn't qualify as spam by the common definition. It is, howe

Re: constantcontact.com

2009-07-03 Thread Aaron Wolfe
On Fri, Jul 3, 2009 at 2:39 AM, rich...@buzzhost.co.uk wrote: > I'm probably missing something here - but Constant Contact (who we block > by IP) have been a nagging source of spam for us. I'm just wondering why Could you share your IP list? I'd like to block these clowns too (and I'm lazy). >

Re: opinions on greylisting and others

2009-05-22 Thread Aaron Wolfe
On Fri, May 22, 2009 at 9:06 AM, McDonald, Dan wrote: > On Fri, 2009-05-22 at 14:14 +0200, Arvid Ephraim Picciani wrote: >> Greetings. >> I'm thinking of implementing: >> - greylisting > > very effective.  I cut my incoming mail by about 80% when we put up > greylisting.  I'm using sqlgrey. > >> -

Re: one domain gets 99% of spam

2009-05-19 Thread Aaron Wolfe
On Wed, May 20, 2009 at 1:09 AM, Marc Perkel wrote: > > > option8 wrote: >> >> on my small server setup, i host around 30 domains. between SA and a >> fairly >> aggressive exim setup, very little spam gets through to the end users. >> most >> of it doesn't even get far enough to hit my logs. >> >>

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Aaron Wolfe
On Mon, May 18, 2009 at 11:36 AM, DAve wrote: > Marc Perkel wrote: >> >> Hi Everyone, >> >> My blacklist hostkarma.junkemailfilter.com is rising in the charts. Here's >> a blacklist comparison chart. >> >> http://www.sdsc.edu/~jeff/spam/cbc.html >> > > Those results differ wildly with my stats ove

Re: OpenDNS and Spamassassin

2009-04-02 Thread Aaron Wolfe
clear. If your mail just isn't important then maybe it's a neat thing, but considering how easy it is to set up a working local DNS, I just don't see the value. -Aaron > Allow users to create child networks > > Enable stats and logs > > Enable typo correction

Re: zen.spamhaus.org

2009-03-31 Thread Aaron Wolfe
On Tue, Mar 31, 2009 at 3:25 PM, Mark wrote: > -Original Message- > From: Martin Hepworth [mailto:max...@gmail.com] > Sent: dinsdag 31 maart 2009 20:56 > To: hlug090...@buzzhost.co.uk > Cc: Rejaine Monteiro; Spamassassin list > Subject: Re: zen.spamhaus.org > >> Err no. >> >> spamhaus is g

Re: automated reporting plugin (was Re: HABEAS_ACCREDITED_COI)

2009-03-17 Thread Aaron Wolfe
ese mechanisms work, but surely you could emulate them or use their reporting systems as an example. The code is open source. Good luck, Aaron > -- > J.D. Falk > Return Path Inc > http://www.returnpath.net/ >

Re: HABEAS_ACCREDITED_COI

2009-03-17 Thread Aaron Wolfe
;m seriously considering changing them to 1.0, 0.01, and 0, respectively. >> > >> > I seem to ONLY see the headers in spam messages. It's a shame the defaults >> > in SA are still set absurd values. > > On 17.03.09 02:25, Aaron Wolfe wrote: >> Funny, I mentioned t

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Aaron Wolfe
On Tue, Mar 17, 2009 at 1:42 AM, LuKreme wrote: > On 16-Mar-2009, at 16:40, Chris wrote: >> >> -8.0 HABEAS_ACCREDITED_COI  RBL: Habeas Accredited Confirmed Opt-In or >>                           Better >>                           [208.82.16.109 listed in > > > I changed my HABEAS scores ages ago:

Re: How can this free MX backup service be exploited?

2009-01-21 Thread Aaron Wolfe
On Wed, Jan 21, 2009 at 7:54 PM, Duane Hill wrote: > On Thu, 22 Jan 2009, Steve Freegard wrote: > >> 5) Privacy concerns; potentially a domains entire mail stream for the >> last 5 days could be held on your mail spool. This has obvious privacy >> implications for most people particularly as th

Re: workaround for DNS "search service"

2008-12-29 Thread Aaron Wolfe
On Mon, Dec 29, 2008 at 9:14 AM, Arvid Ephraim Picciani wrote: >>By any chance, didn't your ISP start "providing search service" for any >>web name that does not exist? > > btw, whats the workaround for this? opendns didnt work for me as they have > similar "features". supposedly these can be

Re: Bug in iXhash plugin - fixed version available

2008-12-03 Thread Aaron Wolfe
On Wed, Dec 3, 2008 at 1:57 PM, Arthur Dent <[EMAIL PROTECTED]> wrote: > On Wed, Dec 03, 2008 at 01:08:32PM -0500, Rose, Bobby wrote: >> I just tried again with this 1.5.2 version and on box it times out querying >> and on another it seems to run but no hits again. Both my boxes are SA3.2.5. >> >

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Aaron Wolfe
On Tue, Dec 2, 2008 at 3:59 PM, Marc Perkel <[EMAIL PROTECTED]> wrote: > > > Rick Macdougall wrote: >> >> Marc Perkel wrote: >>>> >>>> >>> >>> Thanks Aaron, that is a good point. But I'm running Exim and I think I >

Re: I'm thinking about offering a free MX backup service

2008-12-02 Thread Aaron Wolfe
ill be difficult given all the different mail servers and different ways they store their user info. You could try to use callouts to the primary to establish whether a user account is valid before accepting the message, but then you arent much of a backup when the primary goes down. It isn't crazy but it is not trivial to do backup mx well. -Aaron

Re: New free blacklist: BRBL - Barracuda Reputation Block List

2008-09-24 Thread Aaron Wolfe
On Wed, Sep 24, 2008 at 5:41 PM, <[EMAIL PROTECTED]> wrote: > On Tue, 23 Sep 2008, McDonald, Dan wrote: > >> On Tue, 2008-09-23 at 17:21 -0400, [EMAIL PROTECTED] wrote: >>> >>> Getting back to the subject...can anyone enlighten us to the efficacy of >>> this DNSBL? For example, how does it compar

Re: MagicSpam

2008-09-11 Thread Aaron Wolfe
On Thu, Sep 11, 2008 at 1:11 PM, <[EMAIL PROTECTED]> wrote: > Does anybody have any experience with this product? > It appears *noone* has any experience with it... Google finds only 2 links and they are on the company's own homepage. > My company wants to replace SpamAssassin with this product,

Re: senderbase rating - how to appeal?

2008-09-05 Thread Aaron Wolfe
On Fri, Sep 5, 2008 at 5:45 PM, Greg Troxel <[EMAIL PROTECTED]> wrote: > > "Michele Neylon :: Blacknight" <[EMAIL PROTECTED]> writes: > >> Does anyone know how you can appeal or query a senderbase rating? > > I resisted answering at first, because I'm perhaps a bit too cynical: > > The way to appe

Re: Handy script for generating /etc/resolv.conf

2008-09-01 Thread Aaron Wolfe
On Mon, Sep 1, 2008 at 3:43 AM, Marc Perkel <[EMAIL PROTECTED]> wrote: > > > Aaron Wolfe wrote: >> >> On Sun, Aug 31, 2008 at 10:59 PM, RobertH <[EMAIL PROTECTED]> wrote: >> > >>> It was explained somewhere earlier in the thread that he sometim

Re: Handy script for generating /etc/resolv.conf

2008-08-31 Thread Aaron Wolfe
rver on any busy MX or SA server seems to solve this issue quite well without needing any scripts. If you are rsyncing any zones from zen, etc. having the zone served up locally is awesome for quick lookups too. -Aaron

Re: Blacklist Mining Project - Project Tarbaby

2008-08-26 Thread Aaron Wolfe
if your software giving the temp fail doesn't work properly? What if a broken MTA sends the message even after you temp fail? What if you turn into a Real Bad Guy? There is also the issue that even if you do temp fail, even the knowledge of which servers are trying to connect to my client's domains may not be something they want you to gather. As many have stated: if you are truly interested in this, get a client together, preferably open source, that sends only the neccesary data to your site. -Aaron

Re: Blacklist Mining Project - Project Tarbaby

2008-08-25 Thread Aaron Wolfe
r.com/index.php/Project_tarbaby > > Definitely looking for feedback from people who try it out. > > > > Is it just me , or am I having déjà vu, I could swear I have read this > message before - > This is at least 3 times. There was at least once a response thread discussing why most people are not interested in adding MX records that direct their mail to someone else. -Aaron

sa-update, dostech, / RHEL5 question

2008-06-06 Thread Aaron Bennett
k. I'm getting this error when I run with debugging: [20790] dbg: dns: query failed: 4.2.3.72_sare_bml_post25x.cf.sare.sa-update.dostech.net => NOERROR Thanks for any suggestions - Aaron Bennett Here's the complete output of the sa-update: [EMAIL PR

Re: reject vs. delete

2008-05-23 Thread Aaron Wolfe
x27;s mailbox, but I never just throw anything away after saying I will deliver it. There are plenty of sites that do silently throw away mail, and plenty that will reject. unless you are a *really* big site I really don't think spammers are going to care what you do, if they notice at all. I&#x

Re: VBounce ruleset

2008-05-14 Thread Aaron Bennett
x27;m glad to have a confirmation that 0.1 is obviously not enough but I'm curious how others are scoring these rules; given a general spam target of 5. I'm thinking of scoring in the range of 1.5 - 2... Best, Aaron Bennett

VBounce ruleset

2008-05-14 Thread Aaron Bennett
ault scores, or have you tweaked them at all? Best, Aaron Bennett

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Aaron Wolfe
On Wed, May 7, 2008 at 5:44 PM, John Hardin <[EMAIL PROTECTED]> wrote: > On Wed, 7 May 2008, Aaron Wolfe wrote: > > If you just want IPs, maybe instead of running an SMTP service that 450s, > > you would want to use a packet filter like iptables instead. You could get >

Re: Experimental - use my server for your high fake MX record

2008-05-07 Thread Aaron Wolfe
eir high numbered MX record gets some spam reduction. I'm not > interested in the content of the message or anything other than catching the > IP addresses of virus infected spam bots. That's all I want to do. > > If you just want IPs, maybe instead of running an SMTP service that 450s, you would want to use a packet filter like iptables instead. You could get the IPs simply by what packets you saw come in to port 25 and noone would have to worry you were stealing their mail. -Aaron

Re: AWL Database Cleanup

2008-04-28 Thread Aaron Bennett
listmail wrote: I noticed that the AWL database was getting rather large, so I used the check_whitelist script to remove the stale entries. While this seems to have removed a lot of entries from the database, it did not reduce the database size. If you are using MySQL with the Innodb backend

Re: relays.ordb.org returning positive for everything?

2008-04-16 Thread Aaron Wolfe
not a trivial task. Spam is a moving target. Your config may need frequent adjustment and a close eye on the logs to keeps things working well. Since you're not interested in committing time to this task, why not use one of the many services that can do this work for you? They are generally inexpensive and easy to use. -Aaron

Re: relays.ordb.org returning positive for everything?

2008-03-26 Thread Aaron Wolfe
On Wed, Mar 26, 2008 at 12:10 PM, mouss <[EMAIL PROTECTED]> wrote: > nws.charlie wrote: > > I guess I'm one of the mail admin wannabe's... not by choice, but by > > inheritance. It was turned over to me with almost zero training or > > experience. :( > > I found the initial posts clear, and had

Re: relays.ordb.org returning positive for everything?

2008-03-26 Thread Aaron Wolfe
On Wed, Mar 26, 2008 at 2:23 AM, Dave Funk <[EMAIL PROTECTED]> wrote: > On Tue, 25 Mar 2008, John Rudd wrote: > > > Aaron Wolfe wrote: > >> On Tue, Mar 25, 2008 at 11:50 PM, John Rudd <[EMAIL PROTECTED]> wrote: > >>> A postmaster who doe

Re: relays.ordb.org returning positive for everything?

2008-03-25 Thread Aaron Wolfe
On Tue, Mar 25, 2008 at 11:50 PM, John Rudd <[EMAIL PROTECTED]> wrote: > mouss wrote: > > ajx wrote: > >> It seems your logic is fundamentally flawed for several reasons. By > >> returning false positives, you're breaking mail gateways that use this > >> once > >> useful service. On the contr

Re: relays.ordb.org returning positive for everything?

2008-03-25 Thread Aaron Wolfe
On Tue, Mar 25, 2008 at 3:23 PM, Per Jessen <[EMAIL PROTECTED]> wrote: > > Aaron Wolfe wrote: > > > It seems like relays.ordb.org (long dead) has started returning > > positive answers for *all* IPs. > > Today I've had several clients with old configs

relays.ordb.org returning positive for everything?

2008-03-25 Thread Aaron Wolfe
It seems like relays.ordb.org (long dead) has started returning positive answers for *all* IPs. Today I've had several clients with old configs which still had this RBL in them suddenly start blocking everything. Is this a new thing? Maybe the maintainers were tired of all the queries.

Re: New Postfix compatible BLACK LIST

2008-03-21 Thread Aaron Wolfe
s here for about a month. While there are certainly some FPs (do not use it as a blocklist!), I've been using it to add a small amount to the spam score with decent results. There are a number of messages that get pushed over the threshold thanks to hits on hostkarma. I deal with US mail primarily, maybe that is the difference. -Aaron

Re: How to report 120,000 spams

2008-03-09 Thread Aaron Wolfe
real accounts. The scanner would end up biased towards whatever junk the spammers desperate enough to use dictionaries send, which would drown out the stats from those spams that are actually difficult to detect. Why do you accept messages for non existent accounts? You're wasting bandwidth, regardless of what you do or don't do with the junk after you accept it. From the sound of it you could reduce your mail bandwidth to a tiny fraction of what it is now by just refusing this stuff (which is what most everyone else does, AFAIK). -Aaron

Re: Quick Postfix Question [OT]

2008-02-27 Thread Aaron Wolfe
On Wed, Feb 27, 2008 at 3:12 PM, Henrik K <[EMAIL PROTECTED]> wrote: > On Wed, Feb 27, 2008 at 03:00:49PM -0500, Aaron Wolfe wrote: > > On Wed, Feb 27, 2008 at 2:50 PM, Bob Proulx <[EMAIL PROTECTED]> wrote: > > > Marc Perkel wrote: > > > > It appears

Re: Quick Postfix Question [OT]

2008-02-27 Thread Aaron Wolfe
th this program; if not, write to the Free Software Foundation, Inc., #51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # hacked up to query hostkama # by aaron <[EMAIL PROTECTED]> use strict; use IO::Handle; use

Re: Bogus MX -> blacklist service viable?

2008-02-22 Thread Aaron Wolfe
On Fri, Feb 22, 2008 at 7:55 AM, Marc Perkel <[EMAIL PROTECTED]> wrote: > > > > Aaron Wolfe wrote: > > On Thu, Feb 21, 2008 at 11:47 PM, Marc Perkel <[EMAIL PROTECTED]> wrote: > > > Steve Radich wrote: > > Sorry; apparently I was unclear. > &

Re: Bogus MX -> blacklist service viable?

2008-02-21 Thread Aaron Wolfe
This combination creates a highly reliable blacklist and > I'm currently tracking about 1.1 million virus infected spambots that > have tried to spam me in the last 4 days. > > It's my hostkarma list. > > Sounds interesting.. do you block based on this list or just use it for scoring in SA or something like that? What is the false positve rate? -Aaron >

Re: [OT] Bogus MX opinions

2008-02-20 Thread Aaron Wolfe
g here)... the proponents seem to be actually using nolisting and claiming no problems, whilst those against the idea seem to be predicting problems rather than reporting on actual issues they have experienced. -Aaron

Re: Advice on MTA blacklist

2007-10-09 Thread Aaron Wolfe
On 10/9/07, R.Smits <[EMAIL PROTECTED]> wrote: > > Hello, > > Which spam blacklists do you use in your MTA config. (postfix) > smptd_client_restrictions > > Currently we only use : reject_rbl_client list.dsbl.org > > We let spamassassin fight the rest of the spam. But the load of spam is > getting

Re: Advice on MTA blacklist

2007-10-09 Thread Aaron Wolfe
and they usually let me know pretty quickly when there's a problem. I do use dnswl.org to whitelist before RBLs. You might still not want to use spamcop to reject if you're paranoid (and I'll agree they've been overly agressive in the past), but I think it's very safe to use in SA. btw this article is what convinced me to give spamcop a second look: http://www.dnsbl.com/2007/05/spamcop-bl-another-look-its-accurate.html -Aaron

Re: Handling Spam Surges

2007-09-10 Thread Aaron Wolfe
> At my site we operate under the presumption that SpamAssassin should be avoided if at all possible because it is so expensive on our resources compared to some other easy checks. This helps us to deal with DoS and "surges" from retarded bots quite well (so far at least). We reduce the messages bound for SA to less than 10% of our traffic by a combination of postfix UCE checks, a couple very accurate RBLs, selective greylisting and our own whitelist. When the surges/DOS happen, they tend to increase the number of messages thrown away but rarely effect the volume running through SA. -Aaron

Re: [OT] Seeing increase in smtp concurrency ?

2007-09-06 Thread Aaron Wolfe
smtpd_timeout = 45s > > > Some people are even using 10 seconds, which seems short to me. The RFC > requires 300 seconds. > > Jeff C. > Same problem here on several servers. Reducing the timeout helps, but violates RFC and is simply reducing the effects rather than fixing the issue. Is there any RFC valid way for a server to hang up on a client, especially after a 5xx? -Aaron

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

2007-08-28 Thread Aaron Wolfe
27;re not getting flooded with complaints. I tried it with a single small domain (less than 30 mailboxes) and didn't make it 2 business days. We'd all like to find that magic button to stop spam, but this aint it. -Aaron

Re: Email forwarding and RBL trouble

2007-08-22 Thread Aaron Wolfe
On 8/22/07, Rense Buijen <[EMAIL PROTECTED]> wrote: > > Thanks a lot all, it's all clear to me now! > I though that the trusted networks mean that the message will just be > passed it it came from that source. > I didnt know it will skip to the next "Received" IP. Thanks a lot. > > One question abo

Re: Conditionally bypassing RBL checks - how?

2007-08-18 Thread Aaron Wolfe
Just take away the scores for the individual RBLs, and your yellow list as another RBL, and use metarules to score. -Aaron On 8/18/07, Marc Perkel <[EMAIL PROTECTED]> wrote: > I have what I call a yellow list which is a list of IP addresses of > hosts like yahoo, google, hotma

Re: Question - How many of you run ALL your email through SA?

2007-08-16 Thread Aaron Wolfe
On 8/16/07, Marc Perkel <[EMAIL PROTECTED]> wrote: > > OK - it's interesting that of all of you who responded this is the only > person who is doing it right. I have to say that I'm somewhat surprised that > so few people are preprocessing their email to reduce the SA load. As we all > know SA is

Re: Question - How many of you run ALL your email through SA?

2007-08-16 Thread Aaron Wolfe
On 8/16/07, Dave Mifsud <[EMAIL PROTECTED]> wrote: > On 16/08/07 08:45, Aaron Wolfe wrote: > > I agree and have yet another similar setup here. We reject about 80% > > as well, which helps reduce the load on the servers and on the users > > who manage their quarantine

Re: Question - How many of you run ALL your email through SA?

2007-08-15 Thread Aaron Wolfe
ect filtering only, or full content filtering with SA. A surprising number prefer to use just the more basic checks and deal with what gets through with their mua. -Aaron

Re: fake MX records

2007-08-15 Thread Aaron Wolfe
;fault" for violating the RFCs but the > > mail is still lost, and it isn't easy to explain whats going on to > > your users/customers. Greylisting gives me about the same effect but > > it works with a bigger percentage of borken servers and I can easily > > exc

Re: fake MX records

2007-08-15 Thread Aaron Wolfe
s not available, you will simply lose mail from some senders. It's entirely their "fault" for violating the RFCs but the mail is still lost, and it isn't easy to explain whats going on to your users/customers. Greylisting gives me about the same effect but it works with a bigger percentage of borken servers and I can easily exclude broken mailservers if needed. -Aaron

Re: Mail server hosted by Comcast

2007-08-10 Thread Aaron Wolfe
On 8/10/07, Jonn R Taylor <[EMAIL PROTECTED]> wrote: > > Jerry Durand wrote: > > At 01:28 PM 8/10/2007, Igor Chudov wrote: > >> I am considering a local deal related to hosting by Comcast cable > >> (8mbps down, 1 mbps up). > >> > >> I am concerned, however, with me sending email and being on comca

Re: Bayesian DB problem?

2006-08-29 Thread Aaron Hill
and my sanity appreciate that. :) Aaron - Original Message - From: "Theo Van Dinter" <[EMAIL PROTECTED]> To: Sent: Tuesday, August 29, 2006 12:47 PM Subject: Re: Bayesian DB problem? On Tue, Aug 29, 2006 at 12:44:42PM -0400, Aaron Hill wrote: bayes_path /etc/spamassa

Bayesian DB problem?

2006-08-29 Thread Aaron Hill
m I doing wrong? I've done a lot of googling but have had no luck with getting any useful results. I was hoping someone on this list is familiar with the Bayes token DB's and could point me to why it's not working this time.   Thanks! Aaron  

Re: Rejection text

2006-07-11 Thread aaron
ge? Sendmail milter with Mimedefang etc allows you to do this. Cheers, Aaron > > -- > John Hardin KA7OHZICQ#15735746http://www.impsec.org/~jhardin/ > [EMAIL PROTECTED]FALaholic #11174pgpk -a [EMAIL PROTECTED

Re: sa-learn --username option

2006-06-07 Thread Aaron Axelsen
still tries to learn as root Is there some reason for this? Any suggestions? -- Aaron Matt Kettler wrote: > Aaron Axelsen wrote: > >> Hello, >> >> I am trying to run a cronjob as root which will learn a different >> accounts spam into my spam db. Example command:

sa-learn --username option

2006-06-06 Thread Aaron Axelsen
have any idea why its doing this? The user1 .spamassassin folder is chown user1.user and has permissions 700. Are the permissions a problem? I see there is a --spam-db option. Do I need to use this? -- Aaron Axelsen [EMAIL PROTECTED] Great hosting, low prices. Modevia Web Services LLC

Re: Score ends in +10?

2006-05-23 Thread Aaron Grewell
if a match > is found on the sender [EMAIL PROTECTED] > Ah, I see. I'll have to see if I can get amavislogsumm to use X-Spam-Score instead. Thanks Gary! -Aaron

Re: Score ends in +10?

2006-05-23 Thread Aaron Grewell
> > > Is that a score SA is generating, or do I need to redirect this to the > > amavisd-new list? > > That's an amavis log entry, so you'd have to ask them. OK, will do. Thanks Theo. -Aaron

Score ends in +10?

2006-05-23 Thread Aaron Grewell
, MSGID_FROM_MTA_ID=1.393, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, TO_BE_REMOVED_4=1] Is that a score SA is generating, or do I need to redirect this to the amavisd-new list? Thanks, -Aaron

Re: Delete spam or move to a folder?

2006-05-17 Thread aaron
tten for administration purposes and to track down emails when there is a complaint or query. So by default we keep everything and provide mechanisms for our staff to recover an email if required. The ability to customise SpamAssassin and Mimedefang has been invaluable for us. Cheers, Aaron

Re: Big Idiot Needs Instructions

2006-05-11 Thread aaron
but I have had a lot > of gigo since then. > > Thanks for any help > > <> I use procmail with great success. I also use the SpamAssassin > ClamAV plugin. (See plugins on the wiki.) > > {^_^} I run SpamAssassin via MimeDefang. Is there anything in particular you are having problems with? Cheers, Aaron

Remove Me

2006-05-09 Thread Aaron Boyles
How do I take myself off this mailing list? -Javin

  1   2   >