* Craig White <[EMAIL PROTECTED]>:
> I think the basis of Wietse's recommendation is a philosophical one and
> while pertinent to his line of thinking, MailScanner seems to me to be
> the easiest to install, the most effective when properly installed, the
> most frequently updated scanning wrapper
* Kurt Buff <[EMAIL PROTECTED]>:
> Some of the most knowledgable users on the postfix list, especially
> those with very large installations, have forsworn the use of
> mailscanner for that very reason, as they have seen definite problems
> with it.
Basically I fail to see why I should use mailsc
Dear All,
Fresh installed FC4 (with updated), spamassassin (spamassassin-3.0.4-2.fc4) +
milter(spamass-milter-0.3.0-8.fc4) + sendmail (sendmail-8.13.4-2) + clamav and
its milter (clamav-0.88-1.fc4 etc), those work fine.
Spamassasin used a separate log file (at /etc/sysconfig/spamassassin, '-
From: "Chris Purves" <[EMAIL PROTECTED]>
The attached newsletter is triggering the following rules:
X-Spam-Report:
* 0.6 SARE_BAYES_5x7 BODY: Bayes poison 5x7
* 0.8 SARE_BAYES_7x7 BODY: Bayes poison 7x7
* 0.6 SARE_BAYES_6x7 BODY: Bayes poison 6x7
* 1.4 HTML_OBFUSCATE_05_10 BODY: Message is
You're lucky it scored that low. Most of these airline things come in at
aronud 40 points on my system, they have such bad HTML formatting.
The BAYES_x_y rules are looking for a pattern of y-letter words repeated at
least x times. This is virtually impossible in any human language that
isn't enc
Hello Chris,
Wednesday, March 8, 2006, 2:37:47 AM, you wrote:
CP> The attached newsletter is triggering the following rules:
CP> X-Spam-Report:
CP> * 0.6 SARE_BAYES_5x7 BODY: Bayes poison 5x7
CP> * 0.8 SARE_BAYES_7x7 BODY: Bayes poison 7x7
CP> * 0.6 SARE_BAYES_6x7 BODY: Bayes pois
Hello John,
Tuesday, March 7, 2006, 10:35:37 AM, you wrote:
SJ> Yes, I do do most of these things... SARE, URIBLs, bayes, AWL. No, it
SJ> doesn't require much attention. However, it's time to upgrade and THAT is
SJ> what is going to take a bunch of my time. We need new hardware (the thing is
SJ>
Hello Phil,
Tuesday, March 7, 2006, 5:30:16 AM, you wrote:
RP> My experience of the SARE Stock rules to date hasn't been
RP> good. They score way too low to kick stuff into the high score
RP> region even with the help of Bayes.
RP>
RP> What's probably needed is two sets of rules or scores for
I keep getting these drug emails that antidrug.cf is suppose to catch
but it's not. The emails are scoring low. I've updated the antidrug.cf
rule. I've done sa-learn on them but we are still being inundated with
these "news" emails. What can I do to get these to stop?
Here is the header from o
Sorry for the delay, I have re-installed everything looks good, but just no
luck.
-Original Message-
From: Drew Burchett [mailto:[EMAIL PROTECTED]
Sent: Wednesday, March 01, 2006 1:47 PM
To: SpamAssassin
Subject: RE: Problem with SA / Razor
Sounds like Razor2 isn't installed correctly
Hello,
I'm currently using spamassassin in a postfix+amavisd smtp gateway,
filtering mail then forwarding them to an IMAP server.
I'm looking for a way to specify per user, which .cf files it could use
or not use.
For instance, I put some custom_rules.cf files in
/usr/local/share/spamassas
im currently trying to implement spamassassin into our mail server and
am running into problems im hoping you can help me with. our current
setup is running
gentoo/qmail/vpopmail/qmail-scanner/courier-imap/clamav/tmda. i have
reinstalled qmail-scanner so that it can pickup that SA is installed,
an
On Wed, Mar 08, 2006 at 04:39:24AM -0800, Robert Menschel wrote:
> No, what might be useful is one set of rules, and two sets of scores,
> one for systems (ISPs and large companies) which receive stock-related
> ham, and another for those of you who have nothing to do with USA
> stock markets.
Arg
Does the message body contain "mangled" (deliberately misspelled) drug
names? If so, you might find the mangled.cf ruleset at
http://www.rulesemporium.com/other-rules.htm to be useful - it helps my
setup a lot with those sorts of spams, especially the drug ones. You might
even consider increasi
We're also being bombarded with these and I noticed that the bottom received
header on all of them is in a format like
Received: from [87.245.169.135] (port=2971 helo=aflmpt)
by amdy with esmtp
id 1FGG09-0005lZ-7J
I put in a rule to catch this:
header ODD_PORT_SS Received =~ /from \[\d{1,3
jdow wrote:
>
> Don't know about those scores. But it mentions doubleclick, which
> SHOULD score a solid 10 in any SA rule set.
Unless the administrator involved actually has any users who want
commercial mail of any sort.
As much as I despise doubleclick, they are unfortunately commonly used
on *
Sandy S wrote:
> We're also being bombarded with these and I noticed that the bottom
> received header on all of them is in a format like
>
> Received: from [87.245.169.135] (port=2971 helo=aflmpt)
> by amdy with esmtp
> id 1FGG09-0005lZ-7J
>
> I put in a rule to catch this:
> header ODD_P
- Original Message -
From: "Larry Rosenman"
To: "'Sandy S'" <[EMAIL PROTECTED]>;
Sent: Wednesday, March 08, 2006 10:13 AM
Subject: RE: All image spam
> Sandy S wrote:
> > We're also being bombarded with these and I noticed that the bottom
> > received header on all of them is in a for
Sandy S wrote:
> - Original Message -
> From: "Larry Rosenman"
> To: "'Sandy S'" <[EMAIL PROTECTED]>;
> Sent: Wednesday, March 08, 2006 10:13 AM
> Subject: RE: All image spam
>
>
>> Sandy S wrote:
>>> We're also being bombarded with these and I noticed that the bottom
>>> received heade
> I'm currently using spamassassin in a postfix+amavisd smtp gateway,
> filtering mail then forwarding them to an IMAP server.
>
> I'm looking for a way to specify per user, which .cf files it
> could use
> or not use.
>
> For instance, I put some custom_rules.cf files in
> /usr/local/share/spamass
Nick Smith wrote:
im currently trying to implement spamassassin into our mail server and
am running into problems im hoping you can help me with. our current
setup is running
gentoo/qmail/vpopmail/qmail-scanner/courier-imap/clamav/tmda. i have
reinstalled qmail-scanner so that it can pickup that
Bret Miller a écrit :
I'm currently using spamassassin in a postfix+amavisd smtp gateway,
filtering mail then forwarding them to an IMAP server.
I'm looking for a way to specify per user, which .cf files it
could use
or not use.
For instance, I put some custom_rules.cf files in
/usr/local/
A co-worker of mine just pointed this out to me today. He tested it in
Thunderbird and I tested it in OE6. It warrants serious attention.
Ignoring the munged part, this would trick a very savvy internet user that
allows HTML email, clicks on a link and doesn't check the browser address
line.
An
> >
> > my @scanners_installed=("clamdscan_scanner","perlscan_scanner");
> > my @scanners_default=("clamdscan_scanner","perlscan_scanner");
> >
> >
>
> This is the problem right here. There is no mention of spamassassin in
> the installed scanners. This means that when you ran ./configure for
> q
Nick Smith wrote:
my @scanners_installed=("clamdscan_scanner","perlscan_scanner");
my @scanners_default=("clamdscan_scanner","perlscan_scanner");
This is the problem right here. There is no mention of spamassassin in
the installed scanners. This means that when you ran ./configure for
qmail-
Kevin A. McGrail wrote:
> A co-worker of mine just pointed this out to me today. He tested it
> in Thunderbird and I tested it in OE6. It warrants serious attention.
>
> Ignoring the munged part, this would trick a very savvy internet user
> that allows HTML email, clicks on a link and doesn't c
Here is a list of the rulesets that I'm using:
70_sare_adult.cf 70_sare_unsub.cf
70_sare_bayes_poison_nxm.cf 70_sare_uri0.cf
70_sare_evilnum0.cf 70_sare_uri1.cf
70_sare_evilnum1.cf 70_sare_uri3.cf
70_sare_evilnum2.cf 70_sare_uri.cf
70_sare_genlsubj0.cf
On Wed, Mar 08, 2006 at 11:47:49AM -0600, Tracey Gates wrote:
> Here is a list of the rulesets that I'm using:
>
> 70_sare_adult.cf 70_sare_unsub.cf
> 70_sare_bayes_poison_nxm.cf 70_sare_uri0.cf
[...]
>
> How do I tell if I have URIBL lookups enabled?
Those are the third party rules
Tracey Gates wrote:
> Here is a list of the rulesets that I'm using:
>
> 70_sare_adult.cf 70_sare_unsub.cf
> 70_sare_bayes_poison_nxm.cf 70_sare_uri0.cf
> 70_sare_evilnum0.cf 70_sare_uri1.cf
> 70_sare_evilnum1.cf 70_sare_uri3.cf
> 70_sare_evilnum2.cf 70_sare
OMG!
What kind of server are you running this on?
- Original Message -
From: "Tracey Gates" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, March 08, 2006 10:47 AM
Subject: RE: Drug email keeps getting thru
| Here is a list of the rulesets that I'm using:
|
| 70_sare_adult.cf
Hi,
I am still getting many spams with Subject: The Ultimate Online
Pharmaceutical. Can someone suggest anything for them?
I canot attach the body here because then the list is rejecting my mail.
With warm regards,
-Payal
On Wed, Mar 08, 2006 at 01:45:26PM -0500, Payal Rathod wrote:
> I am still getting many spams with Subject: The Ultimate Online
> Pharmaceutical. Can someone suggest anything for them?
> I canot attach the body here because then the list is rejecting my mail.
I don't think anyone can make suggest
Payal Rathod wrote:
> Hi,
> I am still getting many spams with Subject: The Ultimate Online
> Pharmaceutical. Can someone suggest anything for them?
> I canot attach the body here because then the list is rejecting my mail.
> With warm regards,
> -Payal
>
Here's a simple rule I use:
header L_S_
In my procmail log I am getting a load of the error message below &
spamassassin is clearly not doing baysian checking.
---
[14539] warn: bayes: cannot open bayes databases
/home/steve/.spamassassin/bayes_* R/W: lock failed: File exists
--
Quoting steve downes <[EMAIL PROTECTED]>:
> In my procmail log I am getting a load of the error message below &
> spamassassin is clearly not doing baysian checking.
>
> ---
> [14539] warn: bayes: cannot open bayes databases
> /home/steve/.spamassass
Matt Kettler wrote:
Payal Rathod wrote:
Hi,
I am still getting many spams with Subject: The Ultimate Online
Pharmaceutical. Can someone suggest anything for them?
I canot attach the body here because then the list is rejecting my mail.
With warm regards,
-Payal
Here's a simple rule I use:
Iam using spamassassin last one..
Slackware and qmail..
last time iam receiving this mesages when i try to send a email with
atachements or images at body..
spamassassin: message too big - skip it
/var/spool/qmailscan/tmp/nisyros11418515427221191/clip_image062.jpg: OK
/var/spool/qmailscan/
[EMAIL PROTECTED] wrote:
Iam using spamassassin last one..
Slackware and qmail..
last time iam receiving this mesages when i try to send a email with
atachements or images at body..
By default SA does not scan anything over 250k, it's not a problem.
Regards,
Rick
On Wednesday, March 8, 2006, 9:14:57 AM, Kevin McGrail wrote:
> A co-worker of mine just pointed this out to me today. He tested it in
> Thunderbird and I tested it in OE6. It warrants serious attention.
> Ignoring the munged part, this would trick a very savvy internet user that
> allows HTML e
The following just blew past in my maillog. This doesn't seem to be an
isolated incident.
# grep Util.pm /var/log/maillog | wc -l
22581
What's broken?
==
Mar 8 17:01:11 enoch spamd[13279]: Argument "a" isn't numeric in pack
at /usr/lib/perl5/site_perl/5.8
On 08/03/06 06:07 PM, subscribed-lists wrote:
The following just blew past in my maillog. This doesn't seem to be an
isolated incident.
# grep Util.pm /var/log/maillog | wc -l
22581
What's broken?
Nothing really.
==
Mar 8 17:01:11 enoch spamd[13279]: Argum
Have you run "spamassassin --lint"? What does it tell you.
Have you run "spamassassin -d --lint"? What does it tell you.
How are you running spamd? Does it bear any resemblance to what you would
get (as a user not root) with the above two commands?
Barring this you have included no information t
On Wed, Mar 08, 2006 at 05:07:50PM -0600, subscribed-lists wrote:
> What's broken?
>
> Mar 8 17:01:11 enoch spamd[13279]: Argument "a" isn't numeric in pack
> at /usr/lib/perl5/site_perl/5.8.6/Mail/SpamAssassin/Util.pm line 711,
> line 46.
http://issues.apache.org/SpamAssassin/show_bug.cgi?i
On 08/03/06 06:17 PM, Theo Van Dinter wrote:
On Wed, Mar 08, 2006 at 05:07:50PM -0600, subscribed-lists wrote:
What's broken?
Mar 8 17:01:11 enoch spamd[13279]: Argument "a" isn't numeric in pack
at /usr/lib/perl5/site_perl/5.8.6/Mail/SpamAssassin/Util.pm line 711,
line 46.
http://issues.
On Wednesday 08 March 2006 12:14, Kevin A. McGrail wrote:
>A co-worker of mine just pointed this out to me today. He tested it
> in Thunderbird and I tested it in OE6. It warrants serious
> attention.
>
>Ignoring the munged part, this would trick a very savvy internet user
> that allows HTML emai
On Saturday, March 4, 2006, 6:29:27 AM, Rob McEwen wrote:
> I have an e-mail address of a former employee of a client of mine that I use
> (with permission) to monitor spam since this address receives MUCH spam. Of
> course, it is within the realm of possibility that some of this was actually
> sub
--On Wednesday, March 08, 2006 2:24 PM -0800 Jeff Chan <[EMAIL PROTECTED]>
wrote:
It's an interesting use, but I don't believe it would confuse
SpamAssassin, etc. The second URI should be visible enough to be
checked, and I added the IP to ph.surbl.org.
Is there an SA rule that checks for ne
Hey all,
I recently tried to turn on SQL on my SA 3.1.0 installation.
Apparently user prefs are okay, but the lines that are supposed to turn on
the other two modules don't want to load.
I copied the config lines almost verbatim from an existing (working) SA
3.1 server, into local.cf:
Mar
On Wed, Mar 08, 2006 at 04:25:40PM -0800, Kenneth Porter wrote:
> >It's an interesting use, but I don't believe it would confuse
> >SpamAssassin, etc. The second URI should be visible enough to be
> >checked, and I added the IP to ph.surbl.org.
>
> Is there an SA rule that checks for nested ancho
Dan Mahoney, System Admin wrote:
> Hey all,
>
> I recently tried to turn on SQL on my SA 3.1.0 installation.
>
> Apparently user prefs are okay, but the lines that are supposed to
> turn on the other two modules don't want to load.
>
> I copied the config lines almost verbatim from an existing (wor
On Wed, 8 Mar 2006, Matt Kettler wrote:
That fixed half of it.
Dan Mahoney, System Admin wrote:
Hey all,
I recently tried to turn on SQL on my SA 3.1.0 installation.
Apparently user prefs are okay, but the lines that are supposed to
turn on the other two modules don't want to load.
I copied
Loren Wilton wrote:
The other rule is looking for a really standard spammer trick:
.
Interesting. How is this helpful to spammers?
--
Good day, eh.
Chris
On Tue, 7 Mar 2006, Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin wrote:
=item languages_filename
If you want to be able to use the language-guessing rule
C, and are using C instead of
C, C, and C, you
[...]
I'm NOT using rules_text though, unl
On 08/03/06 09:17 PM, Dan Mahoney, System Admin wrote:
On Tue, 7 Mar 2006, Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin
wrote:
[Odd SQL Error]
The only VERY ODD error I am seeing now (and only for ONE user) is this:
Mar 7 20:19:12 quark spa
On Wed, Mar 08, 2006 at 09:17:52PM -0500, Dan Mahoney, System Admin wrote:
> >>Mar 7 20:19:12 quark spamd[83564]: config: failed to parse line,
> >>skipping: rewrite_subject_0
> >Why are these odd? None of these are valid config lines for 3.1.
>
> Because my configs are in a SQL database, and fo
Greetings.
I use Fetchmail to fetch mail from various POP3 and IMAP accounts and
Procmail to pipe the retrieved mail through SpamAssassin (using spamd).
This works fine, except that the first few messages fetched after booting
don't seem to get processed by SpamAssassin. This means I end up with
On Wed, 8 Mar 2006, Daryl C. W. O'Shea wrote:
On 08/03/06 09:17 PM, Dan Mahoney, System Admin wrote:
On Tue, 7 Mar 2006, Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin wrote:
[Odd SQL Error]
Just because the configs are in a SQL database, doesn
--On Wednesday, March 08, 2006 8:40 PM -0500 Theo Van Dinter
<[EMAIL PROTECTED]> wrote:
Not in SA proper. For curiosity sake, I wrote up a quick rule to test
it out:
MSECSSPAM% HAM% S/ORANK SCORE NAME
027920 49400.850 0.000.00 (all messages)
1.400
Theo Van Dinter wrote:
> On Wed, Mar 08, 2006 at 09:17:52PM -0500, Dan Mahoney, System Admin wrote:
Mar 7 20:19:12 quark spamd[83564]: config: failed to parse line,
skipping: rewrite_subject_0
>>> Why are these odd? None of these are valid config lines for 3.1.
>> Because my configs are
From: "Kenneth Porter" <[EMAIL PROTECTED]>
--On Wednesday, March 08, 2006 8:40 PM -0500 Theo Van Dinter
<[EMAIL PROTECTED]> wrote:
Not in SA proper. For curiosity sake, I wrote up a quick rule to test
it out:
MSECSSPAM% HAM% S/ORANK SCORE NAME
027920 4940
Well, I posted the following below to mimedefang, but didn't see a response.
Hopefully someone hear can answer this question? Also asked a few months
ago on the sendmail list, but I think that the idea of adding a knob
that would
allow you to bend the spec was anathema to them... Even if the spe
On Wed, Mar 08, 2006 at 06:46:41PM -0800, Kenneth Porter wrote:
> > 1.400 1.0852 3.17810.255 0.001.00 TVD_NESTED_ANCHOR
> What MUA generates all the FP's?
I already deleted the results, but there were a lot of newsletters.
People are sloppy when they write html, leave an anchor tag
On Thu, Mar 09, 2006 at 02:30:18AM +, Tristan Miller wrote:
> from the command line, spamc didn't wait any longer no matter what value of
> x I used; it just waited for a second and then spit out some-email.txt
> as-is. Ditto when using the -x option.
That makes sense. If the daemon isn't ru
I put a rule in for testing just for this part of the process but a nested
tag inside another tag is a good idea as well. I want to see what
the corpus view is on this issue as well.
rawbody KAM_PHISH1 /u style="cursor: pointer"/
describeKAM_PHISH1 Test for PHISH th
On Wed, 8 Mar 2006, Dan Mahoney, System Admin wrote:
On Wed, 8 Mar 2006, Daryl C. W. O'Shea wrote:
On 08/03/06 09:17 PM, Dan Mahoney, System Admin wrote:
On Tue, 7 Mar 2006, Theo Van Dinter wrote:
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin
wrote:
[Odd SQL Error]
On Wed, 8 Mar 2006, Theo Van Dinter wrote:
match (m//) at /usr/local/lib/perl5/site_perl/5.8.6/Mail/S
pamAssassin/Conf/Parser.pm line 547, line 2.
$set_score = -$set_score if ( $conf->{tflags}->{$k} =~ /\bnice\b/ );
$conf->{tflags}->{$k} is undefined, which shouldn't be possible with th
On Wednesday 08 March 2006 21:57, jdow wrote:
>From: "Kenneth Porter" <[EMAIL PROTECTED]>
>
>> --On Wednesday, March 08, 2006 8:40 PM -0500 Theo Van Dinter
>>
>> <[EMAIL PROTECTED]> wrote:
>>> Not in SA proper. For curiosity sake, I wrote up a quick rule to
>>> test it out:
>>>
>>> MSECSSPAM%
On Wednesday 08 March 2006 21:30, Tristan Miller wrote:
>Greetings.
>
>I use Fetchmail to fetch mail from various POP3 and IMAP accounts and
>Procmail to pipe the retrieved mail through SpamAssassin (using
> spamd). This works fine, except that the first few messages fetched
> after booting don't s
> I put in a rule to catch this:
> header ODD_PORT_SS Received =~ /from
\[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]
> \(port=\d{4} helo=[a-z]{3,6}/
The good old porthelo rule. We have that in the SARE rules someplace. It
hits some ham, but generally not an appreciable amount. You don't even need
to
69 matches
Mail list logo
