RE: FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Sietse van Zanen
And you have added all the users, that need access to the users group in /etc/group? IE your /etc/group file contains a line like: users:x:100:user1,user2,user3,user4,useretc If so, than it is spamassassin that does not switch the user context correctly. -Sietse From: Robert S Sent: Tue 21-

Re: ??

2006-11-21 Thread Philip Prindeville
John D. Hardin wrote: >On Mon, 20 Nov 2006, twofers wrote: > > > >>I would like to know what local rule I could invoke to tag email that the >>subject is not in english. >> >> header NOT_IN_ENGLISH Subject !~ /English/i >> describe NOT_IN_ENGLISH Subject Contains Non Engl

Them spammers are getting smarter..

2006-11-21 Thread Evan Platt
So used to be mail from Richard Smith, subject "Me again Richard". Now they're using the last name, ie "Me again Smith" I'm almost at the point of rejecting anything with the subject Me again..." Off topic: In postfix in header_checks, can I specity something at the START? ie if I say /Me agai

Re: ****Re: blarsbl

2006-11-21 Thread Craig White
On Tue, 2006-11-21 at 12:07 -0500, DAve wrote: > Thomas Lindell wrote: > > At&t mail servers use his service. > > > > Which means I can't send to mediacom which is an at&t partner > > > > I couldn't believe at&t used his service. > > > > What's odd is that my company uses at&t backhaul bandwi

FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Robert S
I've installed this FuzzyOcrPlugin on two machines (debian and gentoo). Everything works fine on the gentoo box, but on the debian box I get the following in the error log: [2006-11-20 04:06:11] Unable to open/create Image Hash database at "/usr/local/var/FuzzyOcr/FuzzyOcr.hashdb", check permiss

Re: amavisd-new or mailscanner?

2006-11-21 Thread Ralf Hildebrandt
* Mark Martinec <[EMAIL PROTECTED]>: > As far as invoking SA and getting its results, it should be about the same. You forget your own p0f fingerprinting :) -- Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED] Charite - Universitätsmedizin BerlinTel. +49 (0)30-450 5

Re: DNS Whitelist - rule optimization

2006-11-21 Thread Matthias Leisi
Theo Van Dinter wrote: > My suggestion was going to be to have the plugin define tags that can > be used via add_header. No need for calling add_header() internally. Sounds like an interesting idea. Since I've never written plugins for SA: what is the best starting point / documentation? >>>

RE: Is my Bayes DB borked?

2006-11-21 Thread Kurt Buff
Nope - it's not that. Looking through my syslog more closely reveals that I'm getting 'SA TIMED OUT' messages all over the place, and referring to rules as well as Bayes. So, I'm just as confused as ever, and don't know what's going on. More analysis needed, I suppose, but I'm not sure where to s

Re: Greylisting

2006-11-21 Thread uxbod
Just to add to the pot I have started working for a company who was receiving +30,000 emails a day and acknowledged they had a spam problem. I got the go ahead to pilot Postfix, MailScanner, SpamAssassin + FuzzyOCR and PolicyD and have now reduced that to ~ 40 emails per day being delivered. T

Re: blarsbl

2006-11-21 Thread DAve
Thomas Lindell wrote: At&t mail servers use his service. Which means I can't send to mediacom which is an at&t partner I couldn't believe at&t used his service. What's odd is that my company uses at&t backhaul bandwidth in the form of 4 t1's Grr the whole thing is frustrating Tom -O

if plugin lines with else functionality?

2006-11-21 Thread Fred T
Hello users, Does anyone thing it might be nice to have if plugin lines with else functionality? Say we create some nice rules that rely on plugins but those plugins aren't available, if we could create alternate rules for when the plugins are not available it might help in some cases.

Re: Them spammers are getting smarter..

2006-11-21 Thread Karl Auer
On Tue, 2006-11-21 at 12:33 -0800, Evan Platt wrote: > In postfix in header_checks, can I specity something at the START? ie if I say > /Me again/Reject > > I only want to reject > "Me again Smith" but not "Hey, it's Me again..." Put a caret at the start of the pattern: "/^Me again/".

Re: blarsbl

2006-11-21 Thread DAve
Thomas Lindell wrote: Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that runs the blarsbl

Re: Them spammers are getting smarter..

2006-11-21 Thread Kelson
Theo Van Dinter wrote: On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote: So used to be mail from Richard Smith, subject "Me again Richard". Now they're using the last name, ie "Me again Smith" FWIW, this is why it's pointless to try keeping up with those things. There's an infinite n

Re: user_prefs not used

2006-11-21 Thread twofers
Are you saying that you have separate rules in user_prefs and those rules are not being processed? or are you talking about just configuration lines in user_prefs like use_bayes 1? Wes Chris Willard <[EMAIL PROTECTED]> wrote: Hi all, I am using spamd and calling spamc from .procmail usi

Re: spammers dodging OCR

2006-11-21 Thread alex
lol, just got a spam with the image obfuscated like captchas in a bbs, to avoid detection by ocr. On Mon, Nov 06, 2006 at 02:06:45PM -0600, Jorge Valdes wrote: > Gary V wrote: > >This morning I received my copy of networkworld. Here is an > >interesting article: > > > >http://www.networkworld.com

Re: Log Mail Caught As Spam

2006-11-21 Thread Panagiotis Christias
On 11/20/06, itdelany <[EMAIL PROTECTED]> wrote: François Rousseau wrote: > > In your log, do you have any things like top 10 spammer, 10 top spam > ... > or something like this? > > URIBL_AB_SURBL=3.812, URIBL_PH_SURBL=2.8, URIBL_SC_SURBL=4.498, >URIBL_WS_SURBL=2.14] > > those tag

Re: Bayes Database Missing

2006-11-21 Thread twofers
You can try: mkdir /var/lib/MailScanner/ #Creates the directory cp /etc/mail/spamassassin/bayes* /var/lib/MailScanner/ #Copies the bayes databases from the default spamassassin directory to the bayes_path directory /etc/init.d/spamassassin restart or /etc/init.d/psa-spamassassin

Re: Bayes column 'token'

2006-11-21 Thread Jonas Eckerman
CREATE TABLE bayes_token ( PRIMARY KEY (id, token), INDEX bayes_token_idx1 (token), INDEX bayes_token_idx2 (id, atime) ) TYPE=MyISAM; PRIMARY for `id` and `token` should not have INDEX for `id` and `token` added, too. Why not? IIRC the three indexes above makes perfect sense. Like this

joe-job/backscatter

2006-11-21 Thread Chris
Anyone else seeing anything like this? I've been getting these for about two days or so now: Return-Path: <> Received: from pop.earthlink.net [209.86.93.201] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Tue, 21 Nov 2006 13:19:50 -0600 (CST) Re

Re: would SA benefit from port to Java

2006-11-21 Thread Justin Mason
Giampaolo Tomassoni writes: > > > > Recently in the perl "blead" code, one of the perl hackers has > > > > added a trie-based regexp matcher (with Aho-Corasick > > > > optimisations) to efficiently match multiple regular expressions > > > > in parallel, to the perl core regexp matching code. That

Re: FuzzyOcr and blank lines?

2006-11-21 Thread Marc Perkel
Matthias Keller wrote: Marc Perkel wrote: I'm running the latest one that is not the devel version. Bill Landry wrote: Marc Perkel wrote the following on 11/19/2006 6:15 PM -0800: Does FuzzyOCR not skip blank lines? * 33 FUZZY_OCR BODY: Mail contains an image with common spam text

Re: blarsbl

2006-11-21 Thread snowcrash+spamassassin
<[EMAIL PROTECTED]>: host gateway.mchsi.com[204.127.203.150] said: 550-12.175.23.161 blocked by ldap:ou=rblmx,dc=mso,dc=att,dc=net 550 Blocked for abuse. Please contact the administrator of your ISP or sending mailservice. (in reply to MAIL FROM command) aha. the mchsi-variant of

Re: blarsbl

2006-11-21 Thread Marc Perkel
DAve wrote: Thomas Lindell wrote: Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that ru

Re: blarsbl

2006-11-21 Thread snowcrash+spamassassin
On 11/21/06, Thomas Lindell <[EMAIL PROTECTED]> wrote: At&t mail servers use his service. can you please share/point-to some evidence of that fact? if that *is* the case, i'll be chatting with my reps at at&t! if i've missed it here, i apologize in advance ... thanks.

Redundant QP encoding of Subject/From fields...

2006-11-21 Thread Philip Prindeville
I got the following spam. I've included the header: Return-Path: <[EMAIL PROTECTED]> Received: from mail.libertysurf.net (webmail-out.libertysurf.net [213.36.80.105]) by mail.redfish-solutions.com (8.13.8/8.13.7) with ESMTP id kAM1ckKs008704 for <[EMAIL PROTECTED]>; Tue, 21 Nov

Re: getting mail directly and not via mail-relay

2006-11-21 Thread David B Funk
On Mon, 20 Nov 2006, Leon Kolchinsky wrote: > Hello, > > There is a Mail-Relay administered by another person and its MX record stand > before MX record of my mail server, so theoretically mail should go first > through Mail-Relay to my server. > > The thing is that for some reason there are muc

Re: fuzzyocr 342 fires error & warn, but scores anyway ... does it work?

2006-11-21 Thread AnonymousDog
Looks like what happens when your giflib/libungif binaries are not where FuzzyOcr expects them to be. Check your actual paths against those in FuzzyOcr.cf. snowcrash+spamassassin wrote: > > GIF-LIB error: Failed to Read from given file. > but, the message does score: >1.5 FUZZY_OC

Re: FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Thiago LPS
Here my FuzzyOCR runs with spamd (the daemon of spamassassin) and the default user that run it is the user spamd -rw-r--r-- 1 spamd spamd 433905 Nov 21 08:51 FuzzyOcr.hashdb my FuzzyOcr.hashdb is set to user spamd and all works fine... :) On 11/20/06, Robert S <[EMAIL PROTECTED]> wrote: I m

Re: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Hi, It appears that as I was accepted to the mailing list after making my first post, my post did not hit the list. Here is my original full post below:- CosmicPerl wrote: > > Hi, > I installed the latest SpamAssassin on my server. At first all my tests > looked good, apart from load. So I

Re: DNS Whitelist - rule optimization

2006-11-21 Thread Justin Mason
Matthias Leisi writes: > I'd like to give SpamAssassin configuration instructions for the use of > dnswl.org (DNS Whitelisting project, see http://www.dnswl.org/). The > goal is to ensure a) efficient (minimal) use of DNS queries and b) that > fake headers do not trigger any whitelisting. > > Fro

Re: Àú=·Å=ÇÑ ¼­=¹Î= ÀÚ=±Ý=´ë==Ãô=¾È= ³»~!

2006-11-21 Thread LuKreme
On 20-Nov-2006, at 05:52, twofers wrote: header NOT_IN_ENGLISH Subject !~ /English/i describe NOT_IN_ENGLISH Subject Contains Non English Characters score NOT_IN_ENGLISH 3.5 What regexp could I use? Well, that's tricky. Sometimes the subject is encoded

Bayes database: per-user or system-wide?

2006-11-21 Thread Robert S
I have two mailservers running SA. On one (with a very small number of users), there is a shared bayes database (bayes_path /var/work/bayes/bayes in local.cf), and in the other one I use the default per-user databases. In both machines I run sa-learn as a weekly cron job on spam in a "Spam" fold

RE: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Actually I was replying to my forum thread and deleted my original message that it quoted as I thought it had already hit the list. Sietse van Zanen wrote: > > Probably with him being too lazy to copy and paste his original message > from the other board, or list.. > > Well, I am too lazy

Re: blarsbl

2006-11-21 Thread Michael W Cocke
On Tue, 21 Nov 2006 10:29:15 -0600, you wrote: >Has anyone had any dealings with this guy. > >I take my mail server very seriously. Further I take spamming very >seriously in general. > >Even when I detect one of my customers sending spam I disable there internet >until the problem is resolved

Using SpamAssassin variables

2006-11-21 Thread John W Mickevich
Hello all! I am relatively new to SpamAssassin and subscribing to this group had really helped me in understanding many of SpamAssassin's intricacies. Thanks to everybody who posts replies to the questions asked here. Also, if this is not the proper place for me to post this question, I ap

Sudden drop in spam-rate, parallel to a surge of new trojans - beware

2006-11-21 Thread Chr. v. Stuckrad
Hi! Yesterday we had a sudden drop in spam-percentage from >80% to near 60%. Parallel to it I got six copies of an undetectable (by NAI and ClamAV) new trojan 'exe' in the Mail. Do we have to prepare for a new flood by an updated (just now reorganizing) botnet? Stucki -- Christoph von Stuckrad

Re: Greylisting

2006-11-21 Thread Charlie Clark
Am 21.11.2006 um 01:12 schrieb John Andersen: On Monday 20 November 2006 15:08, Rick Macdougall wrote: It's possible that they could send it all twice but I've never seen it. Remember that some unbelievable number of infected Windows clients are the main source of spam and it would just

Re: Forged From, Other servers bouncing back

2006-11-21 Thread Kelson
Mark Adams wrote: One of the many spammers around has sent out a LOAD of email from [EMAIL PROTECTED] Currently our server is being over-run by the bounce backs, spamassassin is choking due to the extensive checking it is doing and exim will not accept any more connections. OK, keep in mind tha

Re: amavisd-new or mailscanner?

2006-11-21 Thread Martin Hepworth
Michael W Cocke wrote: I started out using amavisd-new then switched to MailScanner as my mail tester 'framework' (SpamAssassin has been a constant) Looking thru the docs of Mailscanner, it doesn't come out and SAY that it just does the 'basic' spam test features, but reading between the lines

RE: getting mail directly and not via mail-relay

2006-11-21 Thread Leon Kolchinsky
Thanks David, I didn't thought of that simple solution :) Firewall will certainly do the job here. Best Regards, Leon -Original Message- From: David B Funk [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 21, 2006 5:59 AM To: לאון קולצ'ינסקי Cc: users@spamassassin.apache.org Subject:

Re: Need an ISP who offers shell account, SA etc....

2006-11-21 Thread John D. Hardin
On Mon, 20 Nov 2006, Robert Nicholson wrote: > Is this practical without static ip? Free public dynamic DNS services can make it tolerable. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732

Re: name-in-subject spammers switch to images

2006-11-21 Thread Justin Mason
Hold your horses -- it was only added to SVN last night ;) It needs to be tested first, to ensure it catches spam without FPs, before it gets published... --j. Jeremy Fairbrass writes: > Where exactly can I find the new RCVD_FORGED_WROTE2 rule you refer to? I > have RCVD_FORGED_WROTE in my 80_

amavisd-new or mailscanner?

2006-11-21 Thread Michael W Cocke
I started out using amavisd-new then switched to MailScanner as my mail tester 'framework' (SpamAssassin has been a constant) Looking thru the docs of Mailscanner, it doesn't come out and SAY that it just does the 'basic' spam test features, but reading between the lines it seems to - I have a fe

Re: blarsbl

2006-11-21 Thread hamann . w
Hi, I recently got a call from someone trying to send to my email @t-online.de (this is a division of german telecom). While I believe that my friend's ISP might occasionally send spam (any big isp might get unwanted customers), I searched for blacklists and found that isplisted only at blars.

Is my Bayes DB borked?

2006-11-21 Thread Kurt Buff
My postfix queue is climbing like crazy, and I'm getting *lots* of messages in my syslog that look like this: 2006-11-21 16:50:39 Mail.Warningzetmail3Nov 21 16:54:43 amavis[29824]: (29824-01-4) SA TIMED OUT, backtrace: at /usr/local/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/Bayes

Re: Log Mail Caught As Spam

2006-11-21 Thread Panagiotis Christias
On 11/21/06, itdelany <[EMAIL PROTECTED]> wrote: Panagiotis Christias wrote: > >> >> Thanks for your answer, and yes, spam word is everywhere in that email, I >> forgot to say that I already did an sa-learn -ham on this email. What >> else >> can I do ? > > Hello, > > you have probably not setu

Re: Greylisting

2006-11-21 Thread Vivek Khera
On Nov 20, 2006, at 7:29 PM, Mike Jackson wrote: FYI, I work for a large hosting provider, and I've seen customers who have implemented greylisting, but spammers are getting smart enough to work around it. I doubt that they're wasting resources on queuing for redelivery, but they are recog

Re: Bayes column 'token'

2006-11-21 Thread Jonas Eckerman
Michael Alan Dorman wrote: CREATE TABLE bayes_token ( PRIMARY KEY (id, token), INDEX bayes_token_idx1 (token), INDEX bayes_token_idx2 (id, atime) ) TYPE=MyISAM; If the primary key was changed to (token, id), it should be able to be used in the second sort of query as well as the first,

Re: SpamAssassin for FuzzyOCR only

2006-11-21 Thread Odhiambo Washington
* On 21/11/06 12:48 -0500, Theo Van Dinter wrote: | On Tue, Nov 21, 2006 at 08:12:03PM +0300, Odhiambo Washington wrote: | > I'd like to run SA with only the minimalist set of config ( and .cf | > files) that would suffice to just run FuzzyOCR checks only. | > SA version is 3.1.7. | | Interesting

RE: blarsbl

2006-11-21 Thread Thomas Lindell
Here is what I can give you <[EMAIL PROTECTED]>: host gateway.mchsi.com[204.127.203.150] said: 550-12.175.23.161 blocked by ldap:ou=rblmx,dc=mso,dc=att,dc=net 550 Blocked for abuse. Please contact the administrator of your ISP or sending mailservice. (in reply to MAIL FROM command)

RE: Not all Stock Spam is bad

2006-11-21 Thread Chris Santerre
> -Original Message- > From: Jim Maul [mailto:[EMAIL PROTECTED] > Sent: Monday, November 20, 2006 2:36 PM > To: spamassassin > Subject: Re: Not all Stock Spam is bad > > > DAve wrote: > > Randal, Phil wrote: > >> With FuzzyOCR 3.4.2 and using ocrad, > >> > >> $ocrad -s5 -i $pfile > >>

Re: Greylisting

2006-11-21 Thread Benny Pedersen
On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote: > Dylan Bouterse wrote: >> Do you have a compiled list of those IPs? And what method are you using >> to whitelist? Email offlist if more appropriate. Thanks! > We whitelist the main Irish ISPs, so our list wouldn't be of much us

Re: Bayes Database Missing

2006-11-21 Thread Matt Kettler
leemansvg wrote: > I see in my spam.assassin.pref.conf file this entry, > bayes_path /var/lib/MailScanner/bayes > > however when I navigate to this directory this database is not there, is > there a way to generate this database. I've been noticing a lot of spam > getting through a

Re: Greylisting

2006-11-21 Thread Rick Macdougall
John Andersen wrote: On Monday 20 November 2006 15:08, Rick Macdougall wrote: It's possible that they could send it all twice but I've never seen it. Remember that some unbelievable number of infected Windows clients are the main source of spam and it would just be too much trouble for the spa

Re: How do I stop these?

2006-11-21 Thread Duncan Hill
On Mon, November 20, 2006 15:00, Nathan Zabaldo wrote: > I am getting pounded by these types of emails. Does anyone else get > these? What rule can I apply to have them killed. It's driving me nuts. SARE Stock ruleset. Available from fine ninjas everywhere. Well trained Bayes would probably he

user_prefs not used

2006-11-21 Thread Chris Willard
Hi all, I am using spamd and calling spamc from .procmail using | /usr/bin/spamc -u chris Only the rules in /ec/mail/spamassassin/local.cf are being processed. My $HOME/.spamassassin/user_prefs file is not being used! /etc/mail/spamassassin/local.cf has allow_user_rules 1 in it but I can not g

Re: blarsbl

2006-11-21 Thread Kelson
Michael W Cocke wrote: He is. My system is on his list too, which is pretty amazing when you consider that my mail server supports 3, count them, 3 users - myself, my wife, and my 10 year old son - and he's somehow determined that my site hosts spammers. Last I looked, he listed all of Sprint.

Re: Bayes Database Missing

2006-11-21 Thread Matt Kettler
Matt Kettler wrote: > leemansvg wrote: > >> I see in my spam.assassin.pref.conf file this entry, >> bayes_path /var/lib/MailScanner/bayes >> >> however when I navigate to this directory this database is not there, is >> there a way to generate this database. I've been noticing a

Re: amavisd-new or mailscanner?

2006-11-21 Thread Ralf Hildebrandt
* Matt Hampton <[EMAIL PROTECTED]>: > What do you mean by more than the 'basic' features? Bear in mind as > well that MailScanner and amavisd-new check for spam at completely > different stages of the mail processing - amavisd-new at connection time > and MailScanner after it has been queued. Th

Re: amavisd-new or mailscanner?

2006-11-21 Thread Matt Hampton
Ralf Hildebrandt wrote: > * Matt Hampton <[EMAIL PROTECTED]>: > >> What do you mean by more than the 'basic' features? Bear in mind as >> well that MailScanner and amavisd-new check for spam at completely >> different stages of the mail processing - amavisd-new at connection time >> and MailScann

Bayes Database Missing

2006-11-21 Thread leemansvg
I see in my spam.assassin.pref.conf file this entry, bayes_path /var/lib/MailScanner/bayes however when I navigate to this directory this database is not there, is there a way to generate this database. I've been noticing a lot of spam getting through and would like to tighten th

Re: Bayes column 'token'

2006-11-21 Thread Michael Alan Dorman
On Tue, 21 Nov 2006 13:42:09 +0100 Jonas Eckerman <[EMAIL PROTECTED]> wrote: > > CREATE TABLE bayes_token ( > > PRIMARY KEY (id, token), > > INDEX bayes_token_idx1 (token), > > INDEX bayes_token_idx2 (id, atime) > > ) TYPE=MyISAM; > > > PRIMARY for `id` and `token` should not have INDEX for

RE: Greylisting

2006-11-21 Thread Giampaolo Tomassoni
-Original Message- From: Vahric MUHTARYAN [mailto:[EMAIL PROTECTED] Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking

Re: user_prefs not used

2006-11-21 Thread Loren Wilton
Did you restart spamd after changing any options? Loren

Re: How do I stop these?

2006-11-21 Thread Justin Mason
Duncan Hill writes: > On Mon, November 20, 2006 15:00, Nathan Zabaldo wrote: > > I am getting pounded by these types of emails. Does anyone else get > > these? What rule can I apply to have them killed. It's driving me nuts. > > SARE Stock ruleset. Available from fine ninjas everywhere. Well

Re: ??

2006-11-21 Thread John D. Hardin
On Mon, 20 Nov 2006, Philip Prindeville wrote: > Of course, that would exclude messages with ISO Latin 1 (8859.1) > characters like Yen, Pound Sterling, Trademark, etc. Plus, there are > words in English that when properly written do contain accents, > such as resume, dais, cliche, cooperation, et

Re: DNS Whitelist - rule optimization

2006-11-21 Thread Theo Van Dinter
On Tue, Nov 21, 2006 at 03:21:12PM +, Justin Mason wrote: > > And a third and last point: Is it possible to add a dedicated header > > when one of the rules triggered? I see that "add_header" can only > > differentiate between spam, ham and all -- any additional options? The > > idea is that MU

blarsbl

2006-11-21 Thread Thomas Lindell
Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that runs the blarsbl list wants to charge my

Re: Bayes Database Missing

2006-11-21 Thread leemansvg
sorry, I there's no bayes files in /etc/mail/spamassassin/ directory. I'm using MailScanner. twofers wrote: > > You can try: > mkdir /var/lib/MailScanner/ > #Creates the directory > > cp /etc/mail/spamassassin/bayes* /var/lib/MailScanner/ > #Copies the bayes databases from the defau

Re: Greylisting

2006-11-21 Thread Philip Prindeville
John Andersen wrote: >On Monday 20 November 2006 15:08, Rick Macdougall wrote: > > >>It's possible that they could send it all twice but I've never seen it. >> Remember that some unbelievable number of infected Windows clients are >>the main source of spam and it would just be too much trouble

Re: Problems running Spam Assassin

2006-11-21 Thread Magnus Holmgren
On Sunday 19 November 2006 18:04, CosmicPerl wrote: > Hi, > I installed the latest SpamAssassin on my server. At first all my tests > looked good, apart from load. So I setup spamc and spamd and everything > seemed great, for a short while at least. > > A day later my mqueue had about 1500 messag

RE: Problems running Spam Assassin

2006-11-21 Thread Sietse van Zanen
These mails stay there for 5 days. At least if you set up sendmail according to RFC's. that's the whole idea of SMTP store and forward. If address is unavailable, keep trying for a while before giving up. You can set the grace time to any period you like btw. -Sietse From: CosmicPerl Sent:

RE: Adding new rules for pump and dump

2006-11-21 Thread Chris Santerre
There is a new wave hitting. I've already written rules to catch this simple change the spammers did over the weekend. I expect the results will be very very good. I hope to have the SARE stock ruleset updated later today. So, no you aren't teh only one seeing stock spams slip buy over the weeke

Braindeath in the Navy

2006-11-21 Thread Philip Prindeville
Well, I tried to contact some people responsible for the servers below that what they were doing was broken, including citing chapter and verse where in RFC-2822 in syntax of the Received: lines was spec'd out: Received: from Gate2-sandiego.nmci.navy.mil (gate2-sandiego.nmci.navy.mil [138.163.0.4

Re: getting mail directly and not via mail-relay

2006-11-21 Thread Stuart Johnston
Leon Kolchinsky wrote: Hello, There is a Mail-Relay administered by another person and its MX record stand before MX record of my mail server, so theoretically mail should go first through Mail-Relay to my server. The thing is that for some reason there are much e-mails (and spam among them

Re: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Hi All, Ok, I've figured that having "define(`confSEPARATE_PROC', `True')" in my SendMail config was what was causing the flushing of the mail queue to create such a huge server load as it was spawning a new sendmail, procmail, and spamassassin child for each message in the mqueue. So I've disab

Re: Greylisting

2006-11-21 Thread Andy Jezierski
"Vahric MUHTARYAN" <[EMAIL PROTECTED]> wrote on 11/20/2006 04:33:23 PM: > Hello Everybody, > > I'm using SA for a long time without any problem, nowadays > spammers are using too much graphical objects and they are tring to > change it day by day. I'm tring to use fuzzyocr but it's taking

Re: Greylisting

2006-11-21 Thread Michele Neylon :: Blacknight
Vahric MUHTARYAN wrote: Hello, Do you come across with any problem from your clients for mails are not arriving at right time ? Because I afraid of people mta's all of them are configured with different retry times . We whitelist the main ISPs SMTPs to avoid this issue -- Mr Michele Ney

RE: Greylisting

2006-11-21 Thread Randal, Phil
Not to mention that the mail queues are backing up for over half an hour because of all the spam in the first place :-p Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: uxbod [mailto:[EMAIL PROTECTED] > Sent: 21 November 2006 15:13 >

Re: Greylisting

2006-11-21 Thread John D. Hardin
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote: > Do you come across with any problem from your clients for mails are not > arriving at right time ? Because I afraid of people mta's all of them are > configured with different retry times . Whitelist your clients' known MTA IP addresses. Greylist

Re: SPF and SMTP AUTH

2006-11-21 Thread Magnus Holmgren
On Tuesday 21 November 2006 12:07, Rene Caspari wrote: > Hi, > > I have a little problem with SPF: > > For domain.tld there is a SPF record, which says that mail.domain.tld is > allowed to sending mails from [EMAIL PROTECTED] > If I use mail.domain.tld with a dialin account by SMTP AUTH, > spamassa

Re: Them spammers are getting smarter..

2006-11-21 Thread Theo Van Dinter
On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote: > So used to be mail from Richard Smith, subject "Me again Richard". > Now they're using the last name, ie "Me again Smith" FWIW, this is why it's pointless to try keeping up with those things. There's an infinite number of ways they can

Re: Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello, Actually we are receiving too much mail, and % 60 - % 70 of this are spam , also my hardwares are not enough to handle all load because of this I can miss some mails and they are spam. Instead of using fuzzy ocr or any other think I guess that I can use greylisting How they explaine

Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that try greylisting . I wonder are there anybody use greyli

RE: Not all Stock Spam is bad

2006-11-21 Thread Randal, Phil
With FuzzyOCR 3.4.2 and using ocrad, $ocrad -s5 -i $pfile should catch them, according to a post from "decoder" on the FuzzyOCR list. And it seems to here. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -Original Message- > From: DAve [mailto:[E

Re: blarsbl

2006-11-21 Thread twofers
I'm sure the FTC and US Attorny General's office would like to know about this. All you have to do is write a a letter addressed to Attn: of Consumer Affairs and these guys will check it outin a big way. Wes Thomas Lindell <[EMAIL PROTECTED]> wrote: Has anyone had any dealings w

Re: Greylisting

2006-11-21 Thread Leander Koornneef
On 20-nov-2006, at 23:33, Vahric MUHTARYAN wrote: Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that

Re: Greylisting - branching further off topic

2006-11-21 Thread Matt Hampton
Benny Pedersen wrote: > On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote: >> Dylan Bouterse wrote: >>> Do you have a compiled list of those IPs? And what method are you using >>> to whitelist? Email offlist if more appropriate. Thanks! >> We whitelist the main Irish ISPs, so our

Re: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Can anyone help with this? -- View this message in context: http://www.nabble.com/Problems-running-Spam-Assassin-tf2664618.html#a7471981 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Braindeath in the Navy

2006-11-21 Thread Matt Kettler
Philip Prindeville wrote: > Well, I tried to contact some people responsible for > the servers below that what they were doing was broken, > including citing chapter and verse where in RFC-2822 in > syntax of the Received: lines was spec'd out: > > > It just boggles my mind why anyone would go

RE: Spamassassin

2006-11-21 Thread Michael Scheidell
> -Original Message- > From: Maccie Roux [mailto:[EMAIL PROTECTED] > Sent: Monday, November 20, 2006 4:47 AM > To: users@spamassassin.apache.org > Subject: Spamassassin > > > I think amvis is not looking at spamassassin, I also struggle > to get the > system > to send the spam mail to

Re: Greylisting

2006-11-21 Thread Chr. v. Stuckrad
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote: > I'm using SA for a long time without any problem, nowadays > spammers are using too much graphical objects and they are tring > to change it day by day. I'm tring to use fuzzyocr but it's taking Same Problem here ... > too much cpu. I

RE: would SA benefit from port to Java

2006-11-21 Thread Giampaolo Tomassoni
From: Matt Kettler [mailto:[EMAIL PROTECTED] > Giampaolo Tomassoni wrote: > > > > ...omissis > > > > But if we are speaking of a /10 mem*cpu factor, well, it could > > easily be interesting, isn't it? > > No. I think it would be patently stupid because of the massive effort > involved and loss o

Re: Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello, Do you come across with any problem from your clients for mails are not arriving at right time ? Because I afraid of people mta's all of them are configured with different retry times . Regards Vahric - Original Message - From: "Rick Macdougall" <[EMAIL PROTECTED]> To: Sen

Re: How do I stop these?

2006-11-21 Thread John Tice
These are scoring at about 4X my threshold without the SARE stock ruleset. You may need to tweak you scoring. I find bayes_99 to be reliable. FROM_LOCAL_NOVOWEL FORGED_RCVD_HELO BAYES_99 RCVD_IN_SORBS_DUL RCVD_IN_NJABL_DUL On Nov 20, 2006, at 10:00 AM, Nathan Zabaldo wrote: I am getting

Sharing bayes DB between accounts - help

2006-11-21 Thread Evan Dorn
I have multiple shell accounts with my ISP that function as multiple inboxes. I want to run SA on all three, and it would be convenient to share the bayesian DB between all three accounts so I only have to train one. I've installed everything in a way that I think should work, but only

Re: Greylisting

2006-11-21 Thread John Andersen
On Monday 20 November 2006 21:06, Duncan Hill wrote: > Greylisting has been used now for over 2 years.  I haven't seen any > spammer adapt their botnets to handle it in that time frame. But its used on .0002% of MTAs. Not worth anybody's effort until it goes mainstream, or gets talked up here on

Re: would SA benefit from port to Java

2006-11-21 Thread Justin Mason
That's not even mentioning the metaprogramming and higher-order programming techniques that we use extensively in SpamAssassin -- those are basically *just not possible* in C/C++. ;) --j. Matt Kettler writes: > Giampaolo Tomassoni wrote: > > From: Matt Kettler [mailto:[EMAIL PROTECTED] > > >

Re: How do I stop these?

2006-11-21 Thread Justin Mason
Larry Rosenman writes: > [EMAIL PROTECTED] wrote: > > > > As would running sa-update. > > > > --j. > > Speaking of sa-update >Is there a list of the changes from day-to-day with sa-update? > I have an auto-update script that runs for it, but I'd like to see what > Gets added as time goe

  1   2   >