FM_FAKE_HELO_VERIZON

2008-09-14 Thread jpff
I have a user of a mailing list who is sending from a Verizon system, and is being marked as spam. Some is use of HTML etc but > * 2.0 BOTNET_CLIENT Relay has a client-like hostname > * =20 > [botnet_client,ip=206.46.173.1,hostname=vms173001pub.verizon.net, > ipinhostname] >

sa-learn and different parh

2008-09-14 Thread Massimiliano Marini
Hi all, my SA version: 3.2.4 when launching this command, I noticed that the files are updated in two different folders. user: root foo:~# sa-learn --sync --spam --mbox /home/foo/spam.mbox /root/.spamassassin/bayes_seen /root/.spamassassin/bayes_toks /home/spamassassin/.spamassassin/auto-white

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread mouss
jpff wrote: I have a user of a mailing list who is sending from a Verizon system, and is being marked as spam. Some is use of HTML etc but * 2.0 BOTNET_CLIENT Relay has a client-like hostname * =20 [botnet_client,ip=206.46.173.1,hostname=vms173001pub.verizon.net, ipinhostname

Re: MagicSpam

2008-09-14 Thread Michael Scheidell
> At 09:44 12-09-2008, Jesse Stroik wrote: > There is SpamAssassin the project and SpamAssassin the software. The > project, under the aegis of the Apache Software Foundation, provides > a framework to support open source software development to deliver an > enterprise-grade, freely available so

Re: sa-compile errors

2008-09-14 Thread Michael Scheidell
> I just installed SpamAssassin 3.2.5 and after doing a sa-update and > sa-compile I get the following: > > Illegal octal digit '8' ignored at /usr/local/bin/sa-compile line 631, > <$fh> line 2436. > Wide character in print at /usr/local/bin/sa-compile line 385, <$fh> > line 2436. > > They compil

Re: Spamassassin Letting a Lot of Spams Through

2008-09-14 Thread aladdin
On Sunday 14 September 2008 10:06, aladdin wrote: > On Sunday 14 September 2008 05:07, you wrote: > > On Sun, 2008-09-14 at 01:05 -0400, aladdin wrote: > > > > So, evidently, it can't find my bayes database. So, since I want to > > > > use a system-wide database, where is it (/usr/share/spamassass

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread John Hardin
On Sun, 2008-09-14 at 14:43 +0200, mouss wrote: > verizon.net SPF record includes 206.46.0.0/16. Verizon SPF'd a class-B space?? Please don't tell me that covers part of their dynamic address pool... -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]

RE: Spamassassin Letting a Lot of Spams Through

2008-09-14 Thread Martin.Hepworth
Hi /usr/share/spamassassin - contains version release time rules, always used unless next dir exists. /var/lib/spamassassin// - contains 'sa-update'ed rules to bring release time rules upto date without needing a full version release /etc/mail/spamassassin - contains site wide rules and set

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread mouss
John Hardin wrote: On Sun, 2008-09-14 at 14:43 +0200, mouss wrote: verizon.net SPF record includes 206.46.0.0/16. Verizon SPF'd a class-B space?? Please don't tell me that covers part of their dynamic address pool... If they block port 25 except for "responsible" users, I have no problem

Re: access to binary attachments from $PerMsgStatus ?

2008-09-14 Thread Jonas Eckerman
Christian Recktenwald wrote: The stucture I get from the method argv using the code below lacks contents using the MIME type "application/octet-stream" - at least. [...] for my $i (@{$msg->{body_parts}}) { Have you tried using the find_parts method? see perldoc Mail::SpamAss

sa-learn

2008-09-14 Thread Lars Ebeling
Dear all, after running sa-learn -D --spam --mbox /var/mail/spam Do I have to save the mails in /var/mail/spam or can I delete them? -- Regards Lars Ebeling http://leopg9.no-ip.org Hobbithobbyist "I am not young enough to know everything." -- Oscar Wilde

Re: sa-learn

2008-09-14 Thread Matt Kettler
Lars Ebeling wrote: > Dear all, > > after running > sa-learn -D --spam --mbox /var/mail/spam > > Do I have to save the mails in /var/mail/spam or can I delete them? You can delete them. The only time you'd need them is if you wanted to feed them to sa-learn again (ie: if you decide to wipe your ba

RE: MagicSpam

2008-09-14 Thread Michael Hutchinson
Hello, I really don't see how Spamassassin is not "up to par", considering many high end Net App's use Spamassassin and promote corporate level products that include it. Maybe it needs to be configured correctly? In fact, I don't think I've seen any real rival to Spamassassin - except, maybe,

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread Gene Heskett
On Sunday 14 September 2008, mouss wrote: >John Hardin wrote: >> On Sun, 2008-09-14 at 14:43 +0200, mouss wrote: >>> verizon.net SPF record includes 206.46.0.0/16. >> >> Verizon SPF'd a class-B space?? Please don't tell me that covers part of >> their dynamic address pool... > >If they block port 2

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread mouss
Gene Heskett wrote: On Sunday 14 September 2008, mouss wrote: John Hardin wrote: On Sun, 2008-09-14 at 14:43 +0200, mouss wrote: verizon.net SPF record includes 206.46.0.0/16. Verizon SPF'd a class-B space?? Please don't tell me that covers part of their dynamic address pool... If they block

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread Gene Heskett
On Sunday 14 September 2008, mouss wrote: >Gene Heskett wrote: >> On Sunday 14 September 2008, mouss wrote: >>> John Hardin wrote: On Sun, 2008-09-14 at 14:43 +0200, mouss wrote: > verizon.net SPF record includes 206.46.0.0/16. Verizon SPF'd a class-B space?? Please don't tell me

Re: Spamassassin Letting a Lot of Spams Through

2008-09-14 Thread aladdin
Yeah, I'm strugglin'! I'm new to spamassassin, and don't know what rbl's and uri-rbl's are, and, if you've had a chance to see further emails, my sa-update is broken. When you get to your system, I'd appreciate any further insight you may have. Thanks! On Sunday 14 September 2008 16:21, Mart

Re: FM_FAKE_HELO_VERIZON

2008-09-14 Thread SM
At 03:33 14-09-2008, jpff wrote: I have a user of a mailing list who is sending from a Verizon system, and is being marked as spam. Some is use of HTML etc but > * 2.0 BOTNET_CLIENT Relay has a client-like hostname > * =20 > [botnet_client,ip=206.46.173.1,hostname=vms173001pub.veri