URIBL_PH_SURBL

2011-12-01 Thread Tom Kinghorn
Good morning list. could someone possibly explain how the scoring for ph.surbl.org works? I see the following in my spam logs spam-1DSMgl4+-YFV.gz: TO_NO_BRKTS_HTML_ONLY=1.258, URIBL_PH_SURBL=0.001] spam-1DSMgl4+-YFV.gz: * 0.0 URIBL_PH_SURBL

p5-Mail-SpamAssassin-3.3.2_2 error

2011-12-01 Thread Felipe N. Oliva
FreeBSD + Qmail + Vpopmail maillog: Dec 1 10:40:46 mail spamd[67490]: spamd: got connection over /var/run/spamd.socket *Dec 1 10:40:46 mail spamd[67490]: spamd: handle_user unable to find user: 'x...@xxx.com'* Dec 1 10:40:46 mail spamd[67490]: spamd: checking message

Re: URIBL_PH_SURBL

2011-12-01 Thread Ned Slider
On 01/12/11 08:29, Tom Kinghorn wrote: Good morning list. could someone possibly explain how the scoring for ph.surbl.org works? I see the following in my spam logs spam-1DSMgl4+-YFV.gz: TO_NO_BRKTS_HTML_ONLY=1.258, URIBL_PH_SURBL=0.001] spam-1DSMgl4+-YFV.gz: * 0.0 URIBL_PH_SURBL Contains an

Re: p5-Mail-SpamAssassin-3.3.2_2 error

2011-12-01 Thread Mark Martinec
Felipe, FreeBSD + Qmail + Vpopmail maillog: Dec 1 10:40:46 mail spamd[67490]: spamd: got connection over /var/run/spamd.socket *Dec 1 10:40:46 mail spamd[67490]: spamd: handle_user unable to find user: 'x...@xxx.com'* Dec 1 10:40:46 mail spamd[67490]: spamd: checking message

Re: Bayes database in mysql on multiple servers

2011-12-01 Thread Benny Pedersen
On Thu, 1 Dec 2011 01:01:04 -0500, Michael Scheidell wrote: sed -i '' -e '/INSERT INTO bayes_seen/s/INTO/IGNORE INTO/' MySQL.pm ALTER TABLE `bayes_seen` ENGINE = INNODB no, that won't do anything (I use engine = innodb), what has innodb have to do with replication collisions? innodb

Re: p5-Mail-SpamAssassin-3.3.2_2 error

2011-12-01 Thread Mark Martinec
Felipe, FreeBSD + Qmail + Vpopmail *Dec 1 10:40:46 mail spamd[67490]: spamd: handle_user unable to find user: 'x...@xxx.com'* A username 'x...@xxx.com' does not exist. Either you should not pass the full recipient's e-mail address in the -u argument to spamc but use a localpart

RE: A SpamAssassin Crash Course for Admins

2011-12-01 Thread R - elists
It's not always just branding. It's also, giving proper attribution. Organisations and people should be credited appropriately for their contributions. It's the respectful thing to do. GNU/Linux is the best example of this IMO. At least you said free software arena and not open source

Re: URIBL_PH_SURBL

2011-12-01 Thread Jeff Chan
Also keep in mind that PH has a generally low score even for net + bayes since it doesn't hit a large portion of spam in the SA corpus. (In other words phishing and malware unsolicited messages are a relatively small subset of unsolicited messages in general.) However the unsolicited messages it

Adding a blacklist via sa-update - would you mind?

2011-12-01 Thread darxus
There is some question among spamassassin developers* on whether or not it is acceptable to increase the network load of spamassassin, by one DNS query per email, for existing releases (version 3.3.x), by adding one DNS blacklist to the rule set via sa-update. This Mailspike blacklist has proved

Re: URIBL_PH_SURBL

2011-12-01 Thread darxus
On 12/01, Jeff Chan wrote: Also keep in mind that PH has a generally low score even for net + bayes since it doesn't hit a large portion of spam in the SA corpus. No. Scores are not determined by how many spams a rule hits. Scores are automatically generated to correctly flag as many spams

how to check the size of the subject?

2011-12-01 Thread Sergio
Hi all, is there a way to check the size of a subject on a rule? Thanks in advance. Sergio

Re: how to check the size of the subject?

2011-12-01 Thread John Hardin
On Thu, 1 Dec 2011, Sergio wrote: is there a way to check the size of a subject on a rule? Do you want to know if it's larger than or smaller than some specific size, or do you want to know about how many characters are in it? -- John Hardin KA7OHZ

Re: how to check the size of the subject?

2011-12-01 Thread John Hardin
On Thu, 1 Dec 2011, Sergio wrote: I want to check for specific subject size, thanks. Let's keep the discussion on-list so others may benefit. Larger than: header __SUBJ_GT_100 Subject =~ /.{101}/ Smaller than or equal to: header __SUBJ_LE_100 Subject =~ /^.{0,100}$/ Sergio On

Re: how to check the size of the subject?

2011-12-01 Thread Sergio
Sorry, I always reply to the list, this time it flips on me. Thanks! So, this way I can have a check on the large of the subject as a sub rule and then check for the content, appreciated. Regards, Sergio On Thu, Dec 1, 2011 at 4:33 PM, John Hardin jhar...@impsec.org wrote: On Thu, 1 Dec

Re: how to check the size of the subject?

2011-12-01 Thread Benny Pedersen
On Thu, 1 Dec 2011 16:59:33 -0600, Sergio wrote: Sorry, I always reply to the list, this time it flips on me. try reply now, just testing :-)

Re: SA assistance needed willing to compensate for a solution

2011-12-01 Thread Ted Mittelstaedt
Hi Edward, The messages you have on your links there have no header included so I don't think that this is helpful at all. Ted On 12/1/2011 3:24 PM, Edward O'Rourke wrote: Greetings - I'm at my wits end trying to fix this. First my setup is as follows CentOS 5.7 cPanel WHM 11.30.5 build

Re: SA assistance needed willing to compensate for a solution

2011-12-01 Thread John Hardin
On Thu, 1 Dec 2011, Edward O'Rourke wrote: Greetings - I'm at my wits end trying to fix this. Every day, every few hours the same 3 or similar 3 messages are delivered and are not scored. The last time somebody reported behavior like that, they had a catch-all address defined and the spam

Re: SA assistance needed willing to compensate for a solution

2011-12-01 Thread Ted Mittelstaedt
On 12/1/2011 3:59 PM, John Hardin wrote: On Thu, 1 Dec 2011, Edward O'Rourke wrote: Greetings - I'm at my wits end trying to fix this. Every day, every few hours the same 3 or similar 3 messages are delivered and are not scored. The last time somebody reported behavior like that, they had a

Re: Adding a blacklist via sa-update - would you mind?

2011-12-01 Thread Karsten Bräckelmann
How very subversive... On Thu, 2011-12-01 at 12:58 -0500, dar...@chaosreigns.com wrote: There is some question among spamassassin developers* on whether or not it is acceptable to increase the network load of spamassassin, by one DNS query per email, for existing releases (version 3.3.x), by

Re: Bayes database in mysql on multiple servers

2011-12-01 Thread Michael Scheidell
On 12/1/11 10:06 AM, Benny Pedersen wrote: does not make sense so hire a unix programmer to help you understand. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 *| *SECNAP Network Security Corporation * Best Mobile Solutions Product of 2011 * Best Intrusion Prevention Product

Re: SA assistance needed willing to compensate for a solution

2011-12-01 Thread Edward O'Rourke
If you open them with a plain text editor the headers are there. However here is the text of one of the headers they are mostly all the same. They do get a score sorry for my poor choice of wording. No catch all delivery and thank you for your replies I truly appreciate it. The first is the

Re: how to check the size of the subject?

2011-12-01 Thread Sergio
Working great! lol On Thu, Dec 1, 2011 at 5:10 PM, Benny Pedersen m...@junc.org wrote: On Thu, 1 Dec 2011 16:59:33 -0600, Sergio wrote: Sorry, I always reply to the list, this time it flips on me. try reply now, just testing :-)

Re: URIBL_PH_SURBL

2011-12-01 Thread Tom Kinghorn
On 01/12/2011 20:11, dar...@chaosreigns.com wrote: So it's entirely possible to have a rule that hits a very small percentage of spam with a very large score. Thank you to all who replied. It is much clearer now. regards