Re: [qmailtoaster] Fax as tif
George Toft wrote: Looking at the type of mail that I receive, 2.2-2.8 provides a good balance of minimizing spam, and getting [virtually] no false positives. Perhaps I'm trying to tune SA with the wrong tool (adjusting the score)? When all you have is a hammer, every problem looks like a nail. Maybe I need a screwdriver? George Toft, CISSP, MSIS 623-203-1760 Your screwdriver would be RBLs (if you're using the stock default). Quite effective and efficient. -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Fax as tif
I love the PBL - it immediately cut my spam by 60% (judging from the logs). George Toft, CISSP, MSIS 623-203-1760 Eric Shubes wrote: George Toft wrote: Looking at the type of mail that I receive, 2.2-2.8 provides a good balance of minimizing spam, and getting [virtually] no false positives. Perhaps I'm trying to tune SA with the wrong tool (adjusting the score)? When all you have is a hammer, every problem looks like a nail. Maybe I need a screwdriver? George Toft, CISSP, MSIS 623-203-1760 Your screwdriver would be RBLs (if you're using the stock default). Quite effective and efficient. - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Fax as tif
Putting yahoogroups in local.cf seems to have increased the spam score by 0.9: X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on server.northvalleycomputing.com X-Spam-Level: ** X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, HTML_TINY_FONT autolearn=no version=3.1.8 X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.4 HTML_TINY_FONT RAW: body contains 1 or 0-point font * 0.9 AWL AWL: From: address is in the auto white-list Received: from unknown (HELO n32.bullet.scd.yahoo.com) (66.94.237.26) by server.northvalleycomputing.com with SMTP; 11 Apr 2007 06:49:21 - Contents of /etc/mail/spamassassin/local.cf: # These values can be overridden by editing ~/.spamassassin/user_prefs.cf # (see spamassassin(1) for details) # These should be safe assumptions and allow for simple visual sifting # without risking lost emails. ok_locales all skip_rbl_checks 1 required_score 2.2 report_safe 0 rewrite_header Subject ***SPAM*** use_pyzor 1 use_auto_whitelist 1 use_bayes 1 use_bayes_rules 1 bayes_auto_learn 1 # 04/02/07 NVC: Allow yahoogroups.com whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com So how do I make the score reduce if the mail is in the AWL? George Toft, CISSP, MSIS 623-203-1760 Jake Vickers wrote: George Toft wrote: Closely related . . . How do I whitelist based on a header field? I belong to a couple of mailing lists and some messages are getting flagged as ***SPAM***. Can I whitelist messages based on any of these headers: X-eGroups-Approved-By: azipaegroups [EMAIL PROTECTED] via web; 02 Apr 2007 22:53:49 - Sender: [EMAIL PROTECTED] Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] List-Id: azipa.yahoogroups.com I've tried editing local.cf (seems to be wrong) and /usr/share/spamassassin/60_whitelist.cf. I might be in the right place on the latter, but need a gentle shove in the right direction. You were in the right spot. You don't want to edit the files in /usr/shares/spamassassin as they'll be deleted whenever an upgrade comes around. You want to put the entries in your /etc/mail/spamassassin/local.cf file. Just make sure you lint it and restart the daemon when finished: spamassassin -D --lint And for restarting the daemon you can download a script from my site (v2gnu.com) called qmail-spam or install QT-Plus (qtp.qmailtoaster.com) as it's included in there. You can also do it manually: svc -d /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -t /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -u /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log And you would whitelist yahoogroups.com I know there's been a running thread on the best way to whitelist Yahoo groups on the spamassassin mailing list. Might want to peek at their archives. - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Fax as tif
George Toft wrote: Putting yahoogroups in local.cf seems to have increased the spam score by 0.9: X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on server.northvalleycomputing.com X-Spam-Level: ** X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, HTML_TINY_FONT autolearn=no version=3.1.8 X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.4 HTML_TINY_FONT RAW: body contains 1 or 0-point font * 0.9 AWL AWL: From: address is in the auto white-list Received: from unknown (HELO n32.bullet.scd.yahoo.com) (66.94.237.26) by server.northvalleycomputing.com with SMTP; 11 Apr 2007 06:49:21 - We'd need to see the full headers to see where the email is coming from # 04/02/07 NVC: Allow yahoogroups.com whitelist_from_rcvd [EMAIL PROTECTED] yahoo.com I personally don't lock down my config that much, so I would use: whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] You can do the received way, but I think you can only define 1 per line: whitelist_from_rcvd [EMAIL PROTECTED] whitelist_from_rcvd [EMAIL PROTECTED] Then restart spamd and it should get a little better. smime.p7s Description: S/MIME Cryptographic Signature
Re: [qmailtoaster] Fax as tif
Hi Jake, Here are the headers . . . From - Wed Apr 11 00:56:31 2007 X-Account-Key: account1 X-UIDL: 1176274162.6630.server.northvalleycomputing.com,S=18178 X-Mozilla-Status: 0001 X-Mozilla-Status2: Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 6628 invoked by uid 89); 11 Apr 2007 06:49:22 - DomainKey-Status: bad Received: by simscan 1.3.1 ppid: 6622, pid: 6623, t: 0.9315s scanners: attach: 1.3.1 clamav: 0.90.1-exp/m:42/d:2691 spam: 3.1.8 X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on server.northvalleycomputing.com X-Spam-Level: ** X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, HTML_TINY_FONT autolearn=no version=3.1.8 X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.4 HTML_TINY_FONT RAW: body contains 1 or 0-point font * 0.9 AWL AWL: From: address is in the auto white-list Received: from unknown (HELO n32.bullet.scd.yahoo.com) (66.94.237.26) by server.northvalleycomputing.com with SMTP; 11 Apr 2007 06:49:21 - Received-SPF: none (server.northvalleycomputing.com: domain at returns.groups.yahoo.com does not designate permitted sender hosts) Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=lima; d=yahoogroups.com; b=KCSruvypzTqYlQSrC8nagKE9GdXJA1tx8AsHVgVI5WMlIlwgIREHEhayV6UgIwjz6SXV/6lG7yrCYu3NhlpVa4RmfaBe/eLzEPbEmY2hUu2bicjmIT14N8xMLeVD7nvf; Received: from [209.73.164.83] by n32.bullet.scd.yahoo.com with NNFMP; 11 Apr 2007 06:49:19 - Received: from [66.218.67.85] by t7.bullet.scd.yahoo.com with NNFMP; 11 Apr 2007 06:49:19 - X-Yahoo-Newman-Id: 3517437-m1790 Received: (qmail 17957 invoked from network); 11 Apr 2007 06:49:18 - Received: from unknown (66.218.66.70) by m49.grp.scd.yahoo.com with QMQP; 11 Apr 2007 06:49:18 - Received: from unknown (HELO n7c.bullet.sp1.yahoo.com) (69.147.64.167) by mta12.grp.scd.yahoo.com with SMTP; 11 Apr 2007 06:49:18 - Received: from [216.252.122.217] by n7.bullet.sp1.yahoo.com with NNFMP; 11 Apr 2007 06:48:29 - Received: from [66.218.69.4] by t2.bullet.sp1.yahoo.com with NNFMP; 11 Apr 2007 06:48:29 - Received: from [66.218.66.81] by t4.bullet.scd.yahoo.com with NNFMP; 11 Apr 2007 06:48:29 - X-Sender: [EMAIL PROTECTED] X-Apparently-To: [EMAIL PROTECTED] Received: (qmail 87929 invoked from network); 10 Apr 2007 19:07:52 - Received: from unknown (66.218.67.35) by m31.grp.scd.yahoo.com with QMQP; 10 Apr 2007 19:07:52 - Received: from unknown (HELO n31b.bullet.sp1.yahoo.com) (209.131.38.209) by mta9.grp.scd.yahoo.com with SMTP; 10 Apr 2007 19:07:52 - Received: from [216.252.122.216] by n31.bullet.sp1.yahoo.com with NNFMP; 10 Apr 2007 19:05:37 - Received: from [66.218.69.1] by t1.bullet.sp1.yahoo.com with NNFMP; 10 Apr 2007 19:05:37 - Received: from [66.218.66.90] by t1.bullet.scd.yahoo.com with NNFMP; 10 Apr 2007 19:05:37 - To: [EMAIL PROTECTED] Message-ID: [EMAIL PROTECTED] User-Agent: eGroups-EW/0.82 X-Mailer: Yahoo Groups Message Poster X-Originating-IP: 209.131.38.209 X-eGroups-Msg-Info: 1:6:0:0 X-Yahoo-Post-IP: 68.3.11.126 From: Tony Deblon [EMAIL PROTECTED] X-Yahoo-Profile: antonyd1976 X-eGroups-Approved-By: azipaegroups [EMAIL PROTECTED] via web; 11 Apr 2007 06:48:29 - Sender: [EMAIL PROTECTED] MIME-Version: 1.0 Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] List-Id: aztech-work.yahoogroups.com Precedence: bulk List-Unsubscribe: mailto:[EMAIL PROTECTED] Date: Tue, 10 Apr 2007 19:05:37 - Subject: ***SPAM*** [aztech-work] C++ Application Developer with Tivoli Storage Manager X-Yahoo-Newman-Property: groups-email-ff Content-Type: multipart/alternative; boundary=F2wXmUQ1XMxgz6e9YfpmR3BQK3zzUP6k7CN7Yvz X-Spam-Prev-Subject: [aztech-work] C++ Application Developer with Tivoli Storage Manager --F2wXmUQ1XMxgz6e9YfpmR3BQK3zzUP6k7CN7Yvz Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable George Toft, CISSP, MSIS 623-203-1760 Jake Vickers wrote: George Toft wrote: Putting yahoogroups in local.cf seems to have increased the spam score by 0.9: X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on server.northvalleycomputing.com X-Spam-Level: ** X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, HTML_TINY_FONT autolearn=no version=3.1.8 X-Spam-Report: * 0.0 HTML_MESSAGE BODY: HTML included in message * 1.4 HTML_TINY_FONT RAW: body contains 1 or 0-point font * 0.9 AWL AWL: From: address is in the auto white-list Received: from unknown (HELO n32.bullet.scd.yahoo.com) (66.94.237.26) by server.northvalleycomputing.com with SMTP; 11 Apr 2007 06:49:21 - We'd need to see the full headers to see where the email is coming from # 04/02/07 NVC: Allow yahoogroups.com
Re: [qmailtoaster] Fax as tif
George Toft wrote: Hi Jake, Here are the headers . . . X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, That score is rather low in my opinion. The default required is 5. Almost all of the scores in SA are geared to get it above the 5 score, so almost all of them will score above 2.2 smime.p7s Description: S/MIME Cryptographic Signature
Re: [qmailtoaster] Fax as tif
Looking at the type of mail that I receive, 2.2-2.8 provides a good balance of minimizing spam, and getting [virtually] no false positives. Perhaps I'm trying to tune SA with the wrong tool (adjusting the score)? When all you have is a hammer, every problem looks like a nail. Maybe I need a screwdriver? George Toft, CISSP, MSIS 623-203-1760 Jake Vickers wrote: George Toft wrote: Hi Jake, Here are the headers . . . X-Spam-Status: Yes, score=2.3 required=2.2 tests=AWL,HTML_MESSAGE, That score is rather low in my opinion. The default required is 5. Almost all of the scores in SA are geared to get it above the 5 score, so almost all of them will score above 2.2 - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Fax as tif
George Toft wrote: Closely related . . . How do I whitelist based on a header field? I belong to a couple of mailing lists and some messages are getting flagged as ***SPAM***. Can I whitelist messages based on any of these headers: X-eGroups-Approved-By: azipaegroups [EMAIL PROTECTED] via web; 02 Apr 2007 22:53:49 - Sender: [EMAIL PROTECTED] Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] List-Id: azipa.yahoogroups.com I've tried editing local.cf (seems to be wrong) and /usr/share/spamassassin/60_whitelist.cf. I might be in the right place on the latter, but need a gentle shove in the right direction. You were in the right spot. You don't want to edit the files in /usr/shares/spamassassin as they'll be deleted whenever an upgrade comes around. You want to put the entries in your /etc/mail/spamassassin/local.cf file. Just make sure you lint it and restart the daemon when finished: spamassassin -D --lint And for restarting the daemon you can download a script from my site (v2gnu.com) called qmail-spam or install QT-Plus (qtp.qmailtoaster.com) as it's included in there. You can also do it manually: svc -d /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -t /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -u /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log And you would whitelist yahoogroups.com I know there's been a running thread on the best way to whitelist Yahoo groups on the spamassassin mailing list. Might want to peek at their archives. smime.p7s Description: S/MIME Cryptographic Signature
Re: [qmailtoaster] Fax as tif
Thanks, Jake. Do you sleep? Answering e-mail at 3:54am? Yikes! George Toft, CISSP, MSIS 623-203-1760 Jake Vickers wrote: George Toft wrote: Closely related . . . How do I whitelist based on a header field? I belong to a couple of mailing lists and some messages are getting flagged as ***SPAM***. Can I whitelist messages based on any of these headers: X-eGroups-Approved-By: azipaegroups [EMAIL PROTECTED] via web; 02 Apr 2007 22:53:49 - Sender: [EMAIL PROTECTED] Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] List-Id: azipa.yahoogroups.com I've tried editing local.cf (seems to be wrong) and /usr/share/spamassassin/60_whitelist.cf. I might be in the right place on the latter, but need a gentle shove in the right direction. You were in the right spot. You don't want to edit the files in /usr/shares/spamassassin as they'll be deleted whenever an upgrade comes around. You want to put the entries in your /etc/mail/spamassassin/local.cf file. Just make sure you lint it and restart the daemon when finished: spamassassin -D --lint And for restarting the daemon you can download a script from my site (v2gnu.com) called qmail-spam or install QT-Plus (qtp.qmailtoaster.com) as it's included in there. You can also do it manually: svc -d /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -t /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log svc -u /var/qmail/supervise/spamd /var/qmail/supervise/spamd/log And you would whitelist yahoogroups.com I know there's been a running thread on the best way to whitelist Yahoo groups on the spamassassin mailing list. Might want to peek at their archives. - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Fax as tif
Closely related . . . How do I whitelist based on a header field? I belong to a couple of mailing lists and some messages are getting flagged as ***SPAM***. Can I whitelist messages based on any of these headers: X-eGroups-Approved-By: azipaegroups [EMAIL PROTECTED] via web; 02 Apr 2007 22:53:49 - Sender: [EMAIL PROTECTED] Mailing-List: list [EMAIL PROTECTED]; contact [EMAIL PROTECTED] Delivered-To: mailing list [EMAIL PROTECTED] List-Id: azipa.yahoogroups.com I've tried editing local.cf (seems to be wrong) and /usr/share/spamassassin/60_whitelist.cf. I might be in the right place on the latter, but need a gentle shove in the right direction. George Toft Jake Vickers wrote: Jim Shupert, Jr. wrote: Friends, we have a phone system that will get a fax and then send it as an email. the email is mostly an attachment ( tif ) my challenge is that these are being marked as ***spam*** I think ... i need to whitelist or somehow always let mail that is from [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] to come through. note it is coming from within my domain and I have looked at ( and edited the var/qmail/control/simcontrol ) so i know the problem is not the attachment (tif) In your /etc/mail/spamassassin/local.cf: whitelist_from [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
[qmailtoaster] Fax as tif
Friends, we have a phone system that will get a fax and then send it as an email. the email is mostly an attachment ( tif ) my challenge is that these are being marked as ***spam*** I think ... i need to whitelist or somehow always let mail that is from [EMAIL PROTECTED] to come through. note it is coming from within my domain and I have looked at ( and edited the var/qmail/control/simcontrol ) so i know the problem is not the attachment (tif) i think this dab of fun is the clue - Received: from unknown Received: from unknown (HELO mailhost.mydom.com) (192.168.200.1) -- the entire headers look like this Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 26725 invoked by uid 89); 3 Apr 2007 20:17:12 - Received: from unknown (HELO mailhost.mydom.com) (192.168.200.1) by sifter.pps-inc.com with SMTP; 3 Apr 2007 20:17:12 - Date: Tue Apr 03 21:18:02 2007 GMT From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Toshiba FAX Message 12C48ABF X-TOSHIBA-TAIS-STRATAGY-ES-ID: 314870463.8355 X-TOSHIBA-TAIS-STRATAGY-ALLOW-REPLY: 0 X-TOSHIBA-TAIS-STRATAGY-FROM-UAID: -7 Mime-Version: 1.0 Content-Type: multipart/mixed; boundary=-==_ ==__314870463.8355:1175635082_2262b105 _==__--
Re: [qmailtoaster] Fax as tif
Jim Shupert, Jr. wrote: Friends, we have a phone system that will get a fax and then send it as an email. the email is mostly an attachment ( tif ) my challenge is that these are being marked as ***spam*** I think ... i need to whitelist or somehow always let mail that is from [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] to come through. note it is coming from within my domain and I have looked at ( and edited the var/qmail/control/simcontrol ) so i know the problem is not the attachment (tif) In your /etc/mail/spamassassin/local.cf: whitelist_from [EMAIL PROTECTED] smime.p7s Description: S/MIME Cryptographic Signature
