Re: bayes not active although enabled?
On Sun, July 26, 2009 04:43, snowweb wrote: In /etc/mail/spamassassin/local.cf bayes_auto_learn 1 But when I examine the message headers, X-Spam-Status: No, score=3.0 required=4.7 tests=ALL_TRUSTED,AWL,HTML_MESSAGE, MIME_HTML_ONLY,TVD_RCVD_IP autolearn=no version=3.2.4 Is there anywhere else that I need to switch this on? score 3.0 is inside default range for bayes learning as ham or spam, see perldoc Mail::SpamAssassin::Conf so bayes wont learn it, if it was -0.2 it will learn as ham, or 12.1 it will learn as spam -- xpoint
Re: Score -71 for VERY spammy message!
On Sun, July 26, 2009 05:07, snowweb wrote: I can't understand what is going on here! How can it get a score like that? The message contained just an image and a link. add score whitelist_from 0.1 in user_prefs or local.cf restart spamd -- xpoint
Re: Score -71 for VERY spammy message!
On Sun, July 26, 2009 14:18, Benny Pedersen wrote: On Sun, July 26, 2009 05:07, snowweb wrote: I can't understand what is going on here! How can it get a score like that? The message contained just an image and a link. add score whitelist_from 0.1 ups USER_IN_WHITELIST not whitelist_from here so score USER_IN_WHITELIST 0.1 to have it resolved forever with mistakes in user_prefs or local.cf restart spamd -- xpoint
Re: Score -71 for VERY spammy message!
Benny Pedersen wrote: On Sun, July 26, 2009 05:07, snowweb wrote: I can't understand what is going on here! How can it get a score like that? The message contained just an image and a link. add score whitelist_from 0.1 in user_prefs or local.cf restart spamd Um, that's not going to do anything except generate errors Benny. 1) There is no rule named whitelist_from to assign a score to. The rule name is USER_IN_WHITELIST, not whitelist_from. So you'd have to do: score USER_IN_WHITELIST 0.1. 2) Doing this completely defeats all the user-configured static whitelisting in SA. You'd be better off removing all your whitelist_from statements instead. i.e.: don't be stupid and treat the symptoms when it's just as easy to treat the cause.
Re: Score -71 for VERY spammy message!
On Sun, July 26, 2009 14:31, Matt Kettler wrote: Um, that's not going to do anything except generate errors Benny. yes, its early in the morning here local time atleast for me, and i did not think what i writed above, but i discowered the error later, imho whitelist_from should be removed from sa, it creates so much more problem then it solves 1) There is no rule named whitelist_from to assign a score to. The rule name is USER_IN_WHITELIST, not whitelist_from. So you'd have to do: score USER_IN_WHITELIST 0.1. yes, but last . must not be there :-) 2) Doing this completely defeats all the user-configured static whitelisting in SA. You'd be better off removing all your whitelist_from statements instead. yes i already have, but none will properly do this soon i.e.: don't be stupid and treat the symptoms when it's just as easy to treat the cause. yep, just blame cpanel :) -- xpoint
Re: bayes not active although enabled?
Benny Pedersen wrote: On Sun, July 26, 2009 04:43, snowweb wrote: In /etc/mail/spamassassin/local.cf bayes_auto_learn 1 But when I examine the message headers, X-Spam-Status: No, score=3.0 required=4.7 tests=ALL_TRUSTED,AWL,HTML_MESSAGE, MIME_HTML_ONLY,TVD_RCVD_IP autolearn=no version=3.2.4 Is there anywhere else that I need to switch this on? score 3.0 is inside default range for bayes learning as ham or spam, see perldoc Mail::SpamAssassin::Conf so bayes wont learn it, if it was -0.2 it will learn as ham, or 12.1 it will learn as spam -- xpoint Sorry Benny, my message wasn't very clear (although your information was interesting). However, my main concern is that it is not using bayes to analyse the messages, let alone to learn from them. I've now trained bayes with well over 200 mails, using sa-learn but I'm wondering if the parameters you mentions prevent it from learning even when using sa-learn since it still has not kicked in? -- View this message in context: http://www.nabble.com/bayes-not-active-although-enabled--tp24663548p24666833.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: bayes not active although enabled?
On Sun, July 26, 2009 15:10, snowweb wrote: Sorry Benny, my message wasn't very clear (although your information was interesting). However, my main concern is that it is not using bayes to analyse the messages, let alone to learn from them. sa-learn --dump magic I've now trained bayes with well over 200 mails, using sa-learn but I'm wondering if the parameters you mentions prevent it from learning even when using sa-learn since it still has not kicked in? there can be multiple tflags with noautolearn for the msg being tested, i just want to be sure you see same problem if scores is less then -0.1 or bigger then 12.1 -- xpoint
Re: bayes not active although enabled?
Benny Pedersen wrote: On Sun, July 26, 2009 15:10, snowweb wrote: Sorry Benny, my message wasn't very clear (although your information was interesting). However, my main concern is that it is not using bayes to analyse the messages, let alone to learn from them. sa-learn --dump magic I've now trained bayes with well over 200 mails, using sa-learn but I'm wondering if the parameters you mentions prevent it from learning even when using sa-learn since it still has not kicked in? there can be multiple tflags with noautolearn for the msg being tested, i just want to be sure you see same problem if scores is less then -0.1 or bigger then 12.1 -- xpoint I love you guys! You're spot on everytime... [r...@s1 Maildir]# sa-learn --dump magic [9647] warn: FuzzyOcr: Cannot find executable for tesseract 0.000 0 3 0 non-token data: bayes db version 0.000 0258 0 non-token data: nspam 0.000 0160 0 non-token data: nham 0.000 0 26027 0 non-token data: ntokens 0.000 0 1245088823 0 non-token data: oldest atime 0.000 0 1248611169 0 non-token data: newest atime 0.000 0 1248614005 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count I see from that, that I've not trained as many HAM as I thought! OK, I'm off in search of some more HAM! Thanks guys. -- View this message in context: http://www.nabble.com/bayes-not-active-although-enabled--tp24663548p24666952.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: bayes not active although enabled?
On Sun, July 26, 2009 15:29, snowweb wrote: 0.000 0258 0 non-token data: nspam 0.000 0160 0 non-token data: nham try to have them more or less equal to have good bayes db so if less then 1000 in diff is fine if more then 1000 adjust learning scores I see from that, that I've not trained as many HAM as I thought! OK, I'm off in search of some more HAM! Thanks guys. super you found the problem finaly -- xpoint
Re: pilz spammers with new variations
On Sat, 2009-07-25 at 16:07 -0500, McDonald, Dan wrote:
... (?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)[[:punct:]]?\b/i
That part is superfluous. If it matches a punctuation char, its optional
variant (matching no char) will make the \b word boundary match as well.
All it does is eat a char, and have the RE engine backtrack again. ;)
--
char *t=\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128 (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: bayes not active although enabled?
Benny Pedersen wrote: On Sun, July 26, 2009 15:29, snowweb wrote: 0.000 0258 0 non-token data: nspam 0.000 0160 0 non-token data: nham try to have them more or less equal to have good bayes db so if less then 1000 in diff is fine if more then 1000 adjust learning scores I see from that, that I've not trained as many HAM as I thought! OK, I'm off in search of some more HAM! Thanks guys. super you found the problem finaly -- xpoint Sorry, it hasn't solved it :( As you can see below, I now have more than 200 of both SPAM HAM trained: [r...@s1 Maildir]# sa-learn --dump magic [1644] warn: FuzzyOcr: Cannot find executable for tesseract 0.000 0 3 0 non-token data: bayes db version 0.000 0278 0 non-token data: nspam 0.000 0221 0 non-token data: nham 0.000 0 34120 0 non-token data: ntokens 0.000 0 1245088823 0 non-token data: oldest atime 0.000 0 1248616170 0 non-token data: newest atime 0.000 0 1248620830 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count but here are the spam headers of a message, which show that bayes is not being used: X-Spam-Flag: NO X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on s1.snowweb.info X-Spam-Level: ** X-Spam-Status: No, score=3.0 required=4.7 tests=RELAYCOUNTRY_US autolearn=no version=3.2.4 X-Spam-Report: * 3.0 RELAYCOUNTRY_US Relayed through United States of America * 0.0 HTML_MESSAGE BODY: HTML included in message X-Spam-Relay-Country: US US US US US US US US US This is not a random event. Bayes is not being used for any message. -- View this message in context: http://www.nabble.com/bayes-not-active-although-enabled--tp24663548p24667935.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: bayes not active although enabled?
Benny Pedersen wrote: On Sun, July 26, 2009 15:29, snowweb wrote: 0.000 0258 0 non-token data: nspam 0.000 0160 0 non-token data: nham try to have them more or less equal to have good bayes db so if less then 1000 in diff is fine if more then 1000 adjust learning scores I see from that, that I've not trained as many HAM as I thought! OK, I'm off in search of some more HAM! Thanks guys. super you found the problem finaly -- xpoint Sorry, it hasn't solved it :( As you can see below, I now have more than 200 of both SPAM HAM trained: [r...@s1 Maildir]# sa-learn --dump magic [1644] warn: FuzzyOcr: Cannot find executable for tesseract 0.000 0 3 0 non-token data: bayes db version 0.000 0278 0 non-token data: nspam 0.000 0221 0 non-token data: nham 0.000 0 34120 0 non-token data: ntokens 0.000 0 1245088823 0 non-token data: oldest atime 0.000 0 1248616170 0 non-token data: newest atime 0.000 0 1248620830 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count but here are the spam headers of a message, which show that bayes is not being used: X-Spam-Flag: NO X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on s1.snowweb.info X-Spam-Level: ** X-Spam-Status: No, score=3.0 required=4.7 tests=RELAYCOUNTRY_US autolearn=no version=3.2.4 X-Spam-Report: * 3.0 RELAYCOUNTRY_US Relayed through United States of America * 0.0 HTML_MESSAGE BODY: HTML included in message X-Spam-Relay-Country: US US US US US US US US US This is not a random event. Bayes is not being used for any message. Which user you run the spam check with? sa-learn shows root's magic. If use for example use user spam to check the spam, you should call sa-learn as sa-learn -u spam --dump magic
Re: bayes not active although enabled?
Benny Pedersen wrote: On Sun, July 26, 2009 15:29, snowweb wrote: 0.000 0258 0 non-token data: nspam 0.000 0160 0 non-token data: nham try to have them more or less equal to have good bayes db so if less then 1000 in diff is fine if more then 1000 adjust learning scores I see from that, that I've not trained as many HAM as I thought! OK, I'm off in search of some more HAM! Thanks guys. super you found the problem finaly -- xpoint Sorry, it hasn't solved it :( As you can see below, I now have more than 200 of both SPAM HAM trained: [r...@s1 Maildir]# sa-learn --dump magic [1644] warn: FuzzyOcr: Cannot find executable for tesseract 0.000 0 3 0 non-token data: bayes db version 0.000 0278 0 non-token data: nspam 0.000 0221 0 non-token data: nham 0.000 0 34120 0 non-token data: ntokens 0.000 0 1245088823 0 non-token data: oldest atime 0.000 0 1248616170 0 non-token data: newest atime 0.000 0 1248620830 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count but here are the spam headers of a message, which show that bayes is not being used: X-Spam-Flag: NO X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on s1.snowweb.info X-Spam-Level: ** X-Spam-Status: No, score=3.0 required=4.7 tests=RELAYCOUNTRY_US autolearn=no version=3.2.4 X-Spam-Report: * 3.0 RELAYCOUNTRY_US Relayed through United States of America * 0.0 HTML_MESSAGE BODY: HTML included in message X-Spam-Relay-Country: US US US US US US US US US This is not a random event. Bayes is not being used for any message. Which user you run the spam check with? sa-learn shows root's magic. If use for example use user spam to check the spam, you should call sa-learn as sa-learn -u spam --dump magic One can also use bayes_sql_override_username spam in local.cf, if the bayes is in a SQL database. I have that, and there seems to be no difference if I use -u or not.
Re: pilz spammers with new variations
On Sun, 26 Jul 2009, Karsten Br�ckelmann wrote: On Sun, 2009-07-26 at 17:19 +0200, Karsten Bräckelmann wrote: On Sat, 2009-07-25 at 16:07 -0500, McDonald, Dan wrote: ... (?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)[[:punct:]]?\b/i That part is superfluous. If it matches a punctuation char, its optional variant (matching no char) will make the \b word boundary match as well. Crap, that's actually wrong. :/ There is exactly *one* char in the POSIX punct char class, that also is a word char -- the underscore... So that translates to with an optional underscore after the TLD. Sorry, my bad. That's an inefficient and confusing way to deal with the fact that underscore breaks \b, and doesn't cover all cases. I prefer: Before text: \b_* After text: _*\b As in:/\b_*www_*\b/ -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- When designing software, any time you think to yourself a user would never be stupid enough to do *that*, you're wrong. --- 10 days until the 274th anniversary of John Peter Zenger's acquittal
Re: bayes not active although enabled?
Jari Fredriksson wrote: One can also use bayes_sql_override_username spam in local.cf, if the bayes is in a SQL database. I have that, and there seems to be no difference if I use -u or not. I was wondering whether it was a user issue earlier, but I tried sa-learn --username=user --dump magic and it seemed to give the same result as the default user. I tried various different users (even made some up!) but it didn't complain - still gave me the same dump. While writing this, I just checked messages on another domain/user and found that bayes is working there! phew! That's a relief... it seems that it is only on my domain that we have an issue. On Friday, due to a lack of understanding of how spamassassin works, I renamed the following: /home/snowbnet/.spamassassin/bayes.mutex /home/snowbnet/.spamassassin/bayes_journal /home/snowbnet/.spamassassin/bayes_seen /home/snowbnet/.spamassassin/bayes_toks I added .old to the end of each. Afterwards, spamassassin recreated them and I though all was good, but because bayes stopped working, I changed them back and removed the newly created versions. In hind sight, I guess it just needed training. Anyway, don't know if what I did is related to this problem. Is the 'user', the email account user or the domain user? Also, I've just noticed that the bayes_journal has not been modified since Saturday about the time I renamed stuff. -- View this message in context: http://www.nabble.com/bayes-not-active-although-enabled--tp24663548p24668896.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: United-MAP spam flood
Paweł Tęcza a écrit : Hello Folks, Did you also get many spams from United-MAP, a dynamic company with rapid development, with a united team of professionals in its core.? :) Or maybe this new spam flood is only Poland targeted? or maybe we don't see them because they come from clients that are in spamhaus PBL? Here are a few spam samples: http://pastebin.com/m178f4a58 The client is listed in the PBL (+ISP maintained, so the isitng is probably old), and in the CBL. http://pastebin.com/m6d07f79d at this time, 62.33.94.189 is listed in PBL and CBL. http://pastebin.com/m477546b9 at this time, 92.230.188.145 is listed in PBL, CBL and SORBS_DUL consider blocking .adsl.alicedsl.de in MTA (or add corresponding rule in SA). My best regards, Pawel
Catch-22 unsubscribing from this list.
There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address users-unsubscr...@spamassassin.apache.org complains that my IP address is dynamic (which is why I use dyndns.org, thank you very much.) And on that subject, am I the only person who thinks that blocking by IP address block is inefficient, brute force, and prone to both false positives and false negatives? I'm setting up filters (ironically using spamassassin) to block this list, but frankly it strikes me as impolite to filter this list - isn't there a way to unsubscribe? Mike-
Re: Catch-22 unsubscribing from this list.
On Sun, July 26, 2009 00:07, Michael W. Cocke wrote: I'm setting up filters (ironically using spamassassin) to block this list, but frankly it strikes me as impolite to filter this list - isn't there a way to unsubscribe? how did you subscribe ? ;) help sent to you -- xpoint
[no subject]
On Sat, 25 Jul 2009, Michael W. Cocke wrote: There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address users-unsubscr...@spamassassin.apache.org complains that my IP address is dynamic (which is why I use dyndns.org, thank you very much.) And on that subject, am I the only person who thinks that blocking by IP address block is inefficient, brute force, and prone to both false positives and false negatives? If you are sending out from your dynamic home connection, you are going to have bigger problems, most of the big ISP's and many many many others block at MTA level for your type of connections, either get a static IP *and* a real PTR entry, or use your ISP as smarthost. Nothing wrong with the way this list is setup apart from it uses qmail, but we wont go into that :) -- Res -Beware of programmers who carry screwdrivers
Re: Catch-22 unsubscribing from this list.
On Sat, 25 Jul 2009 18:07:12 -0400 Michael W. Cocke cocke.mich...@gmail.com wrote: There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address users-unsubscr...@spamassassin.apache.org complains that my IP address is dynamic (which is why I use dyndns.org, thank you very much.) Presumably it's complaining that you are sending direct to mx from a dynamic IP address. If you run a mail server on an dynamic address, you should send your outgoing mail through a smarthost. And on that subject, am I the only person who thinks that blocking by IP address block is inefficient, brute force, and prone to both false positives It's extremely efficient, blocklists catch most spam, many spamassassin installations would be overwhelmed if they had to deal with it all. It's arguable that there's no such thing as a false positive in this area anymore, because the consensus against receiving mail from dynamic addresses is now so strong that it's in the senders own interest that they be forced to fix their problem. and false negatives? That's why we have Spamassassin.
Re: bayes not active although enabled?
snowweb wrote: I was wondering whether it was a user issue earlier, but I tried sa-learn --username=user --dump magic and it seemed to give the same result as the default user. I tried various different users (even made some up!) but it didn't complain - still gave me the same dump. While writing this, I just checked messages on another domain/user and found that bayes is working there! phew! That's a relief... it seems that it is only on my domain that we have an issue. On Friday, due to a lack of understanding of how spamassassin works, I renamed the following: /home/snowbnet/.spamassassin/bayes.mutex /home/snowbnet/.spamassassin/bayes_journal /home/snowbnet/.spamassassin/bayes_seen /home/snowbnet/.spamassassin/bayes_toks I added .old to the end of each. Afterwards, spamassassin recreated them and I thought all was good, but because bayes stopped working, I changed them back and removed the newly created versions. In hind sight, I guess it just needed training. Anyway, don't know if what I did is related to this problem. Also, I've just noticed that the bayes_journal has not been modified since Saturday about the time I renamed stuff. To recap, update and summarize: Bayes is not being used for one domain on the server. For the others it is. Bayes is file based not mysql based. When I do sa-learn --username=user --dump magic I get the same result for whatever username I try, even if the user doesn't exist. sa-learn --dump tells me that both nspam nham are 200 so it isn't waiting for training. I probably created the problem on Saturday when in ignorance, I decided that I would erase the bayes db and retrain it. I renamed the bayes_ files in /home/username/.spamassassin/ by adding .old. They were all automatically recreated but bayes no longer worked. Not understanding that perhaps they just needed training, I renamed them back and removed the new files. However, bayes did not resume working. I have since used sa-learn --clear and then retrained it with 200+ each of spam and ham but it still has not started working. I can't figure out whether on my system SA is using one bayes db for the whole system or one for each user or domain? However, the other domains seem to be working ok. In /etc/mail/spamassassin/ I have use_bayes 1 Perhaps someone could spot something I've missed for me? Meanwhile, I'll go and study the wiki some more. Thanks. -- View this message in context: http://www.nabble.com/bayes-not-active-although-enabled--tp24663548p24672500.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: Catch-22 unsubscribing from this list.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 07/26/09 20:01, quoth RW: On Sat, 25 Jul 2009 18:07:12 -0400 Michael W. Cocke cocke.mich...@gmail.com wrote: There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address users-unsubscr...@spamassassin.apache.org complains that my IP address is dynamic (which is why I use dyndns.org, thank you very much.) Presumably it's complaining that you are sending direct to mx from a dynamic IP address. If you run a mail server on an dynamic address, you should send your outgoing mail through a smarthost. I'd be curious to hear more on this. I have a server running at home. My ISP gives me a so-called static address that I pay extra for. It's really just an IP address from their pool of dynamic addresses so it registers as really coming from a dynamic address. Somehow I got lucky and got a reverse dns record so if you look my ip up you'll see me and not my ISP. The rest is done through zoneedit.com which does a fabulous job. I do have a substantial list of people who will not accept email if it is sent to them directly. For each of them I have an entry in my sendmail mailertable. So if you see a domain that is not accepting from you because you're a dynamic address then it's up to you to reroute your email. I would like to state that apache.org is *not* in my mailertable; I deliver direct and have not had a rejection. - -- Time flies like the wind. Fruit flies like a banana. Stranger things have .0. happened but none stranger than this. Does your driver's license say Organ ..0 Donor?Black holes are where God divided by zero. Listen to me! We are all- 000 individuals! What if this weren't a hypothetical question? steveo at syslang.net -BEGIN PGP SIGNATURE- Version: GnuPG v2.0.10 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ iEYEARECAAYFAkptFGQACgkQRIVy4fC+NyS71QCaA3gA86DyaRf8fRyPWVx1bVRO d70An1/As+m7caim00P1OLtD2u3uoTAM =BN4P -END PGP SIGNATURE-
