Is spamming legal in the UK ?

2009-10-23 Thread Per Jessen
I was just spammed by T-mobile (UK).  Seems incredible that an otherwise
reputable company would sink so low - does anyone know if spamming
(given the right conditions) is legal in the UK ?


/Per Jessen, Zürich



Re: Is spamming legal in the UK ?

2009-10-23 Thread Andreas Rehmer

Hi,

i dont know it exactly but i dont think it. One day before the 
Bundestagswahl in Germany. Guido Westerwelle (Leader from an big faction) 
send around a Spam-Mail to vote for his faction. I think its enough that 
you can say i get the adresses legally eg. from an adress trader or 
something else. Then you mostly have no Problems to send around spam.


Mit freundlichen Grüßen

Andreas Rehmer - IT
--
Tel.: 030/453081-506




teltarif.de Onlineverlag GmbH
Alt-Moabit 96c, 10559 Berlin
Tel:  +49 (0)30 453 081-0
Fax:  +49 (0)30 453 081-11
Mail: mailto:i...@teltarif.de
WWW:  http://www.teltarif.de

Geschäftsführer: Kai Petzke, Martin Müller
eingetragen beim Amtsgericht Berlin-Charlottenburg, HRB 70507
Umsatzsteuer-ID: DE201038407

Attraktives Werbeumfeld gefällig?
Vielfältige Targetingoptionen, eine E-Commerce-affine Leserschaft und
passgenaue Platzierungen sorgen für Ihren Werbeerfolg bei teltarif.de.
Weitere Informationen: http://www.teltarif.de/mediadaten


On Fri, 23 Oct 2009, Per Jessen wrote:


Date: Fri, 23 Oct 2009 10:38:06
From: Per Jessen p...@computer.org
To: users@spamassassin.apache.org
Subject: Is spamming legal in the UK ?

I was just spammed by T-mobile (UK).  Seems incredible that an otherwise
reputable company would sink so low - does anyone know if spamming
(given the right conditions) is legal in the UK ?


/Per Jessen, Zürich




Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson


23.10.2009 4:52, MySQL Student kirjoitti:
 Hi,
 
 On the message that should have been scanned:
 
 The emails that has not been tagged at all:
 
 [...]
 From: Angus - 3idea angus.d...@3idea.com
 To: supp...@3idea.com
 
 Are you forwarding this spam from your internal account to this other
 internal supp...@3idea.com account? It also looked like there was no
 external mail server involved.
 
 If so, I would think that SA trusts your internal network, and
 therefore is just passing the message through without even evaluating
 it. If you want your internal mail to also be scanned, remove your
 mail server from trusted_networks and internal_networks.
 
 I think that should fix it.
 
 Regards,
 Alex
 

SpamAssassin DOES NOT bypass scanning, if the internal or trusted
networks contain the server in it.

Own mail server MUST be in those network settings.

The questions follows:

How do you call SpamAssassin? Via spamc? How do you initiate spamc? Does
it somehow bypass local network?


-- 
http://www.iki.fi/jarif/

Stay away from flying saucers today.



signature.asc
Description: OpenPGP digital signature


Re: Is spamming legal in the UK ?

2009-10-23 Thread Toni Mueller

Hi,

On Fri, 23.10.2009 at 11:32:16 +0200, Per Jessen p...@computer.org wrote:
 Toni Mueller wrote:
  I seriously doubt it, besides this probably not being applicable to
  spamming from the UK (not Germany).
 
 One interesting thing about the T-Mobile spam I got is - it was clearly
 sent on behalf of T-Mobile UK, but sent by fagms.net / fagms.de =
 United MailSolutions GmbH in Duesseldorf. 

well, if T-Mobile UK admits to eg. having contracted United
MailSolutions GmbH, then I'd say it's ultimately their responsibility.
But I don't know how you can proceed against them (eg. which laws
apply).

FYI, T-something aggravated some of their resellers just a few months
ago by cutting them off and asking damages from them for not conforming
to certain customer protection laws (the details evade me atm).


Kind regards,
--Toni++



Re: Is spamming legal in the UK ?

2009-10-23 Thread Per Jessen
Toni Mueller wrote:

 On Fri, 23.10.2009 at 11:32:16 +0200, Per Jessen p...@computer.org
 wrote:
 Toni Mueller wrote:
  I seriously doubt it, besides this probably not being applicable to
  spamming from the UK (not Germany).
 
 One interesting thing about the T-Mobile spam I got is - it was
 clearly sent on behalf of T-Mobile UK, but sent by fagms.net /
 fagms.de = United MailSolutions GmbH in Duesseldorf.
 
 well, if T-Mobile UK admits to eg. having contracted United
 MailSolutions GmbH, then I'd say it's ultimately their responsibility.

Yeah. 

 But I don't know how you can proceed against them (eg. which laws
 apply).

I've already upgraded my ruleset, i.e. more points to mails from 
fagms.[net|de].


/Per Jessen, Zürich



RE: Is spamming legal in the UK ?

2009-10-23 Thread Per Jessen
Randal, Phil wrote:

 Yes and no.
 
 The official line is here:
 

http://www.ico.gov.uk/what_we_cover/privacy_and_electronic_communications.aspx
 
 Cheers,
 Phil

Thanks Phil.

The two most pertinent lines would appear to be:

1) The sending of unsolicited direct marketing by phone, fax, email,
text or any other electronic means is strictly regulated.

2) The regulations do not cover electronic mail marketing messages sent
to businesses.

What if you claim you were spamming, uh, emailing a business contact ...
That anti-spam regulation seems as silly and useless as our Swiss ditto. 


/Per Jessen, Zürich



Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
On Fri, 2009-10-23 at 10:38 +0200, Per Jessen wrote:
 I was just spammed by T-mobile (UK).  Seems incredible that an otherwise
 reputable company would sink so low - does anyone know if spamming
 (given the right conditions) is legal in the UK ?
 
 
 /Per Jessen, Zürich
 
Recently I've caught lots of T-Mobile Spam - but it's not what it seems.
Mine has all come from a well know spam outfit:

c01-ltd.co.uk - openviewtime.co.uk 

Received: from pool41-50.mail.openviewtime.co.uk
 (pool41-50.mail.openviewtime.co.uk [213.41.41.50])

Which ultimately come back down to:

Colt Telecommunication France NOC 213.41.41.0 - 213.41.41.255

The amount of French  Spanish IP's I see spamming is something else.
It's second only to Brazil.


Your actual question - is spamming legal in the UK. The answer is NO,it
is not legal to send spam in the UK. Usual caveats apply, must be
'spam' (what is spam?), must be aimed at individuals (not business to
business) and can you prove who actually sent it

Quite apart from the guidelines on sending UCE in the UK, there are
criminal laws that can be put to use - the two common ones:

Telecommunications Act 1984 Section 43:

Improper use of public telecommunication system
(b) sends by those means, for the purpose of causing annoyance,
inconvenience or needless anxiety to another

And far more useful is The Protection from Harassment Act of 1997. 

There are also laws covering things like Data Protection which, whilst
lame in enforcement, exist.



.




Re: Is spamming legal in the UK ?

2009-10-23 Thread rich...@buzzhost.co.uk
I need to add this is in ADDITION to guidelines mostly aimed at junk
faxes published here and already quoted:

http://www.ico.gov.uk/what_we_cover/privacy_and_electronic_communications.aspx



Hostname Based Black/White lists

2009-10-23 Thread Marc Perkel
Does SA support host name based black/white lists? I suppose to do it 
right you might have to pick a specific received line to get the host 
that sent you the email, do FCrDNS, and then do the lookup.


Is something like this available? I'm doing it in Exim on my system, but 
Exim has the host connection information.




update does not work correctly?

2009-10-23 Thread klopp76
Hi,

 

I use Spamassassin 3.2.5 with CentOS

On October 20 I startet an update with this commands:

sa-update --channel updates.spamassassin.org

 

When I start now the update, the date of the folder and file in
/var/lib/spamassassin/3.002005 does not change. It is still the October 20

 

Did anyone an idea why the date does not change?

 

Thanks

 

 



Re: Hostname Based Black/White lists

2009-10-23 Thread McDonald, Dan
On Fri, 2009-10-23 at 03:34 -0700, Marc Perkel wrote:
 Does SA support host name based black/white lists?

like whitelist_rcvd_from ?



-- 
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com


signature.asc
Description: This is a digitally signed message part


Re: update does not work correctly?

2009-10-23 Thread McDonald, Dan
On Fri, 2009-10-23 at 13:02 +0200, klop...@gmx.de wrote:
 Hi,
 
  
 
 I use Spamassassin 3.2.5 with CentOS
 
 On October 20 I startet an update with this commands:
 
 sa-update --channel updates.spamassassin.org
 
  
 
 When I start now the update, the date of the folder and file
 in /var/lib/spamassassin/3.002005 does not change. It is still the
 October 20
 
  
 
 Did anyone an idea why the date does not change?

There hasn't been an update.

Look at the first line
of /var/lib/spamassassin/3.002005/updates_spamassassin_org.cf, and you
will see the current version:
# UPDATE version 795855

Then check DNS to see if a newer version has been published:
$ dig 5.2.3.updates.spamassassin.org txt
...
;; ANSWER SECTION:
5.2.3.updates.spamassassin.org. 3600 IN TXT 795855

Same version.  No change.  Updates.spamassassin.org isn't updated very
often, not since July.  

-- 
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com


signature.asc
Description: This is a digitally signed message part


Re: update does not work correctly?

2009-10-23 Thread Matt Kettler
klop...@gmx.de wrote:

 Hi,

  

 I use Spamassassin 3.2.5 with CentOS

 On October 20 I startet an update with this commands:

 sa-update --channel updates.spamassassin.org

  

 When I start now the update, the date of the folder and file in
 /var/lib/spamassassin/3.002005 does not change. It is still the
 October 20

  

 Did anyone an idea why the date does not change?

Updates are published as needed, which at times means there may be
updates every day, and other times it may be a several months between
releases.

In general spam signatures are fairly broad and generic, and need to be
updated *MUCH* less often than virus signatures. Virus signatures target
a single virus at a time, thus need updating for every new variant,
hence the very frequent releases. SA rules target a generic trait of a
message, and only need updating when there is radical change in the spam
stream.

Looking at the SVN tags, the last update to rules for the 3.2 branch was
pushed back on July 20th.





Re: Spamassassin not tagging some emails

2009-10-23 Thread John Hardin

On Thu, 22 Oct 2009, Angus Dunn wrote:

I have enabled spamassassin on my mail server. Spamassassin is correctly 
tagging most of the email but some of the emails are not.




The correctly tagged emails has the following in the email headers:
Received: from inspiron1505 (titanium [127.0.0.1])
by titanium.3idea.com (8.13.8/8.13.8) with ESMTP id n9N031fU015203
for postmas...@austingrahaminc.com; Thu, 22 Oct 2009 17:03:01 -0700


The emails that has not been tagged at all:
Received: from inspiron1505 (titanium [127.0.0.1])
by titanium.3idea.com (8.13.8/8.13.8) with ESMTP id n9MNutNS014287
for supp...@3idea.com; Thu, 22 Oct 2009 16:56:55 -0700

I have confirmed that spamassassin is running all the time. It seems like
all emails with attachment are passing straight through and not evaluate by
spamassassin.


How is SA glued into your MTA? What rules, if any, are implemented to 
control when a message gets passed to SA for scanning?



The IP of the spam email is from a blacklisted mail server.


Oh? You can't tell that from the examples you posted. Both examples only 
have _one_ Received: header, shoing that the message originates at 
localhost.



I am using the following:
Spamassassin 3.2.5
Sendmail 8.13.8-2
Centos 5.1



If there is additional info i need to provide, please let me know.


(1) How SA is attached to Sendmail. Via procmail? Via a milter? Via some 
other package?


(2) Does the message skipping appear to be related to message size - 
larger message are skipped? Is spamc in use? If so, do you have a size 
limit set that would cause a message with a large attachment would be 
skipped?


(3) Provide full, unedited (i.e. all headers intact) samples of a spam 
message that did not get scanned and one that did get scanned and scored, 
posted to a website (e.g. pastebin) and the URLs to them posted here. 
Please don't send samples to the mailing list.


Something you could check:

Find where spamassassin writes its logs. It will probably be 
/var/log/maillog.


Look for the message-ID of a message that was properly marked up. You 
should find it.


Look for the message-ID of a message that was not marked up at all. Do you 
find it?


If you don't find it then it's likely your glue layer is deciding not to 
ask SA to scan the message, thus the problem does not lie in SA.


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  One death is a tragedy; thirty is a media sensation;
  a million is a statistic.  -- Joseph Stalin, modernized
---
 14 days since President Obama won the Nobel Not George W. Bush prize


OT: Thunderbird filter

2009-10-23 Thread Dan Schaefer
The emails being sent to postfix-users-dig...@cloud9.net are messing 
with my head. I setup a filter to put emails sent to 
users@spamassassin.apache.org into a SA folder. Whenever an email gets 
sent to postfix-users-dig...@cloud9.net, I think there's something wrong 
with TB. I have subsequently added a filter for that address as well.


--
Dan Schaefer
Web Developer/Systems Analyst
Performance Administration Corp.



Re: OT: Thunderbird filter

2009-10-23 Thread Dan Schaefer

Dan Schaefer wrote:
The emails being sent to postfix-users-dig...@cloud9.net are messing 
with my head. I setup a filter to put emails sent to 
users@spamassassin.apache.org into a SA folder. Whenever an email gets 
sent to postfix-users-dig...@cloud9.net, I think there's something 
wrong with TB. I have subsequently added a filter for that address as 
well.



I'm an idiot...wrong user list :-[

--
Dan Schaefer
Web Developer/Systems Analyst
Performance Administration Corp.



Re: OT: Thunderbird filter

2009-10-23 Thread Adam Katz
Dan Schaefer wrote:
 The emails being sent to postfix-users-dig...@cloud9.net are
 messing with my head. I setup a filter to put emails sent to 
 users@spamassassin.apache.org into a SA folder. Whenever an email
 gets sent to postfix-users-dig...@cloud9.net, I think there's
 something wrong with TB. I have subsequently added a filter for
 that address as well.

This list's mail is not addressed to each individual user, so you
can't catch that in Thunderbird (look at the headers, you won't find
your personal address in any To or Cc headers).  My Thunderbird filter
looks for us...@spamassasin.apache.org

If you really wanted to filter by recipient address, you could filter
by Delivered-To, but you should check to make sure that that header
exists given your own environment.  I haven't had any luck using
Thunderbird to filter with Received headers.


Re: OT: Thunderbird filter

2009-10-23 Thread Jari Fredriksson


23.10.2009 18:26, Adam Katz kirjoitti:
 Dan Schaefer wrote:
 The emails being sent to postfix-users-dig...@cloud9.net are
 messing with my head. I setup a filter to put emails sent to 
 users@spamassassin.apache.org into a SA folder. Whenever an email
 gets sent to postfix-users-dig...@cloud9.net, I think there's
 something wrong with TB. I have subsequently added a filter for
 that address as well.
 
 This list's mail is not addressed to each individual user, so you
 can't catch that in Thunderbird (look at the headers, you won't find
 your personal address in any To or Cc headers).  My Thunderbird filter
 looks for us...@spamassasin.apache.org
 
 If you really wanted to filter by recipient address, you could filter
 by Delivered-To, but you should check to make sure that that header
 exists given your own environment.  I haven't had any luck using
 Thunderbird to filter with Received headers.
 

How about List-Id: header? I use that in my maildrop. Works like a charm.

-- 
http://www.iki.fi/jarif/

It is often the case that the man who can't tell a lie thinks he is the best
judge of one.
-- Mark Twain, Pudd'nhead Wilson's Calendar



signature.asc
Description: OpenPGP digital signature


Re: hostkarma/uribl_black disparity

2009-10-23 Thread Adam Katz
MySQL Student wrote:
 Over the past few days I have been investigating more closely email
 that wasn't tagged that I thought should have been, and
 vice-versa, using various factors, such as URIBL_BLACK and JMF_W.

Very interesting.

Here's a quick testing script (ymmv on log file syntax):

#
#!/bin/sh

# helper function, see below
_sacount() {
  zgrep -h spamd: result: ${3:+Y} /var/log/mail.lo* \
 |egrep -c $1${2:+.*$2|$2.*$1}
}

# Usage: sa_count RULE1 [RULE2]
# Counts messages marked as RULE1 (and RULE2 if given)
sa_count() {
  c=`_sacount $1 $2`
  sc=`_sacount $1 $2 spam`
  echo Found $c ($sc spam) matching ${2:+both} $1${2:+ and $2}.
}

sa_count RCVD_IN_HOSTKARMA_W URIBL_BLACK
sa_count RCVD_IN_DNSWL URIBL_BLACK
sa_count URIBL_BLACK
sa_count .   # show total numbers

#

My output (note, I greylist):

Found 54 (11 spam) matching both RCVD_IN_HOSTKARMA_W and URIBL_BLACK.
Found 25 (16 spam) matching both RCVD_IN_DNSWL and URIBL_BLACK.
Found 1981 (1919 spam) matching  URIBL_BLACK.
Found 123273 (3791 spam) matching  ..


I don't have data on whether there were FPs or FNs involved.

(And yes, zgrep is perfectly content to deal with uncompressed files.)


Re: Spamassassin not tagging some emails

2009-10-23 Thread MySQL Student
Hi,

 SpamAssassin DOES NOT bypass scanning, if the internal or trusted
 networks contain the server in it.

Hmm.. thanks for correcting me.

How would you, then, go about preventing SA from scanning the
localhost or a specific domain without whitelisting that domain or
range?

Thanks,
Alex


Re: Spamassassin not tagging some emails

2009-10-23 Thread Karsten Bräckelmann
On Fri, 2009-10-23 at 13:04 -0400, MySQL Student wrote:
  SpamAssassin DOES NOT bypass scanning, if the internal or trusted
  networks contain the server in it.
 
 Hmm.. thanks for correcting me.
 
 How would you, then, go about preventing SA from scanning the
 localhost or a specific domain without whitelisting that domain or
 range?

Don't feed the mail to SA. That's the responsibility of your glue,
whatever passes mail to SA.

SA scans *any* mail it gets passed. Using the Shortcircuit plugin, you
can e.g. have SA end early -- but for shortcircuiting to happen, SA
obviously must process the mail.


-- 
char *t=\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}



Re: Spamassassin not tagging some emails

2009-10-23 Thread Jari Fredriksson


23.10.2009 20:04, MySQL Student kirjoitti:
 Hi,
 
 SpamAssassin DOES NOT bypass scanning, if the internal or trusted
 networks contain the server in it.
 
 Hmm.. thanks for correcting me.
 
 How would you, then, go about preventing SA from scanning the
 localhost or a specific domain without whitelisting that domain or
 range?
 
 Thanks,
 Alex
 

Personally, I do call SpamAssassin from maildrop (/etc/maildroprc).

That takes place as

--

if ( $SCAN_SPAM == 1 )
{
 xfilter spamc -H --retry-sleep=10 --connect-retries=100 -d spamd
-u spam
}

--

Than can be done from procmailrc etc. with their own ways.

The SCAN_SPAM variable is a key in this. I can set it to 0 (default
value for script 1) using various tests.

I have various tests for that variable, that this is what whitelists the
message from being passed to SpamAssassin.

--

if (( $SCAN_SPAM == 1)   /^From:\s*(.*)/  lookup( $MATCH1,
/usr/etc/maildrop_sender_whitelist, D ))
{
xfilter reformail -A'X-Whitelisted: $MATCH1 in
/usr/etc/maildrop_sender_whitelist'
SCAN_SPAM=0
}

--

In this case, I have a text file /usr/etc/maildrop_sender_whitelist
which contains email addresses line by line, and if maildrop finds a
match from there, it sets the SCAN_SPAM to 0, thus bypassing the SA call.

This test if earlier in the maildroprc script, the spamc call is of
course in the end.

This kind of whitelisting is of course dangerous, but it it works for
me. The whitelisted addresses are mostly of type
r...@somehost.example.com which are not abused by spammers (knock knock).

You can do all kinds of tests with maildrop. I have also this.

---
# Check for bounces. If matches, no SpamAssassin call needed, because I
do not consider bounce as spam.
if (/^Subject: Mail Delivery Problem/   || \
/^Subject: Mail Delivery \(failure/ || \
/^Subject: Undelivered Mail Returned to Sender/ || \
/^Subject: virus found in sent message/ || \
/^Subject: failure notice / || \
/^Subject: Mail delivery failed/|| \
/^Subject: Undeliverable\:/ || \
/^Subject: Undeliverable [Mm]ail/   || \
/^Subject: Undeliverable Mail/  || \
/^Subject: Undeliverable mail/  || \
/^Subject: Returned mail\: /|| \
/^Subject: DELIVERY FAILURE: User / || \
/^Subject: Yahoo! Auto Response/|| \
/^X-ME-bounce-domain:/  || \
/^X-Failed-Recipients:/ || \
/^X-Yahoo-Newman-Property: groups-bounce/   || \
/^Diagnostic-Code: X-Postfix; host /|| \
/^Content-type: multipart\/report;/ || \
/^Subject: Delivery failed\:/   || \
/^Subject: DELIVERY FAILURE\:/  || \
/^Subject: MESSAGE NOT DELIVERED\: /|| \
/^Subject: Delivery problem/|| \
/^Subject: Email Failure Notification/  || \
/^Subject: Email not allowed/   || \
/^Subject: failure delivery/|| \
/^Subject: failure notice/  || \
/^Subject: Mail Not Delivered/  || \
/^Subject: mail failed, returning to sender/|| \
/^Subject: Nondeliverable mail/ || \
/^Subject: Warning: could not send message for/ || \
/^Subject: MDaemon Warning - Virus Found/   || \
/^Subject: Permanent Delivery Failure/  || \
/^Subject: Mail System Error - Returned Mail/   || \
/^Subject: Mail System Error - Undeliverable Mail/   || \
/^Subject: Transient Delivery Failure/  || \
/^Subject: Message status - undeliverable/  || \
/^Subject: Warning\: message /  || \
/^Subject: Mail could not be delivered/ || \
/^Subject: Your email to .* has NOT been delivered/ || \
/^Subject: Returned mail: see our site/ || \
/^Subject: Delivery failure/ )
{
`logger -p mail.info ** BOUNCE RECEIVED **`
if (hasaddr(ve...@iki.fi))
{
exit
}
xfilter reformail -A'X-Whitelisted: Apparently a bounce,
SpamAssassin will not be called.'
xfilter reformail -A'X-Bounce: Yes '
SCAN_SPAM=0
}

---

It does not scan for Spam Attachments if the mail is a bounce. Bounces
will be 

Email / Inbox Speed Problems

2009-10-23 Thread Sean Leinart
Hi TJ,

Looking over your Inbox situation, you suffer from the same problem as
most here do. 
You have too much email stored on the server. Can you give me a rundown
of the folders
that can be eliminated in your Inbox, we can archive them off then
delete them from your
folders that are online, this will help a great deal.

Thank you,

Sean Leinart
Network Systems Engineer
First Service Carolina Inc.
Raleigh, North Carolina
United States
slein...@fscarolina.com
919-832-5553


RE: Email / Inbox Speed Problems

2009-10-23 Thread Sean Leinart

 -Original Message-
 From: Sean Leinart [mailto:slein...@fscarolina.com] 
 Sent: Friday, October 23, 2009 2:04 PM
 To: TJ Russ
 Cc: allison.ays...@lonesource.com; Spamassassin Mailing List
 Subject: Email / Inbox Speed Problems
 
 Hi TJ,
 
 Looking over your Inbox situation, you suffer from the same 
 problem as most here do. 
 You have too much email stored on the server. Can you give me 
 a rundown of the folders that can be eliminated in your 
 Inbox, we can archive them off then delete them from your 
 folders that are online, this will help a great deal.
 
 Thank you,
 
 Sean Leinart
 Network Systems Engineer
 First Service Carolina Inc.
 Raleigh, North Carolina
 United States
 slein...@fscarolina.com
 919-832-5553
 

DOH!!
 
List, please disregard the erroneous CC: post to the list.

Peace,

Sean


Re: Email / Inbox Speed Problems

2009-10-23 Thread Ted Mittelstaedt

Sean Leinart wrote:

-Original Message-
From: Sean Leinart [mailto:slein...@fscarolina.com] 
Sent: Friday, October 23, 2009 2:04 PM

To: TJ Russ
Cc: allison.ays...@lonesource.com; Spamassassin Mailing List
Subject: Email / Inbox Speed Problems

Hi TJ,

Looking over your Inbox situation, you suffer from the same 
problem as most here do. 
You have too much email stored on the server. Can you give me 
a rundown of the folders that can be eliminated in your 
Inbox, we can archive them off then delete them from your 
folders that are online, this will help a great deal.


Thank you,

Sean Leinart
Network Systems Engineer
First Service Carolina Inc.
Raleigh, North Carolina
United States
slein...@fscarolina.com
919-832-5553



DOH!!
 
List, please disregard the erroneous CC: post to the list.




I had to look twice since it was the identical problem to what
we deal with every week around here.

Ted


Re: Email / Inbox Speed Problems

2009-10-23 Thread Jay Plesset
Geez, unless your users are into the millions of messages, maybe you 
need a more scalable mail server.   My day job is support of the Sun 
comms suite.  I only get these when there are litterally tens of 
millions of messages in an inbox.


jay

Ted Mittelstaedt wrote:

Sean Leinart wrote:

-Original Message-
From: Sean Leinart [mailto:slein...@fscarolina.com] Sent: Friday, 
October 23, 2009 2:04 PM

To: TJ Russ
Cc: allison.ays...@lonesource.com; Spamassassin Mailing List
Subject: Email / Inbox Speed Problems

Hi TJ,

Looking over your Inbox situation, you suffer from the same problem 
as most here do. You have too much email stored on the server. Can 
you give me a rundown of the folders that can be eliminated in your 
Inbox, we can archive them off then delete them from your folders 
that are online, this will help a great deal.


Thank you,

Sean Leinart
Network Systems Engineer
First Service Carolina Inc.
Raleigh, North Carolina
United States
slein...@fscarolina.com
919-832-5553



DOH!!
 
List, please disregard the erroneous CC: post to the list.




I had to look twice since it was the identical problem to what
we deal with every week around here.

Ted


Re: Email / Inbox Speed Problems

2009-10-23 Thread Ted Mittelstaedt

Jay Plesset wrote:
Geez, unless your users are into the millions of messages, maybe you 
need a more scalable mail server.   My day job is support of the Sun 
comms suite.  I only get these when there are litterally tens of 
millions of messages in an inbox.




Where we generally get these problems is when users are running MacOS X
and using the included free Apple Mail as a POP3 client, because one
of the DEFAULTS of that client is to leave a copy of the mail message
on the server.  The typical scenario is that we get one of these users
who runs it this way for a couple months, then one day their relative
starts e-mailing them 50MB pictures of their latest vacation, and once
their e-mail box exceeds 800MB in size, popper (qpopper) starts getting
really slow in downloading the message ID list and their client starts
running like a dog.

There's probably many ways I could fix it, from replacing qpopper to
going to faster disks or more powerful hardware, or running a nightly
script that squawks about the bad citizens, but I frankly don't
feel compelled to allocate all of our POP3 users a gigabyte of disk 
space for their mailbox, and if did fix it then I'd have to setup

quotas on /var/mail

Doing it this way penalizes only the users who engage in the 
objectionable behavior, and it penalizes them in such a way that it 
doesn't cause them to lose mail, or cause the server to reject incoming 
mail messages to them, or causes mail they have to be truncated.  And

it also doesn't do it in a way that is sudden - the user just starts
noticing things getting slower and slower and slower over time - so
they have plenty of time to contact us at their leisure.

I suppose that one of these days the author of qpopper will rewrite
the search logic in the qpopper program to fix this and then I'll have
to find some other way to gently enforce this.

Ted


jay

Ted Mittelstaedt wrote:

Sean Leinart wrote:

-Original Message-
From: Sean Leinart [mailto:slein...@fscarolina.com] Sent: Friday, 
October 23, 2009 2:04 PM

To: TJ Russ
Cc: allison.ays...@lonesource.com; Spamassassin Mailing List
Subject: Email / Inbox Speed Problems

Hi TJ,

Looking over your Inbox situation, you suffer from the same problem 
as most here do. You have too much email stored on the server. Can 
you give me a rundown of the folders that can be eliminated in your 
Inbox, we can archive them off then delete them from your folders 
that are online, this will help a great deal.


Thank you,

Sean Leinart
Network Systems Engineer
First Service Carolina Inc.
Raleigh, North Carolina
United States
slein...@fscarolina.com
919-832-5553



DOH!!
 
List, please disregard the erroneous CC: post to the list.




I had to look twice since it was the identical problem to what
we deal with every week around here.

Ted




Re: Email / Inbox Speed Problems

2009-10-23 Thread Jay Plesset
Many of my users use the various quota settings in Messaging Server.  
You can set quotas on message number and/or mailbox size.  Notifications 
are sent to the user, even if they're over quota. . .


You can set quota individually, by class of service, or globally.

Yes, it'll run on the same hardware you're running now.  On Redhat 4 or 
5, or Solaris.


jay

Ted Mittelstaedt wrote:

Jay Plesset wrote:
Geez, unless your users are into the millions of messages, maybe you 
need a more scalable mail server.   My day job is support of the Sun 
comms suite.  I only get these when there are litterally tens of 
millions of messages in an inbox.




Where we generally get these problems is when users are running MacOS X
and using the included free Apple Mail as a POP3 client, because one
of the DEFAULTS of that client is to leave a copy of the mail message
on the server.  The typical scenario is that we get one of these users
who runs it this way for a couple months, then one day their relative
starts e-mailing them 50MB pictures of their latest vacation, and once
their e-mail box exceeds 800MB in size, popper (qpopper) starts getting
really slow in downloading the message ID list and their client starts
running like a dog.

There's probably many ways I could fix it, from replacing qpopper to
going to faster disks or more powerful hardware, or running a nightly
script that squawks about the bad citizens, but I frankly don't
feel compelled to allocate all of our POP3 users a gigabyte of disk 
space for their mailbox, and if did fix it then I'd have to setup

quotas on /var/mail

Doing it this way penalizes only the users who engage in the 
objectionable behavior, and it penalizes them in such a way that it 
doesn't cause them to lose mail, or cause the server to reject 
incoming mail messages to them, or causes mail they have to be 
truncated.  And

it also doesn't do it in a way that is sudden - the user just starts
noticing things getting slower and slower and slower over time - so
they have plenty of time to contact us at their leisure.

I suppose that one of these days the author of qpopper will rewrite
the search logic in the qpopper program to fix this and then I'll have
to find some other way to gently enforce this.

Ted


jay

Ted Mittelstaedt wrote:

Sean Leinart wrote:

-Original Message-
From: Sean Leinart [mailto:slein...@fscarolina.com] Sent: Friday, 
October 23, 2009 2:04 PM

To: TJ Russ
Cc: allison.ays...@lonesource.com; Spamassassin Mailing List
Subject: Email / Inbox Speed Problems

Hi TJ,

Looking over your Inbox situation, you suffer from the same 
problem as most here do. You have too much email stored on the 
server. Can you give me a rundown of the folders that can be 
eliminated in your Inbox, we can archive them off then delete them 
from your folders that are online, this will help a great deal.


Thank you,

Sean Leinart
Network Systems Engineer
First Service Carolina Inc.
Raleigh, North Carolina
United States
slein...@fscarolina.com
919-832-5553



DOH!!
 
List, please disregard the erroneous CC: post to the list.




I had to look twice since it was the identical problem to what
we deal with every week around here.

Ted




Re: Spamassassin not tagging some emails

2009-10-23 Thread Angus Dunn



Jari Fredriksson wrote:
 
 
 
 23.10.2009 20:04, MySQL Student kirjoitti:
 Hi,
 
 SpamAssassin DOES NOT bypass scanning, if the internal or trusted
 networks contain the server in it.
 
 Hmm.. thanks for correcting me.
 
 How would you, then, go about preventing SA from scanning the
 localhost or a specific domain without whitelisting that domain or
 range?
 
 Thanks,
 Alex
 
 
 Personally, I do call SpamAssassin from maildrop (/etc/maildroprc).
 
 That takes place as
 
 --
 
 if ( $SCAN_SPAM == 1 )
 {
  xfilter spamc -H --retry-sleep=10 --connect-retries=100 -d spamd
 -u spam
 }
 
 --
 
 Than can be done from procmailrc etc. with their own ways.
 
 The SCAN_SPAM variable is a key in this. I can set it to 0 (default
 value for script 1) using various tests.
 
 I have various tests for that variable, that this is what whitelists the
 message from being passed to SpamAssassin.
 
 --
 
 if (( $SCAN_SPAM == 1)   /^From:\s*(.*)/  lookup( $MATCH1,
 /usr/etc/maildrop_sender_whitelist, D ))
 {
 xfilter reformail -A'X-Whitelisted: $MATCH1 in
 /usr/etc/maildrop_sender_whitelist'
 SCAN_SPAM=0
 }
 
 --
 
 In this case, I have a text file /usr/etc/maildrop_sender_whitelist
 which contains email addresses line by line, and if maildrop finds a
 match from there, it sets the SCAN_SPAM to 0, thus bypassing the SA call.
 
 This test if earlier in the maildroprc script, the spamc call is of
 course in the end.
 
 This kind of whitelisting is of course dangerous, but it it works for
 me. The whitelisted addresses are mostly of type
 r...@somehost.example.com which are not abused by spammers (knock knock).
 
 You can do all kinds of tests with maildrop. I have also this.
 
 ---
 # Check for bounces. If matches, no SpamAssassin call needed, because I
 do not consider bounce as spam.
 if (/^Subject: Mail Delivery Problem/   || \
 /^Subject: Mail Delivery \(failure/ || \
 /^Subject: Undelivered Mail Returned to Sender/ || \
 /^Subject: virus found in sent message/ || \
 /^Subject: failure notice / || \
 /^Subject: Mail delivery failed/|| \
 /^Subject: Undeliverable\:/ || \
 /^Subject: Undeliverable [Mm]ail/   || \
 /^Subject: Undeliverable Mail/  || \
 /^Subject: Undeliverable mail/  || \
 /^Subject: Returned mail\: /|| \
 /^Subject: DELIVERY FAILURE: User / || \
 /^Subject: Yahoo! Auto Response/|| \
 /^X-ME-bounce-domain:/  || \
 /^X-Failed-Recipients:/ || \
 /^X-Yahoo-Newman-Property: groups-bounce/   || \
 /^Diagnostic-Code: X-Postfix; host /|| \
 /^Content-type: multipart\/report;/ || \
 /^Subject: Delivery failed\:/   || \
 /^Subject: DELIVERY FAILURE\:/  || \
 /^Subject: MESSAGE NOT DELIVERED\: /|| \
 /^Subject: Delivery problem/|| \
 /^Subject: Email Failure Notification/  || \
 /^Subject: Email not allowed/   || \
 /^Subject: failure delivery/|| \
 /^Subject: failure notice/  || \
 /^Subject: Mail Not Delivered/  || \
 /^Subject: mail failed, returning to sender/|| \
 /^Subject: Nondeliverable mail/ || \
 /^Subject: Warning: could not send message for/ || \
 /^Subject: MDaemon Warning - Virus Found/   || \
 /^Subject: Permanent Delivery Failure/  || \
 /^Subject: Mail System Error - Returned Mail/   || \
 /^Subject: Mail System Error - Undeliverable Mail/   || \
 /^Subject: Transient Delivery Failure/  || \
 /^Subject: Message status - undeliverable/  || \
 /^Subject: Warning\: message /  || \
 /^Subject: Mail could not be delivered/ || \
 /^Subject: Your email to .* has NOT been delivered/ || \
 /^Subject: Returned mail: see our site/ || \
 /^Subject: Delivery failure/ )
 {
 `logger -p mail.info ** BOUNCE RECEIVED **`
 if (hasaddr(ve...@iki.fi))
 {
 exit
 }
 xfilter reformail -A'X-Whitelisted: Apparently a bounce,
 SpamAssassin will not be called.'
 xfilter reformail -A'X-Bounce: Yes '
 SCAN_SPAM=0
 }
 
 

Re: Spamassassin not tagging some emails

2009-10-23 Thread John Hardin

On Fri, 23 Oct 2009, Angus Dunn wrote:


:0fw
*  25600
| /usr/bin/spamc


*chuckle*  Yeah, that'd do it all right.

It looks like spamassassion will not be invoked if email is larger than 
25600 bytes.


Correct.


:0fw
*  102400
| /usr/bin/spamc


100KB is still rather small for an email with scannable attachments.


That seems to fix the problem.
I also have a question:
Do i really need to check for the size of email? Should I just remove the
size check?


spamc also has a size limit; that you aren't specifying it means it's 
using its internal default. See the spamc documentation for what that is 
and how to set it.


You should probably have your procmail rule set to the same size limit as 
spamc is using, and make both explicit. That will minimize overhead for 
messages larger than the limit and make it clear what is going on.


The size limit is generally set to 400-500KB. If you have an underpowered 
MTA/SA box you might want to set it smaller to reduce scanning load. Also 
take into consideration whether what you set it to lets an unacceptable 
amount of large spams to get through.


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  ...in the 2nd amendment the right to arms clause means you have
  the right to choose how many arms you want, and the militia clause
  means that Congress can punish you if the answer is none.
-- David Hardy, 2nd Amendment scholar
---
 14 days since President Obama won the Nobel Not George W. Bush prize


Blacklists Compared 17 October 2009

2009-10-23 Thread Marc Perkel

http://www.sdsc.edu/~jeff/spam/cbc.html

The races!

Big upset for Baracudda as Spamhaus takes back the #1 position and Spam 
Eating Monkey comes in second. (I don't count apews) Hostkarma pulls 
ahead of Uceprotect who have been running neck and neck for 5th and 6th 
place.




Re: Spamassassin not tagging some emails

2009-10-23 Thread d . hill

Quoting Angus Dunn angus.d...@3idea.com:


2. I am using procmailrc to invoke spamassassin.
Here is the /etc/procmailrc:
DROPPRIVS=yes
:0fw
*  25600
| /usr/bin/spamc

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
/dev/null
~

As someone suggested, this may be due to size of the email. It looks like
spamassassion will not be invoked if email is larger than 25600 bytes.

I changed the above to the following:

DROPPRIVS=yes
:0fw
*  102400
| /usr/bin/spamc

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
/dev/null


That seems to fix the problem.
I also have a question:
Do i really need to check for the size of email? Should I just remove the
size check?


spamc documentation shows the default scan size is 500Kb. If you have  
the system resources, you could eliminate the size restriction. I'm  
calling spamc directly from the MTA and have the size set to 256Kb.




Re: Email / Inbox Speed Problems

2009-10-23 Thread Ted Mittelstaedt


What is the point of a quota system that does not limit the
received mail?  And if it does limit it then we get irate calls from
people complaining that sally sue sent them a message and got it
returned.  Of course, sally sue never reads the error message
and tells our user that their e-mail box is too large - or if
she did, then irate user thinks it's our problem.

Not to mention the user thinks their inbox is -on their mac-
not on our mailserver, since of course they are entirely
unaware that their applemail has the setting flipped that
leaves a copy of the message on the mailserver.

Sending them notifications is worthless since they don't know what
they are, they don't know how to shut them off, and 3/4 of
the time they think they are spam anyway.

The whole point of this is customer management.  Your average mac
user is as dumb as a stump.  As long as things work they assume
everything is hunky-dory.  If things stop working they NEVER
assume it's their Mac that's the problem because Steve Jobs
told them Mac's are infallible and they worship the ground he
walks on.  And of course, if they stop working they stop working
at the worst time for them, (late at night on Friday) because of
the laws of Mr. Murphy.  So by the time they get ahold of us
they are hopping mad, they assume it's our problem, and the Pope
himself could tell them that it's their own stupid fault and
they wouldn't believe him.

Naturally, if things start getting slow they ALSO
automatically assume it's our problem - but they generally
are not emotional to the point that they won't listen.  So
they call in, expecting to inform us about something we
are doing wrong - whereupon we have to tell them that their
Mac that they believe is infallible is really fallible because
Apple's programmers are idiots and select retarded defaults.
That's a terrible blow to their world view, and it's often about
the most that they can digest.

But the key here is that when they get off the call they are
fixed (because their Applemail is now correctly deleting the
mail that it downloads) and that they DON'T believe that it
was our problem, and they have actually learned something
about how e-mail works.

I can also see your next argument - if we inform them in advance
that their mail client isn't deleting the mail it downloads
that we might avoid this.  The problem is that first, we don't
know in advance if they are running a large mailbox because they
are dumb-as-post mac users, oblivious to the world, or if they
are running a large mailbox because they are running IMAP or
some such that doesn't have that problem with the mailserver.
If they do know what they are doing, and we call them, we look
like idiots, and it's annoying to them, or worse they get the
impression we want them to go away.  Second, if they are dumb-as-post 
users, they automatically assume that if we tell them to change a 
setting in their Applemail, that it's because our mailserver is screwed 
up - because, after all Macs are infallible, and everything that Apple 
does must be the One True Way to setup a computer.


It's really better in the long run to make them come to us, not
for us to go to them.  If they come to us at least they are
acknowledging that there's a problem.  Remember, problems with
computers are very frightening to people who are ignorant about
computers.  Think about it, you don't know squat about your car's
transmission - so if a mechanic tells you your transmission has
a problem, your going to be scared to death it's going to cost you
thousands.  Your average Mac user will go into denial when they
have a problem with their Mac - they will refuse to believe for
the longest time that there's a problem even when it's obvious
there's a problem to a blind monkey.  They have to believe there's
a problem before they are even willing to be educated in how
to fix the problem.

As I said, this is customer management.  Just keep in mind that
when your dealing with the general public, the more ignorant the
person you work with, the more likely they are to assume they are
right, and you are wrong.  For us to win at the game we must
educate the users, and the most ignorant of the users will only
open their minds for knowledge for a very short time, before it
snaps closed like a steel trap, and they will never believe
there's a problem unless they see it for themselves.

After all, just think of your average conservative Republican's
reaction to Global Warming.  It's not something they can see and
their brains are (apparently) incapable of imagination so they cannot
imagine that Global Warming is real, that's why they make silly
arguments like global warming must not be happening because
we are having a pretty cold winter  It's the same principle in 
operation here.


Ted


Jay Plesset wrote:
Many of my users use the various quota settings in Messaging Server.  
You can set quotas on message number and/or mailbox size.  Notifications 
are sent to the user, even if they're over 

Re: Spamassassin not tagging some emails

2009-10-23 Thread Karsten Bräckelmann
On Fri, 2009-10-23 at 15:12 -0700, Angus Dunn wrote:
 Thank you for the useful tips. I have tried the following:
 1. trusted_networks/internal_networks - I checked the conf file for
 spamassassin /etc/mail/spamassassin/local.cf, there is no reference to
 trusted_networks or internal_networks. I also clear those two setting just
 in case with the following settings:

As has been clarified, this is not your issue. No way it will skip
scanning.

 clear_trusted_networks
 clear_internal_networks
 
 trusted_networks
 internal_networks

Please check the Conf docs. If you don't have any need to specifically
set them, just leave out all those options and let the magic work.

 But this does not help. The spam emails still did not get tag.
 
 2. I am using procmailrc to invoke spamassassin.
 Here is the /etc/procmailrc:
 DROPPRIVS=yes
 :0fw
 *  25600
 | /usr/bin/spamc

That's 25 kByte! Yes, that is your problem. Any mail larger than that
will NOT be processed by SA.

The default has been 500 kByte for a long time, and was 250 kByte
before. That line looks like an obvious *typo* to me. An ancient one.


 As someone suggested, this may be due to size of the email. It looks like
 spamassassion will not be invoked if email is larger than 25600 bytes.
 
 I changed the above to the following:
 
 DROPPRIVS=yes
 :0fw
 *  102400
 | /usr/bin/spamc

100 kByte, still really low.

 That seems to fix the problem.
 I also have a question:
 Do i really need to check for the size of email? Should I just remove the
 size check?

man spamc. Without that procmail condition, spamc simply will return any
messages exceeding the (default) size limit unprocessed. Using an
explicit limit here will spare the unnecessary filter, since spamc won't
even be called.

I recommend setting it to the limit you want enforced -- and hence
setting it to 500 kByte if you don't want to change the spamc default.


-- 
char *t=\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}



Re: Email / Inbox Speed Problems

2009-10-23 Thread John Hardin

On Fri, 23 Oct 2009, Ted Mittelstaedt wrote:

Great post, up until this:

After all, just think of your average conservative Republican's reaction 
to Global Warming.  It's not something they can see and their brains are 
(apparently) incapable of imagination so they cannot imagine that Global 
Warming is real, that's why they make silly arguments like global 
warming must not be happening because we are having a pretty cold 
winter  It's the same principle in operation here.


Don't go there, Ted. This isn't the appropriate forum for that.

--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  An entitlement beneficiary is a person or special interest group
  who didn't earn your money, but demands the right to take your
  money because they *want* it.-- John McKay, _The Welfare State:
   No Mercy for the Middle Class_
---
 14 days since President Obama won the Nobel Not George W. Bush prize


Re: Email / Inbox Speed Problems

2009-10-23 Thread Jay Plesset



Ted Mittelstaedt wrote:


What is the point of a quota system that does not limit the
received mail?  And if it does limit it then we get irate calls from
people complaining that sally sue sent them a message and got it
returned.  Of course, sally sue never reads the error message
and tells our user that their e-mail box is too large - or if
she did, then irate user thinks it's our problem.

Um, well, that's not exactly how it works.

System messages and guranteed delivery messages always get through.
Messages that will take a user over quota are held for a configurable 
grace period, and the user is warned that they are over quota at a 
configurable repeat rate.  Messages are returned to the sender after a 
configurable hold period.  there are plenty of knobs for you to turn. . .


Not to mention the user thinks their inbox is -on their mac-
not on our mailserver, since of course they are entirely
unaware that their applemail has the setting flipped that
leaves a copy of the message on the mailserver.

Sending them notifications is worthless since they don't know what
they are, they don't know how to shut them off, and 3/4 of
the time they think they are spam anyway.

The whole point of this is customer management.  Your average mac
user is as dumb as a stump.  As long as things work they assume
everything is hunky-dory.  If things stop working they NEVER
assume it's their Mac that's the problem because Steve Jobs
told them Mac's are infallible and they worship the ground he
walks on.  And of course, if they stop working they stop working
at the worst time for them, (late at night on Friday) because of
the laws of Mr. Murphy.  So by the time they get ahold of us
they are hopping mad, they assume it's our problem, and the Pope
himself could tell them that it's their own stupid fault and
they wouldn't believe him.
Well, it's true that most users don't know much, but it's my experience 
that many admins don't know much more. . .


Naturally, if things start getting slow they ALSO
automatically assume it's our problem - but they generally
are not emotional to the point that they won't listen.  So
they call in, expecting to inform us about something we
are doing wrong - whereupon we have to tell them that their
Mac that they believe is infallible is really fallible because
Apple's programmers are idiots and select retarded defaults.
That's a terrible blow to their world view, and it's often about
the most that they can digest.
It's very similar to what I tell admins when they get winmail.dat 
attachments they can't read.  Yep, Exchange isn't very compliant.


But the key here is that when they get off the call they are
fixed (because their Applemail is now correctly deleting the
mail that it downloads) and that they DON'T believe that it
was our problem, and they have actually learned something
about how e-mail works.

I can also see your next argument - if we inform them in advance
that their mail client isn't deleting the mail it downloads
that we might avoid this.  The problem is that first, we don't
know in advance if they are running a large mailbox because they
are dumb-as-post mac users, oblivious to the world, or if they
are running a large mailbox because they are running IMAP or
some such that doesn't have that problem with the mailserver.
If they do know what they are doing, and we call them, we look
like idiots, and it's annoying to them, or worse they get the
impression we want them to go away.  Second, if they are dumb-as-post 
users, they automatically assume that if we tell them to change a 
setting in their Applemail, that it's because our mailserver is 
screwed up - because, after all Macs are infallible, and everything 
that Apple does must be the One True Way to setup a computer.


It's really better in the long run to make them come to us, not
for us to go to them.  If they come to us at least they are
acknowledging that there's a problem.  Remember, problems with
computers are very frightening to people who are ignorant about
computers.  Think about it, you don't know squat about your car's
transmission - so if a mechanic tells you your transmission has
a problem, your going to be scared to death it's going to cost you
thousands.  Your average Mac user will go into denial when they
have a problem with their Mac - they will refuse to believe for
the longest time that there's a problem even when it's obvious
there's a problem to a blind monkey.  They have to believe there's
a problem before they are even willing to be educated in how
to fix the problem.

As I said, this is customer management.  Just keep in mind that
when your dealing with the general public, the more ignorant the
person you work with, the more likely they are to assume they are
right, and you are wrong.  For us to win at the game we must
educate the users, and the most ignorant of the users will only
open their minds for knowledge for a very short time, before it
snaps closed like a steel trap, and they will never 

Re: Spamassassin not tagging some emails

2009-10-23 Thread John Hardin

On Fri, 23 Oct 2009, d.h...@yournetplus.com wrote:


Quoting Karsten Bräckelmann guent...@rudersport.de:


 But this does not help. The spam emails still did not get tag.
 
 2. I am using procmailrc to invoke spamassassin.

 Here is the /etc/procmailrc:
 DROPPRIVS=yes
 : 0fw
 *  25600
 |  /usr/bin/spamc

That's 25 kByte! Yes, that is your problem. Any mail larger than that
will NOT be processed by SA.

The default has been 500 kByte for a long time, and was 250 kByte
before. That line looks like an obvious *typo* to me. An ancient one.


Add another zero and it would have been about 256Kb.


That's why we think it's a fossilized typo.


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  An entitlement beneficiary is a person or special interest group
  who didn't earn your money, but demands the right to take your
  money because they *want* it.-- John McKay, _The Welfare State:
   No Mercy for the Middle Class_
---
 14 days since President Obama won the Nobel Not George W. Bush prize

Re: Spamassassin not tagging some emails

2009-10-23 Thread Karsten Bräckelmann
On Fri, 2009-10-23 at 16:11 -0700, John Hardin wrote:
 On Fri, 23 Oct 2009, d.h...@yournetplus.com wrote:
  Quoting Karsten Bräckelmann guent...@rudersport.de:

: 0fw
*  25600
|  /usr/bin/spamc
   
   That's 25 kByte! Yes, that is your problem. Any mail larger than that
   will NOT be processed by SA.
   
   The default has been 500 kByte for a long time, and was 250 kByte
   before. That line looks like an obvious *typo* to me. An ancient one.
 
  Add another zero and it would have been about 256Kb.

Which would be exactly why I claimed this to look like a...

 That's why we think it's a fossilized typo.

Err, right, thanks. ;-)


-- 
char *t=\10pse\0r\0dtu...@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4;
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;il;i++){ i%8? c=1:
(c=*++x); c128  (s+=h); if (!(h=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}



Re: Spamassassin not tagging some emails

2009-10-23 Thread Angus Dunn

Thanks everyone for your help!

I have changed procmailrc to the following:
DROPPRIVS=yes
:0fw
*  512000
| /usr/bin/spamc

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
/dev/null

It is now working fine.

Someone mentioned that i can actually invoke spamassassin directly from
sendmail. What will be the advantage/disadvantage to do that? Also any docs
on how to do that?

Thanks,

Angus



d.hill wrote:
 
 Quoting Karsten Bräckelmann guent...@rudersport.de:
 
 But this does not help. The spam emails still did not get tag.

 2. I am using procmailrc to invoke spamassassin.
 Here is the /etc/procmailrc:
 DROPPRIVS=yes
 :0fw
 *  25600
 | /usr/bin/spamc

 That's 25 kByte! Yes, that is your problem. Any mail larger than that
 will NOT be processed by SA.

 The default has been 500 kByte for a long time, and was 250 kByte
 before. That line looks like an obvious *typo* to me. An ancient one.
 
 Add another zero and it would have been about 256Kb.
 
 
 

-- 
View this message in context: 
http://www.nabble.com/Spamassassin-not-tagging-some-emails-tp26019435p26034712.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: Spamassassin not tagging some emails

2009-10-23 Thread d . hill

Quoting Angus Dunn angus.d...@3idea.com:


Thanks everyone for your help!

I have changed procmailrc to the following:
DROPPRIVS=yes
:0fw
*  512000
| /usr/bin/spamc

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
/dev/null

It is now working fine.

Someone mentioned that i can actually invoke spamassassin directly from
sendmail. What will be the advantage/disadvantage to do that? Also any docs
on how to do that?


Seeing as you responded to my message, I don't recall seeing anyone  
mentioning a particular MTA. I could be wrong as I jumped into the  
conversation late. I invoke SA directly from Postfix, myself.




Re: Email / Inbox Speed Problems

2009-10-23 Thread Ted Mittelstaedt

Jay Plesset wrote:



Ted Mittelstaedt wrote:


What is the point of a quota system that does not limit the
received mail?  And if it does limit it then we get irate calls from
people complaining that sally sue sent them a message and got it
returned.  Of course, sally sue never reads the error message
and tells our user that their e-mail box is too large - or if
she did, then irate user thinks it's our problem.

Um, well, that's not exactly how it works.

System messages and guranteed delivery messages always get through.
Messages that will take a user over quota are held for a configurable 
grace period, and the user is warned that they are over quota at a 
configurable repeat rate.  Messages are returned to the sender after a 
configurable hold period.  there are plenty of knobs for you to turn. . .


I can understand that, and in a corporate environment where you
have more control over the userbase (and the users are much more
inclined to listen to you, after all it's not their money on the line)
I am sure it would work well.  Of course, if I was using a
-standards- based method of handling mail in such an environment
(ie: NOT MS Exchange) then I wouldn't be using POP3 in the first
place, I'd be using IMAP and I'd also setup a set of shared
e-mail folders accessible from the IMAP client.  I'd also probably
run some scripts that warned me when people were letting their
inbox get too large, so I could go train them in how to drag the
mail messages they want to save into private or shared folders
on the server.  But, that's my style - other admins might go out
and buy software to do this.  Ultimately it works the same way.

This discussion really illustrates the disconnect between people who
write e-mail systems for a living and what ISP's need.  While I've
not looked at the Sun comm suite your talking about, I'm sure it's
not that much different from many other commercial e-mail systems
I've been pitched over the years from people wanting to make my
life easier as an ISP admin (in exchange for some money, of course)

The problem though is when I've drilled into them, I've always found
issues like this.  Those systems are written first as competitors to
Exchange, and make a boatload of assumptions about the users, and
the admin's skill level.  Usually they assume the users are smarter
and the admins are dumber.  That's about right for the corporate
networks I've admined.  But ISPs don't survive unless the admin is
a lot smarter - because the users in general are a lot dumber.

Oh, there's exceptions - but most of the time it's customers who
work in office environments and come home and want the same level of
support they get at the office.  Those people are in a minority.
The majority of customers quite obviously don't understand very much,
and with a surprising number of them they don't even understand the
accepted nomenclature.

If I had a nickel for every time I've told a user OK now open your
web browser and gotten back what's a web browser I'd be a rich
man.  I've learned to refer to web browsers with phrases like
go to google or click on the Internet.  This is the level of
skill we deal with regularly.  After all, it's not the new-technology
embracers who are calling in for ISP support.  It's the people
who were left behind years ago, who are only on the Internet because
the rest of their family won't spend the time to communicate with
them unless they are on facebook or e-mail.  At least once a week
I and the other admins get someone who we just shake our head over
and wonder why in the world this person is even wasting their money
and time with a computer at all - they are like the old grandmother
who never drives on the highway and never drives faster than 45Mph
who owns a Lamborghini.  It's really a sad thing, to be honest.



Not to mention the user thinks their inbox is -on their mac-
not on our mailserver, since of course they are entirely
unaware that their applemail has the setting flipped that
leaves a copy of the message on the mailserver.

Sending them notifications is worthless since they don't know what
they are, they don't know how to shut them off, and 3/4 of
the time they think they are spam anyway.

The whole point of this is customer management.  Your average mac
user is as dumb as a stump.  As long as things work they assume
everything is hunky-dory.  If things stop working they NEVER
assume it's their Mac that's the problem because Steve Jobs
told them Mac's are infallible and they worship the ground he
walks on.  And of course, if they stop working they stop working
at the worst time for them, (late at night on Friday) because of
the laws of Mr. Murphy.  So by the time they get ahold of us
they are hopping mad, they assume it's our problem, and the Pope
himself could tell them that it's their own stupid fault and
they wouldn't believe him.
Well, it's true that most users don't know much, but it's my experience 
that many admins don't know much more. . .


That is true and 

Re: Email / Inbox Speed Problems

2009-10-23 Thread LuKreme

On 23-Oct-2009, at 16:41, Ted Mittelstaedt wrote:
Your average mac user is as dumb as a stump.  As long as things work  
they assume everything is hunky-dory.  If things stop working they  
NEVER assume it's their Mac that's the problem because Steve Jobs  
told them Mac's are infallible and they worship the ground he walks  
on.



It's amazing to me you have ANY Mac users as customers.

Tell you what, the guys down the hall from me run a Mac-oriented  
hosting service, MacHighway.com. Refer your Mac users there. They will  
not be treated as if they are 'dumb as a stamp'.


--
'It's time to-'
'Prod buttock, sir?' said Carrot, hurriedly.
'Close,' said Vimes, taking a deep drag and blowing out a smoke ring,  
'but no cigar.' --Feet of Clay




Re: Email / Inbox Speed Problems

2009-10-23 Thread Ted Mittelstaedt

LuKreme wrote:

On 23-Oct-2009, at 16:41, Ted Mittelstaedt wrote:
Your average mac user is as dumb as a stump.  As long as things work 
they assume everything is hunky-dory.  If things stop working they 
NEVER assume it's their Mac that's the problem because Steve Jobs told 
them Mac's are infallible and they worship the ground he walks on.



It's amazing to me you have ANY Mac users as customers.

Tell you what, the guys down the hall from me run a Mac-oriented hosting 
service, MacHighway.com. Refer your Mac users there. They will not be 
treated as if they are 'dumb as a stamp'.




stump, not stamp

No, I'll tell you exactly how they will be treated.  They will not be
treated as though they are ignorant and need education.  They will be
treated as though they are so smart that they don't need any education
whatsoever, and that if they ever have to fix anything with their
mystical Mac, that they have to pay someone to do it for them.

In short, they will be kept ignorant because that's the way the Mac 
retailers and Apple keep them hooked.


It's like the Mac user I talked to the other day who was positive
that the only way to get more hard disk space was to buy a hard
drive from Apple, that the regular hard drives on sale at the store
wouldn't work.  I corrected that when I told her that the Mac
sitting at my right hand here that I do support with had a crashed
hard disk in it when I got it and I pulled a hard disk out of a
PC that I was scrapping out to fix it.  She was amazed that you
could do that.

Sure, a lot more people ignorant of computers buy Macs.  Are you
going to argue that?  The entire sales strategy of Apple is to
cater to these people and KEEP THEM IGNORANT because that way they
can sell them computers and peripherals that cost 6 times more.
And design their products so that figuring out how to take them
apart takes hours so that their average customer can't do it.

I'll never forget the first time I opened an iMac  (Blueberry as
I recall) to replace a crapped-out dvd drive.  I had 2 iMacs, see,
one with a fried video board, the other with a drive that someone
had jammed and bent by sticking a screwdriver in it.  I figured
I'd remove the drive from the system with the crapped video board
before I tossed it out.  It took me 2 hours of staring at it,
probing gently, and imagining how they had hidden access to
everything before I finally found all the hidden screws and got
it apart.  And I only succeeded in the end because I wasn't the
first guy to take it apart, and the prior guy who took it apart
had obviously NOT figured out where all the screws were because
some of the screw mounts were fractured and the screws torn out.

Of course, once it was apart all their secrets were exposed and
it was easy to see what they had done, so the second one came
apart quite easily.

I haven't repaired a minimac yet, but I read that Apple designed
it with breakaway pieces that you HAVE to fracture to get it
apart - so that only Apple repair places who can order replacements
for the breakaways can reassemble them so they look nice.  Apple
learned that trick from the automakers who do that with body panel
fasteners - but you can buy the replacement one-use fasteners from
any auto part store.  Not so with Apple.

Where else can you pay $30 for a USB mouse that retails for $5 from
Fry's (or other retailer) than a Mac store?

Who else than Apple produces a cellular phone that costs $100 for
a new battery and you have to hand your phone over to a retailer to
install it?  Ever other cell phone on the market has a battery cover
and you open the cover, take out the battery, and put in a new battery
that costs $30 from the store, or $10 off Ebay?

Yet, you open up a new Mac and what's inside?  A PC motherboard and 
processor, that's what there is!!!  You can even boot OSX on a PC 
motherboard if you patch out the checks that Apple put in it to try to 
prevent the educated guys out there from doing it.


And don't even get me started about software.  Every piece of software
worth a piss that's running on my PPC Tiger box here I either downloaded
and compiled on it, or downloaded precompiled binaries, and none of it
cost me a cent.  There's a universe of Open Source out there that runs
on OSX with minimal effort.

Yet, Apple's response to the Open Source community is APSL 2.0 which
is incompatible with GPL.  And do you think that anyone in a Mac store
knows anything about free Open Source Software, much less APSL?  Or
would tell them to use, say, NeoOffice instead of selling them
MS Office for the Mac if they had a chance?  Hah!

Your amazed WE have Mac customers?!?  At least WE try to EDUCATE them
so they aren't stuck with Apple sticking it to their wallets.  I'm
amazed that ANY Mac-specific retailer, much less APPLE, has ANY Mac
customers.

Ted


Re: Email / Inbox Speed Problems

2009-10-23 Thread MySQL Student
Hi,

I really hate to respond to this because it's so off-topic (how long
did it take you to write that email, anyway?), but you're s
missing the point that I just can't let it go, and it's slow on a late
Friday night.

 Yet, you open up a new Mac and what's inside?  A PC motherboard and
 processor, that's what there is!!!  You can even boot OSX on a PC

That's not the point. Haven't you ever bought a bottled water, or
spoken with someone that has, because it tastes better? It's all in
the marketing. Apple caters to people that just don't care that it's a
PC inside.

 Yet, Apple's response to the Open Source community is APSL 2.0 which
 is incompatible with GPL.  And do you think that anyone in a Mac store

That's a different issue. There's no business model for corporations
like Adobe building open source apps for the PC, let alone the Mac
where the userbase is even smaller.

 Your amazed WE have Mac customers?!?  At least WE try to EDUCATE them
 so they aren't stuck with Apple sticking it to their wallets.  I'm
 amazed that ANY Mac-specific retailer, much less APPLE, has ANY Mac
 customers.

You had mentioned someone jammed a screwdriver into the computer and
broke it, and you really think they care about going to Fry's to buy a
replacement hard disk? They just don't care. They want it to just
work. Who cares that the mouse is $30? They buy them for the
convenience, the looks, the infamous support for multimedia, and the
ease-of-use. They buy them because it's a single point of contact.
They buy them because someone can make the choice for them, and they
can get on with doing things other than worry about the details of the
computer and just start using it.

Best,
Alex