Re: [SAtalk] Why is auto-learn set to no?

2003-09-22 Thread Robert Nicholson
It seems i didn't appreciate that autolearn in that line relates to how that particular message was autolearnt. So things are working as I expect them to. --- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgee

Re: [SAtalk] razor

2003-09-22 Thread Antoine Jacoutot
Selon Hannu Liljemark <[EMAIL PROTECTED]>: > Uh... so is spamd working at all? Do you see spamd write logs when mail > goes through the system? How about that 'spamassassin -t -D < testmail', > does it show lines about razor? OK, here is my complete log; it does show lines about razor, but th

[SAtalk] Spamd domain sockets implementation

2003-09-22 Thread Mike Loiterman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Just reading the release notes for 2.60 and noticed this: - spamd now supports UNIX-domain sockets for low-overhead scanning, thanks to Steve Friedl for this. This is strongly recommended if you're running spamc on the same host as the sp

Re: [SAtalk] Philosophical SA questions

2003-09-22 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Darren, Monday, September 22, 2003, 4:43:33 PM, you wrote: DM> 256 Ham, 1040 Probably Spam (>5 points), 256 Almost Certainly Spam DM> (>15 points), and 269 false negatives, 0 false positives. Bayes was DM> trained with 16680 Spam, 4092 Ham, 12

[SAtalk] Why is auto-learn set to no?

2003-09-22 Thread Robert Nicholson
RE: X-Spam-Status: Yes, hits=10.7 required=0.6 tests=DATE_IN_PAST_03_06, DATE_SPAMWARE_Y2K,FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,HTML_60_70, HTML_FONTCOLOR_BLUE,HTML_FONTCOLOR_GREEN,HTML_FONTCOLOR_RED, HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MISSING_MIMEOLE, NORMAL_HTTP_TO_IP autolea

Re: [SAtalk] razor

2003-09-22 Thread Hannu Liljemark
On Mon, Sep 22, 2003 at 09:52:40PM +0200, Antoine Jacoutot wrote: > No, I still don't have anything in the logs... > Here is my sendmail entry concerning spamassassin: > INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass-milter.sock, F=, > T=C:15m;S:4m;R:4m;E:10m') > > And here is the p

Re: [SAtalk] Tagging as spam

2003-09-22 Thread Skylar Thompson
On Mon, Sep 22, 2003 at 02:58:51PM -0400, Kris Deugau wrote: > Skylar Thompson wrote: > > I use the MIMEDefang and SpamAssassin plugins for sendmail on my > > FreeBSD 4.8 mail server. For some reason, SpamAssassin tags all > > messages as SpamAssassin tags all messages as spam, even when the > > sc

Re[4]: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Mike, Monday, September 22, 2003, 5:47:27 PM, you wrote: MK> For me spam is sex, drugs/pharmacies, nigerian bank proposals, etc Agreed. And if your test had mentioned P...rn, V...gra, pen...ses or brea...ts, nigerian banks and millions of dol

[SAtalk] Monitoring which Rules are being used...

2003-09-22 Thread Steve Brorens
SA is doing a superb job in my gateways config (with amavisd-new and clamav), but I'd like to get a better feel for the relative effects of the various rules - in particular BAYES_*, AWL, my 'custom local.cf rules', RCVD_IN_BL_SPAMCOP, AWL... - My logs now show the TotalHits and the RulesInvolve

Re[2]: [SAtalk] Newbie: Adding Rules To SpamAssassin

2003-09-22 Thread Robert Menschel
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello John, Monday, September 22, 2003, 12:48:55 PM, you wrote: >> Something like >> > body RM_b_V-drug/V[Ii1\|[EMAIL PROTECTED]/i >> but for the subject, right? JP> Yes, this is along the lines of what I wanted since, at least my JP> version o

Re: [SAtalk] Cannot change scores

2003-09-22 Thread Matt Kettler
At 11:15 PM 9/22/03 -0400, Jay R. Yablon wrote: Whenever I try to change the scores in the rules of configuration file, with, e.g., score DIET 7.0 score WEALTH 8.0 etc., Spam assassin stop schevking for that rile, i.e., it has the effect of setting it to zero. Using v 1.2.1 Help? Um, 1.2.1?

Re: [SAtalk] SpamAssassin 2.60 released!!

2003-09-22 Thread Chris Paul
I just upgraded from rc5 and did something wrong. It appears that the BAYES database is not being consulted by SpamAssassin. Some mail is not getting scored at all. Other mail gets a higher than normal score due to not getting BAYES scored. I see no BAYES tags in the headers at all. I can read t

[SAtalk] SpamAssassin 2.60 release

2003-09-22 Thread Michael Bell
Is there any difference in code between the final and the RC6 release? __ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com --- This sf.net email is spons

[SAtalk] Cannot change scores

2003-09-22 Thread Jay R. Yablon
Whenever I try to change the scores in the rules of configuration file, with, e.g.,    score DIET 7.0  score WEALTH 8.0   etc., Spam assassin stop schevking for that rile, i.e., it has the effect of setting it to zero.   Using v 1.2.1   Help?   Thanks. __Jay R. Yab

[SAtalk] suddenly SA broke on me and provides this msg

2003-09-22 Thread landy
[EMAIL PROTECTED]:~> spamassassin Can't locate IO/Socket/INET.pm in @INC (@INC contains: /usr/lib/perl5/site_perl/5.8.0/i586-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/5.8.0/i586-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl .) at /usr/lib/perl5/5.8.0/i586-l

RE: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread Larry Gilson
Hi Kenneth, > -Original Message- > From: Kenneth Porter > --On Sunday, September 21, 2003 10:31 PM -0400 Matt Kettler > <[EMAIL PROTECTED]> wrote: > > > However, you could write a custom rule or two to pick these off. > > > > A body rule something like this should do: > > > > body LOCA

[SAtalk] SpamAssassin 2.60 released!!

2003-09-22 Thread Theo Van Dinter
SpamAssassin 2.60 is released! SpamAssassin 2.60 is the first major update of SpamAssassin since February 2003 (when the 2.50 series was released). SpamAssassin is a mail filter which uses advanced statistical and heuristic tests to identify spam (also known as unsolicited commercial/bulk email).

RE: [SAtalk] Philosophical SA questions

2003-09-22 Thread Tom Meunier
Hi Darren, > 256 Ham, 1040 Probably Spam (>5 points), 256 Almost Certainly > Spam (>15 points), and 269 false negatives, 0 false > positives. Bayes was trained with 16680 Spam, 4092 Ham, > 125776 tokens. I have auto-learning enabled, and feed all > the false negatives back into sa-learn th

Re: [SAtalk] Philosophical SA questions

2003-09-22 Thread Matt Kettler
At 11:43 PM 9/22/03 +, Darren Madams wrote: Note in advance, I'm assuming sa 2.55 since this is a recent install. Philosophical question #1: Am I expecting too much to be disappointed with so many false negatives? I'm [obviously] nowhere near the numbers you guys are quoting. A lot of

Re: [SAtalk] Philosophical SA questions

2003-09-22 Thread Kai MacTane
At 9/22/03 04:43 PM , Darren Madams wrote: Philosophical question #3: One of the things I liked about SpamBouncer was feeding it your legitimate email addresses and mailing list addresses and then it would consider items sent TO those (missing or specifically there) in the overall scoring. I

RE: Re[2]: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Mike Klein
As I mentioned in my first email...I will customize SA to get desired filtering behaviour. I have always realized this is possible...it's just that I don't always want (or expect) to spend that much time installing/configuring certain applications. I believed this would be 'out of box' behaviour, b

Re: [SAtalk] upping BAYES_80 score

2003-09-22 Thread Matt Kettler
At 03:34 PM 9/22/03 -0700, Jonathan Nichols wrote: Ugh. How do I change the score again? I put: score BAYES_80 2.00 2.00 2.00 in local.cf - but it's not working. I'm trying to catch the stuff that's slipping through with only 4.4, etc. Thanks! try: score BAYES_80 0 0 2.00 2.00 Note there's _f

[SAtalk] Re: local.cf not being read

2003-09-22 Thread Malte S. Stretz
On Tuesday 23 September 2003 01:48 CET Stephen Lau wrote: > I'm running 2.55 as spamd (rather than standalone)...I just noticed > that my /etc/mail/spamassassin/local.cf doesn't seem to be having any > effect on my incoming mail. I've got SpamAssassin is probably looking for that file somewhere e

Re[2]: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Abigail Marshall
Hello Mike, Monday, September 22, 2003, 1:47:50 PM, you wrote: MK> In response to my complaint of weak rules out of box: Mike, the value of Spamassassin is its ability to weight based on a combination of factors, rather than simply delete email based on single words or phrases. Words that seem s

Re: [SAtalk] Better logging?

2003-09-22 Thread Matt Thoene
On Monday, September 22, 2003 @ 3:17:03 PM [-0700], landy wrote: > On Mon, 2003-09-22 at 07:56, Markus Gaugusch wrote: >> On Sep 22, Tom Meunier <[EMAIL PROTECTED]> wrote: >> >> > Spamstats does that. >> Thanks! That's EXACTLY what I wanted :) > for this to work do you need spamd? Yes. Spamstat

[SAtalk] local.cf not being read

2003-09-22 Thread Stephen Lau
I'm running 2.55 as spamd (rather than standalone)...I just noticed that my /etc/mail/spamassassin/local.cf doesn't seem to be having any effect on my incoming mail. I've got score MICROSOFT_EXECUTABLE 15.0 score RCVD_IN_OSIRUSOFT_COM 0.00 score X_OSIRU_OPEN_RELAY0.00 score X_OSIRU_D

[SAtalk] Philosophical SA questions

2003-09-22 Thread Darren Madams
OK, I need some help, and sorry in advance for the long email. I had tried SA about a year ago and wasn't overly impressed. I ended up going with SpamBouncer, which worked reasonably well but quickly got out of date and had no facilities for easy update (other than from the author, who it ap

Re: [SAtalk] Maintaining a list of IP numbers

2003-09-22 Thread Kai Schaetzl
Larry Gilson wrote on Mon, 22 Sep 2003 10:44:29 -0400: > The virus library > documentation and all the messages I have seen indicate that the From and To > are grabbed from multiple locations on the computer and the Subject is > dynamic from hard-coded lists. It says nothing about the MAIL FROM b

Re: [SAtalk] SA Gone Wild???

2003-09-22 Thread Kai Schaetzl
Dan Tappin wrote on Mon, 22 Sep 2003 14:46:00 -0600: This only means that you have the "always report" option on. That "preamble" is always the same, be it spam or ham. > Just in the past hour SA has started identifying e-mail as spam that should > not be. I have several domains / addresses whi

[SAtalk] upping BAYES_80 score

2003-09-22 Thread Jonathan Nichols
Ugh. How do I change the score again? I put: score BAYES_80 2.00 2.00 2.00 in local.cf - but it's not working. I'm trying to catch the stuff that's slipping through with only 4.4, etc. Thanks! --- This sf.net email is sponsored by:ThinkGe

RE: [SAtalk] Better logging?

2003-09-22 Thread landy
On Mon, 2003-09-22 at 07:56, Markus Gaugusch wrote: > On Sep 22, Tom Meunier <[EMAIL PROTECTED]> wrote: > > > Spamstats does that. > Thanks! That's EXACTLY what I wanted :) for this to work do you need spamd? i use procmail/postfix and when i ran it got this [EMAIL PROTECTED]:~/spamstats-0.4b5>

RE: [SAtalk] SA Gone Wild???

2003-09-22 Thread Dan Tappin
Sorry everyone, I am a dork. I had another filter at work and mistakenly had it reporting trapped spam to the same monitoring account. I though SA was trapping this spam. Dan > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan > Tappin > Sent: Monda

Re: [SAtalk] Error message from DCC since upgraded to RC5

2003-09-22 Thread Daniel Quinlan
Luis Hernán Otegui <[EMAIL PROTECTED]> writes: > About $PATH: >> From the spamd start script: > PATH=$PATH:/usr/bin:/usr/local/bin What's the _full_ PATH variable? Telling me that /usr/bin and /usr/local/bin were appended to PATH does not answer the question. > And you're right, Daniel, in the

RE: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Tom Meunier
> -Original Message- > From: Mike Klein [mailto:[EMAIL PROTECTED] > Sent: Monday, September 22, 2003 3:48 PM > To: [EMAIL PROTECTED] > Subject: RE: [SAtalk] SpamAssassin filters seem too weak out of the > box... [] > > As far as I could tell, my spam email was pfs (that's pretty f%$%$king

Re: [SAtalk] SA Gone Wild???

2003-09-22 Thread Klaus Mueller
> -1.0/5.0 -1.0 ist less then the required 5 points. This is not identified as spam. Mail is spam if it reaches the 5.0 points or is above. Can you send the complete mail header (x-out the adresses). This part is not enough to help you. Klaus --

[SAtalk] SA Gone Wild???

2003-09-22 Thread Dan Tappin
Just in the past hour SA has started identifying e-mail as spam that should not be. I have several domains / addresses white listed in my local.cf file and even these are getting tagged as spam. Here is the output of a message filtered at the server as spam but yet the spamc report is contradicto

Re: [SAtalk] Best virus scanner?

2003-09-22 Thread Bob Sully
I use ClamAV and recommend it without reservation, if you're running your own mail server. On Mon, 22 Sep 2003, Philip Mak wrote: > I'm receiving a flood of Microsoft viruses recently. I went to sleep > for 7 hours, and I came up with 145 new messages, almost all of them > Microsoft viruses. >

RE: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Mike Klein
In response to my complaint of weak rules out of box: I have rtfm (INSTALL, USAGE, website). It states (step #7 in INSTALL file): = 7. Now, you should be ready to send some test emails and ensure everything works as expected. First, send yourself a test email that doesn't contain

Re: [SAtalk] Re: New virus posing as Microsoft

2003-09-22 Thread Forrest Aldrich
I'm also curious about how this virus/worm operates. I'm presuming it's infiltrating Outlook address books, but I could be wrong - since my server is being hit with 100's of these messages, and that indicates possibly some other source of data (for addresses). I'm successfully blocking these w

RE: [SAtalk] Re: Virus checkers v.s. spam filters

2003-09-22 Thread Bill Polhemus
If you are using Procmail (a good idea to use in tandem with SA anyway), then see: http://www.spamless.us/pub/procmail/virussnag For a venerable, tried and true recipe for "snagging" viral emails. Even though the recipe(s) has/have been around awhile, they still seem to work even on the latest ge

Re: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread Kenneth Porter
--On Sunday, September 21, 2003 10:31 PM -0400 Matt Kettler <[EMAIL PROTECTED]> wrote: > However, you could write a custom rule or two to pick these off. > > A body rule something like this should do: > > body LOCAL_SVEN_WORM /\bThis is the latest version of security update\b/ > score LOCAL_SVEN

Re: [SAtalk] How to add New Rules

2003-09-22 Thread Theo Van Dinter
On Mon, Sep 22, 2003 at 03:29:07PM -0400, Bert Rapp wrote: > bit slipping by lately. Is it possible to add the current rules from > 2.55 to the 2.43 rules. Or would it be better to just upgrade to 2.55? you could probably move some of them over, but most rules require code updates, so I'd just

Re: [SAtalk] razor

2003-09-22 Thread Antoine Jacoutot
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Monday 22 September 2003 11:16, Hannu Liljemark wrote: > Does razor work now and does running spamassassin with the -D flag show > razor in action? No, I still don't have anything in the logs... Here is my sendmail entry concerning spamassassin: IN

RE: [SAtalk] Using Procmail with SpamAssassin for redirecting spa m email...

2003-09-22 Thread Chris Santerre
Ok, I really should finish the write up on my setup one day :) I was having the same difficulty as you mentioned. Every one of my users is an alias to a procmail file. alias file has entry like so: loser1: "| /usr/bin/procmail /etc/procmailrcs/loser1.rc " loser1.rc looks like so (over simplifi

[SAtalk] spamd problem

2003-09-22 Thread Steve Heggood
Hi, I just switched my setup from spamassassin to spamd/spamc, started spamd with OPTIONS="-d -c -a -D" in my /etc/sysconfig/spamd file. Redhat 8 spamd 2.55 I seem to have a permissions problem pointed out in /var/log/maillog: - from log: Sep 22 13:50:29 gizmo spamd[8211]: server start

[SAtalk] How to add New Rules

2003-09-22 Thread Bert Rapp
I've been running spamassasssin 2.43 for quite some time. I've been adding new rules to my own setup here and there to block the major offenders that have been slipping through, but there has been quite a bit slipping by lately. Is it possible to add the current rules from 2.55 to the 2.43 ru

Re: [SAtalk] Re: Spam slipped through, why no Bayes?

2003-09-22 Thread Kris Deugau
Chris Barnes wrote: > header LOCAL_PERLMX_TAG_100 /X-PerlMX=~ /\b Probability=100\%/ ^ Just at a guess, what you want is something like: header LOCAL_PERLMX_TAG_100 X-PerlMX=~ /\b Probability=100\%/ The header name isn't part of the regex. -kgd -- hm. I've l

Re: [SAtalk] HTML has images with 600-800 bytes of words

2003-09-22 Thread Theo Van Dinter
On Mon, Sep 22, 2003 at 11:32:41AM -0700, Tory M Blue wrote: > I had a rich text document come thru and was flagged with > "HTML has images with 600-800 bytes of words" > The document had no images. > > What is being picked up? without seeing the message, no one can answer this question for you.

[SAtalk] HTML has images with 600-800 bytes of words

2003-09-22 Thread Tory M Blue
First post, tried to find the answer I had a rich text document come thru and was flagged with "HTML has images with 600-800 bytes of words" The document had no images. What is being picked up? Thanks Tory <|[EMAIL PROTECTED]> --- This

RE: [SAtalk] microsoft worm - working solution

2003-09-22 Thread Dave Stern - Former Rocket Scientist
Not sure if this helps but by lowering threshold (required_hits) to 4 rather than 5, increasing FRIEND_AT_PUBLIC score FRIEND_AT_PUBLIC 3.0 and adding filter for various attachments I don't commonly get via procmailrc: :0 B: * ^Content-Type:.*(application|audio|multipart) * name=.*\.(pif|mp3|sr

Re: [SAtalk] Tagging as spam

2003-09-22 Thread Kris Deugau
Skylar Thompson wrote: > I use the MIMEDefang and SpamAssassin plugins for sendmail on my > FreeBSD 4.8 mail server. For some reason, SpamAssassin tags all > messages as SpamAssassin tags all messages as spam, even when the > score is low or sub-zero. I have required_hits set to 5 in > sa-mimedefan

Re: [SAtalk] Re: New virus posing as Microsoft

2003-09-22 Thread Jack Gostl
Can I just tack this on at the end of my user_prefs file? On Sat, 20 Sep 2003, Mark A. Hershberger wrote: > Forrest Aldrich <[EMAIL PROTECTED]> writes: > > > Has anyone filters for Spamassassin that will correctly identify this > > virus? I'd like to score this one high so they are rejected (v

RE: [SAtalk] Using Procmail with SpamAssassin for redirecting spa m email...

2003-09-22 Thread Chris Santerre
> -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > Sent: Saturday, September 20, 2003 2:34 PM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Using Procmail with SpamAssassin for > redirecting spam > email... > > > Hello everyone. > > Well, after getting some gre

[SAtalk] Re: Virus checkers v.s. spam filters

2003-09-22 Thread Malte S. Stretz
On Monday 22 September 2003 18:30 CET Philip Mak wrote: > > 1.15. Does SpamAssassin filter email-borne viruses as well as spam? > > > > No. SpamAssassin is focussed on identifying spam, and not viruses. > > The mechanism of scanning for viruses is different, and software > > tailored for virus scan

Re: [SAtalk] sa-learn

2003-09-22 Thread Tomáš Macek
Fine, so when I will have one directory, in that will all the users move the messages that they want to teach sa-learn as spam, how can the sa-learn recognize the message? Understand - how can the engine know, that "this" message is from user [EMAIL PROTECTED] and another is from [EMAIL PROTECTE

RE: [SAtalk] Help in Understanding how to make a local.cf file...

2003-09-22 Thread Chris Santerre
See the link in my sig, and www.exit0.us Chris Santerre System Admin and SA Custom Rules Emporium keeper http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm "A little nonsense now and then, is relished by the wisest men." - Willy Wonka > -Original Message- > From: L. D. Jame

RE: [SAtalk] OBFUSCATING comment not matching.

2003-09-22 Thread Chris Santerre
Was it base 64 encoded? (double encoded?) > -Original Message- > From: Seelig, CD (Chris) [mailto:[EMAIL PROTECTED] > Sent: Monday, September 22, 2003 1:03 PM > To: 'Fred I-IS.COM'; Seelig, CD (Chris) ; > [EMAIL PROTECTED] > Subject: RE: [SAtalk] OBFUSCATING comment not matching. > > >

RE: [SAtalk] How to deal with the learning curve for spamassassin

2003-09-22 Thread Chris Santerre
I have to completely agree with Robert here. I don't really have time to teach the users about SA. While I'm sure this isn't for an ISP, but more along the lines of a local sysadmin. It is better for them to tell me about problems, and let me take care of it, less trouble. Chris Santerre System

RE: [SAtalk] microsoft worm - working solution

2003-09-22 Thread Chris Santerre
Um...I would STRONGLY recommened someone think twice before using these rules. I see them hitting on LOTS of legit emails. Also only the last rule is a meta, so they will also score 1.00 on each hit, in addition to the meta rule. It is a great start, but I think they need more tweaking. just my 2

Re: [SAtalk] Error message from DCC since upgraded to RC5

2003-09-22 Thread Daniel Quinlan
=?iso-8859-1?B?THVpcyBIZXJu4W4gT3RlZ3Vp?= <[EMAIL PROTECTED]> writes: > Well, I guess nobody noticed my other post, so here we go again: > Since upgrading to SA-2.60-RC5, I'm getting this warnings in the maillog > whenever spamd analizes a message: > Sep 22 10:39:00 nahuel spamd[16955]: DCC -> ch

Re: [SAtalk] Error message from DCC since upgraded to RC5

2003-09-22 Thread Luis Hernán Otegui
Luis Hernán Otegui Administrador de Red Facultad de Ciencias Exactas UNLP GNU-GPL: "May The Source Be With You..."

Re: [SAtalk] Spam not

2003-09-22 Thread mikea
On Mon, Sep 22, 2003 at 12:07:06PM -0400, Alicia Forsythe wrote: > The following spam is making it through. When I test this same mail, it > scores over 20 points. Why is it still getting through? > > > Return-path: <[EMAIL PROTECTED]> > Received: from 209.118.212.3 > ([200.167.37.247])

RE: [SAtalk] OBFUSCATING comment not matching.

2003-09-22 Thread Seelig, CD (Chris)
Hmm, something appears to have kindly converted the thing to clear text. Cut and past from a 'view source' .. Start Paste- Wholesale Prescription Medications Our doctors will write you a prescription for free! Buy Your Prescription Meds Online See For Yourself.

[SAtalk] Virus checkers v.s. spam filters

2003-09-22 Thread Philip Mak
> 1.15. Does SpamAssassin filter email-borne viruses as well as spam? > > No. SpamAssassin is focussed on identifying spam, and not viruses. > The mechanism of scanning for viruses is different, and software > tailored for virus scanning is much much better at this task. Well, I wouldn't expect Sp

Re: [SAtalk] OBFUSCATING comment not matching.

2003-09-22 Thread Fred I-IS.COM
I don't see any comments in this message, normally they start with and they must break a word for the rule to hit. Frederic Tarasevicius Internet Information Services, Inc. Seelig, CD (Chris) wrote: > The OBFUSCATING_COMMENT rule on our servers seem to miss a lot of > mails that would appear (

[SAtalk] Spam not

2003-09-22 Thread Alicia Forsythe
The following spam is making it through. When I test this same mail, it scores over 20 points. Why is it still getting through? Return-path: <[EMAIL PROTECTED]> Received: from 209.118.212.3 ([200.167.37.247]) by ns1.mshs.com; Fri, 19 Sep 2003 13:13:40 -0400 Received: from [161

[SAtalk] Help in Understanding how to make a local.cf file...

2003-09-22 Thread L. D. James
Can someone give me some help in understanding how to make a local configuration file. I would use this information to curtail some of the recent bombardment of the Microsoft virus that's currently happening. I'm sure if someone will give me a sample that would perform some of the fo

[SAtalk] Best virus scanner?

2003-09-22 Thread Philip Mak
I'm receiving a flood of Microsoft viruses recently. I went to sleep for 7 hours, and I came up with 145 new messages, almost all of them Microsoft viruses. SpamAssassin isn't catching these. I fed about 20 of them through "spamassassin --report", but the Bayes filter still doesn't seem to recogni

[SAtalk] OBFUSCATING comment not matching.

2003-09-22 Thread Seelig, CD (Chris)
The OBFUSCATING_COMMENT rule on our servers seem to miss a lot of mails that would appear (by eye)to match the regex (see included item, if it makes it out of exchange intact). Any obvious reason for this? The servers are using MIMEDefang to feed SA. Some emails do match, not all. Possibly some d

RE: [SAtalk] Maintaining a list of IP numbers

2003-09-22 Thread Larry Gilson
> -Original Message- > From: Kai Schaetzl > Larry Gilson wrote on Sun, 21 Sep 2003 17:13:35 -0400: > > > I agree with what you are saying about the MAIL FROM command. > > It is easy enough to forge. However, I have only seen the header > > From change and leave the MAIL FROM command

Re: [SAtalk] Proposal for X-Spam-Status

2003-09-22 Thread Bob Apthorpe
On Mon, 22 Sep 2003 20:19:34 +0700 Robert Nicholson <[EMAIL PROTECTED]> wrote: > In addition to the tests that were performed I'd like to see the effect > on the overall score each test had. > > so instead of > > X-Spam-Status: No, hits=-0.6 required=0.6 > tests=IN_REP_TO,NO_REAL_NAME,REFERENC

[SAtalk] Re: Proposal for X-Spam-Status

2003-09-22 Thread Shane Williams
A patch to do just this exists. Do a search through the SA bugzilla, and you should be able to find it. I've got a copy of the patch laying around somewhere, but it'll probably take me longer to find it than a search on bugzila. On Mon, 22 Sep 2003, Robert Nicholson wrote: > In addition to the

RE: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread Dallas L. Engelken
> -Original Message- > From: Matt Kettler [mailto:[EMAIL PROTECTED] > > F-prot makes a very decent linux scanner on the commercial > side and their > small-business version covers most mailsever type usage at a > reasonable > price last time I checked. I heard some rumbling on the >

Re: [SAtalk] Proposal for X-Spam-Status

2003-09-22 Thread Robert Nicholson
Never mind I just learnt about always_add_report On Monday, September 22, 2003, at 08:19 PM, Robert Nicholson wrote: In addition to the tests that were performed I'd like to see the effect on the overall score each test had. so instead of X-Spam-Status: No, hits=-0.6 required=0.6 tests=IN_RE

Re: [SAtalk] Maintaining a list of IP numbers

2003-09-22 Thread Kai Schaetzl
Larry Gilson wrote on Sun, 21 Sep 2003 17:13:35 -0400: > I agree with what you are saying about the MAIL FROM command. It is easy > enough to forge. However, I have only seen the header From change and leave > the MAIL FROM command as that configured in the user's profile. What "user's profile"

Re: [SAtalk] Could not create INET socket:

2003-09-22 Thread Matt Kettler
At 07:30 AM 9/22/03 +0100, TUNC ERESEN wrote: Hello, how could I fix this error ? [root /root]# spamd -D debug: Score set 0 chosen. debug: running in taint mode? no Could not create INET socket: Address already in use IO::Socket::INET: Address already in use Best Regards, Sounds like spamd is alr

[SAtalk] Running spamd under daemontools with debugging enabled

2003-09-22 Thread Ralf Guenthner
Hi list In order to ensure that spamd is running all the time, I start it via supervise from DJB's daemontools. I wanted to use the -D option with spamd, but whenever I put that in its /service/run script, supervise can't start spamd properly (results in "supervice Removing -D solves this and sp

[SAtalk] Error message from DCC since upgraded to RC5

2003-09-22 Thread Luis Hernán Otegui
Well, I guess nobody noticed my other post, so here we go again: Since upgrading to SA-2.60-RC5, I'm getting this warnings in the maillog whenever spamd analizes a message: Sep 22 10:39:00 nahuel spamd[16955]: DCC -> check failed: Insecure directory in $ENV{PATH} while running with -T switch at

Re: [SAtalk] bayes auto expiry

2003-09-22 Thread Pete O'Hara
Theo Van Dinter wrote: On Fri, Sep 19, 2003 at 04:38:40PM -0400, Pete O'Hara wrote: Yes, I figured that if for some reason the 50k was too low that I should endup with 100k, but I here I have 165k and this is what is confusing me. 0.000 0 165010 0 non-token data: ntokens

Re: [SAtalk] Ignore SPAM rule for local users

2003-09-22 Thread Luis Hernán Otegui
Well, what MTA are you using? If you use Sendmail, MIMEDefang, od Spamass-Milter can do the trick, but you have to recompile Sendmail to enable milters (with -DMILTER compile option, and build the Libmilter, in the libmilter subdir from the distro Regards, Luis Hernán Ot

Re: [SAtalk] Blacklist from

2003-09-22 Thread Matt Kettler
At 12:30 PM 9/22/03 +0200, Jim Knuth wrote: Can I add an entry " blacklist_to [EMAIL PROTECTED]" ?? in my local.cf? That there is no support for blacklist_to currently, however if my foggy memory serves me right, it was being added to 2.60 somewhere along the line. Most of the time if you want to

[SAtalk] Proposal for X-Spam-Status

2003-09-22 Thread Robert Nicholson
In addition to the tests that were performed I'd like to see the effect on the overall score each test had. so instead of X-Spam-Status: No, hits=-0.6 required=0.6 tests=IN_REP_TO,NO_REAL_NAME,REFERENCES,X_AUTH_WARNING,X_LOOP version=2.55 I'd like to see (-1.0) etc after each test. so that I

Re: [SAtalk] Re: Spamassassin and qmail?

2003-09-22 Thread up
On Mon, 22 Sep 2003, drew wrote: > Once you get the hang of it, its not too bad I personally find it much > easier to configure then sendmail. Just be careful with the scripts, thats > the easiest place to booger something. All I did to integrate SA into my > Qmail install was to download the perl

Re: [SAtalk] 2.55 and FAILURE NOTICE's

2003-09-22 Thread Robert Nicholson
This problem I'm seeing is because folks are using my domain when forging emails. On Monday, September 22, 2003, at 06:49 PM, Ralf Guenthner wrote: - Original Message - From: "Robert Nicholson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 22, 2003 1:05 PM Subject:

Re: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Fred
Hello, Do not assume we know which version of SA you are using. This information is really helpful. Do you use Bayes? (is it trained with 200 spam & 200 ham)? Do you use Auto-White List? (Possible reason for your troubles.) You can fine tune the scores all you like, if you find a test which you

Re: [SAtalk] sa-learn

2003-09-22 Thread Matt Kettler
At 11:50 AM 9/22/03 +0200, =?ISO-8859-2?Q?Tom=E1=B9_Macek?= wrote: a] I have virtual user accounts and all my users have their accounts in the database. Their home directories/maildirs are somewhere in the /var. I'd like to know, if will make all the users via the webmail interface able to use th

Re: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread Matt Kettler
At 06:35 AM 9/22/03 -0400, landy wrote: do you recommend a virus scanner for linux On the free-software side, look into clamAV. F-prot makes a very decent linux scanner on the commercial side and their small-business version covers most mailsever type usage at a reasonable price last time I chec

Re: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Matt Kettler
At 11:36 PM 9/21/03 -0700, Mike Klein wrote: Basically email consisted of an all caps subject "INCREASE YOUR PEN*S SIZE NOW!!!" and several lines in the body with same text and a url to go to. BTW, I didn't make the above typo in my email...I spelled the organ part correctly. Why is the rating s

Re: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread Markus Gaugusch
On Sep 22, landy <[EMAIL PROTECTED]> wrote: > do you recommend a virus scanner for linux You can try H+B EDV Antivir free edition (for non-commercial use): http://www.hbedv.com/ Markus -- __/"\ Markus Gaugusch \ /ASCII Ribbon Campaign [EMAIL PROTECTED] X Aga

Re: [SAtalk] 2.55 and FAILURE NOTICE's

2003-09-22 Thread Ralf Guenthner
- Original Message - From: "Robert Nicholson" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, September 22, 2003 1:05 PM Subject: [SAtalk] 2.55 and FAILURE NOTICE's > Hi, have any improvements been made to sort out spammers who are > forging failure notices? > > From: Mail Deli

RE: [SAtalk] SpamAssassin filters seem too weak out of the box...

2003-09-22 Thread Tom Meunier
It's not abysmal. You just don't understand it. Most people get in excess of 99% of spam with SpamAssassin. Isn't it great to know that SpamAssassin is so well geared against false positives that you're TRYING to send a spammy email and can't do it? http://www.spamassassin.org/tests.html Break

RE: [SAtalk] Better logging?

2003-09-22 Thread Markus Gaugusch
On Sep 22, Tom Meunier <[EMAIL PROTECTED]> wrote: > Spamstats does that. Thanks! That's EXACTLY what I wanted :) Markus -- __/"\ Markus Gaugusch \ /ASCII Ribbon Campaign [EMAIL PROTECTED] X Against HTML Mail / \ --

RE: [SAtalk] Better logging?

2003-09-22 Thread Tom Meunier
Spamstats does that. http://www.gryzor.com/tools/ > -Original Message- > From: Markus Gaugusch [mailto:[EMAIL PROTECTED] > Sent: Monday, September 22, 2003 5:31 AM > To: [EMAIL PROTECTED] > Subject: [SAtalk] Better logging? > > Hi, > I'm using spamassassin on our relay server (with pos

[SAtalk] 2.55 and FAILURE NOTICE's

2003-09-22 Thread Robert Nicholson
Hi, have any improvements been made to sort out spammers who are forging failure notices? From: Mail Delivery Subsystem <[EMAIL PROTECTED]> Date: Mon Sep 22, 2003 3:05:39 PM Asia/Bangkok To: <[EMAIL PROTECTED]> Subject: Returned mail: User unknown Return-Path: <> Delivered-To: [EMAIL PROTECTED]

Re: [SAtalk] why it pass SA

2003-09-22 Thread landy
> You also didn't say what version of SA, or anything about your setup (bayes > enabled? awl enabled? is razor installed?, etc). Including some > configuration information, at least a version, is helpful when asking this > kind of question. quite honest i am running a default installation of

Re: [SAtalk] Blacklist from

2003-09-22 Thread Jim Knuth
Hallo Matt, am Montag, 22. September 2003, 03:54:46, schriebst Du: > At 09:07 PM 9/21/03 +0200, Jim Knuth wrote: >>Hallo SA-List, >> >> how can I add an entry in the blacklist. >>I mean a faked to-address (this is not mine) >>The sender added like so? >>--snip >>spamassassin [EMAIL PROTECTED] >>

Re: [SAtalk] All these Microsoft patch spams

2003-09-22 Thread landy
do you recommend a virus scanner for linux On Sun, 2003-09-21 at 22:31, Matt Kettler wrote: > At 12:34 PM 9/20/03 -0500, Philip Mak wrote: > >Can SpamAssassin do something about these messages? There's been a big > >flood of them recently, and they're all slipping through the filter. > > Well th

[SAtalk] Better logging?

2003-09-22 Thread Markus Gaugusch
Hi, I'm using spamassassin on our relay server (with postfix), and I would like to associate the mail recipients with the messages from spamd, to do some stats (who gets the most spam, etc.). Unfortunately, there is no easy way to do this automated - the messages from spamd don't contain enough in

Re: [SAtalk] Re: Spamassassin and qmail?

2003-09-22 Thread Michael W. Cocke
On Sun, 21 Sep 2003 23:38:57 +0200, you wrote: >Hi, > >> you will also need something like qmail-scanner, >> and need to patch and >> recompile qmail to support calling another >> queue... > >One appendum to that advice ... > >There are 4 great open source MTAs out there : Postfix, Exim, sendm

[SAtalk] sa-learn

2003-09-22 Thread Tomáš Macek
a] I have virtual user accounts and all my users have their accounts in the database. Their home directories/maildirs are somewhere in the /var. I'd like to know, if will make all the users via the webmail interface able to use the sa-learn program for teaching: will the settings made by all of t

  1   2   >