Re: Preferred DNSBL

2004-09-28 Thread David Brodbeck
John Rudd wrote: 1) Greet_Delay (default 30 seconds) -- had some brief false positives with mac.com, but they fixed their MTA to stop being so impatient. You might want to keep in mind that some MTAs that do callout verification use 30 seconds as the default timeout, and if you make them wait

RE: MIMEDefang, SpamAssassin and URIDNSBLs

2004-09-28 Thread Lucas Albers
Tim Boyer said: But the same question applies. Even _if_ I had it set wrong, why would it work when I do a 'spamassassin --test', but not when MIMEDefang calls it? You calling it as the user mimedefang runs as.. do all your tests like such: su -c spamassassin --test defang -- Luke

RE: MIMEDefang, SpamAssassin and URIDNSBLs

2004-09-28 Thread Tim Boyer
Tim Boyer said: But the same question applies. Even _if_ I had it set wrong, why would it work when I do a 'spamassassin --test', but not when MIMEDefang calls it? You calling it as the user mimedefang runs as.. do all your tests like such: su -c spamassassin --test defang ...

Strange Errors from SA 3.0

2004-09-28 Thread Erik Wickstrom
Hi all, I keep getting strange errors like this from spamassassin: sa-learn --dump magic bayes db version 2 is not able to be used, aborting! at /usr/lob/perl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm line 160. ERROR: Bayes dump returned an error, please re-run with -D for more

blacklisting/whitelisting on smtp relay for remote users

2004-09-28 Thread ip.guy
hi all our setup - qmail/qmailscanner/spamassassin/clamav, scaning ALL inbound mail and delivers (smtp relays) to internal mail server question since there are no accounts on the mail relay of user accounts, is it at all possible to allow users to setup whitelists/blacklists of

SARE: What is safe for 3.0.0?

2004-09-28 Thread Daniel M. Drucker
A simple question: Are all the rules on http://www.rulesemporium.com/rules.htm safe for use with 3.0.0, other than the ones specifically labeled pre3.0.0 or x30? Are any of said rules now unneccessary, even if they're safe? -- Daniel Drucker / [EMAIL PROTECTED]

Re: Preferred DNSBL

2004-09-28 Thread Will Yardley
On Mon, Sep 27, 2004 at 12:49:14PM -0700, Ed Kasky wrote: At 09:52 AM Monday, 9/27/2004, Dan Mahoney, System Admin wrote -= Hey guys, as a quick survey, if you're blocking ips at the MTA level, which are you using? Rejects Since Sunday 4:00 am via rbls: spamcop: 65 maps rbl+: 154

Re: REMINDER: Adding new JP list to multi.surbl.org on 9/27/04

2004-09-28 Thread Daniel M. Drucker
On 2004-09-27, Jeff Chan [EMAIL PROTECTED] wrote: This is a reminder that we will be adding JP as a new list within multi.surbl.org, as described in the previous announcement: http://www.surbl.org/quickstart.html is a little bit confusing due to its haphazard organization. Am I correct in

Sendmail smtp auth open relay on debian (fwd)

2004-09-28 Thread jm
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- Forwarded Message Message-Id: [EMAIL PROTECTED] From: debian-security-announce@lists.debian.org Sender: [EMAIL PROTECTED] To: full-disclosure@lists.netsys.com Subject: [Full-Disclosure] [SECURITY] [DSA 554-1] New sendmail packages

Re: REMINDER: Adding new JP list to multi.surbl.org on 9/27/04

2004-09-28 Thread Josh Trutwin
On Tue, 28 Sep 2004 03:01:48 + (UTC) Daniel M. Drucker [EMAIL PROTECTED] wrote: On 2004-09-27, Jeff Chan [EMAIL PROTECTED] wrote: This is a reminder that we will be adding JP as a new list within multi.surbl.org, as described in the previous announcement:

Re: REMINDER: Adding new JP list to multi.surbl.org on 9/27/04

2004-09-28 Thread Jeff Chan
On Monday, September 27, 2004, 8:01:48 PM, Daniel Drucker wrote: On 2004-09-27, Jeff Chan [EMAIL PROTECTED] wrote: This is a reminder that we will be adding JP as a new list within multi.surbl.org, as described in the previous announcement: http://www.surbl.org/quickstart.html is a little bit

spam as a covert channel

2004-09-28 Thread Justin Mason
A little OT... This presentation from this year's Black Hat Briefings is really quite interesting -- http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-kret.pdf It really does look like there may be some use of spam, specifically hashbusters and chaff headers, as a covert channel.

Remove list.dsbl.org

2004-09-28 Thread Mohd Irwan b. Jamaluddin
Good day, I am using SpamAssassin on my E-Mail Server. Version use: SpamAssassin version 2.53 Platform: Red Hat Linux 9, Kernel 2.4.20-13.9 on x86 When somebody try to email any username on my system, there is an error occured like below: (reason: 550 5.7.1 Rejected: xxx.xxx.xxx.xxx listed at

Re: [sa-list] Remove list.dsbl.org

2004-09-28 Thread Dan Mahoney, System Admin
On Tue, 28 Sep 2004, Mohd Irwan b. Jamaluddin wrote: Spamassassin is not rejecting your mail, sendmail is. Spamassassin would never reject a mail with a reason code similar to that. I would suggest finding the config file for sendmail (and the mc file it's generated from) and removing the dnsbl

SURBL in 3.0

2004-09-28 Thread Christopher Jett
Just upgraded to 3.0 from 2.6.3. I don't see where SURBL is ever registering a score, where previously it was scoring tons of mail. How can I verify that it is actually working? I installed it using MCPAN and --lint shows everything A-OK. -- Chris Jett [EMAIL PROTECTED]

Re: Preferred DNSBL

2004-09-28 Thread Jeff Chan
On Monday, September 27, 2004, 9:52:41 AM, System Dan Mahoney wrote: Hey guys, as a quick survey, if you're blocking ips at the MTA level, which are you using? sbl-xbl.spamhaus.org list.dsbl.org Spamhaus catches 90+% of them. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED]

clearing house question

2004-09-28 Thread Muhammad Talha
Dear all what is best clearing house database ( Vipul's Razor, Pyzor, and DCC ) to be used with spamassassin. Thanks Regards M.Talha

Re: Goodbye old friend 2.4x!

2004-09-28 Thread Danie Marais
LOL, it is official, I am taking my own advice. I am upgrading my live server from 2.4x! And I think the experiment was a complete success I never upgraded live server from 2.4x because I wanted to see how good I could get that system working without Bayes and net tests. 2.4x ran

Re: a rule to catch this spam

2004-09-28 Thread Raymond Dijkxhoorn
Hi! I'm getting lots of spam like this. Does anyone know a rule to catch this type of spam: Subject: Re:wmcecrgig,HotSt0ck Talk Message: I started a stock.cf, but so far the content is vary'ing so much and i could not find and specific signs so far, so i would also be interested to get them

Re: SURBL in 3.0

2004-09-28 Thread John Andersen
On Monday 27 September 2004 09:22 pm, Christopher Jett wrote: Just upgraded to 3.0 from 2.6.3. I don't see where SURBL is ever registering a score, where previously it was scoring tons of mail. How can I verify that it is actually working? I installed it using MCPAN and --lint shows

Re: a rule to catch this spam

2004-09-28 Thread Loren Wilton
There are SARE rules for stock scams. Don't recall which file they are in. Loren

Version 3.0.0-r1 won't work with DCC Pyzor

2004-09-28 Thread Hoffmann, Oliver
Hello yesterday i've done some nasty stuff. i've upgraded my perfect working sa 2.64 to 3.0.0-r1. now i have some problems with dcc and pyzor. all connections timed out after 10 seconds and i don't know why. everything works fine befor my upgrade. my system is a gentoo linux with postfix-2.1,

AW: Is there a way...

2004-09-28 Thread Hoffmann, Oliver
do you use spamassassin in a systemwide configuration? i think black- and whitelisting can held you. greats oliver hoffmann -Ursprüngliche Nachricht- Von: Mário Gamito [mailto:[EMAIL PROTECTED] Gesendet: Dienstag, 28. September 2004 11:18 An: users@spamassassin.apache.org Betreff:

serious problems after upgrade

2004-09-28 Thread Thomas Kinghorn
Hi List. I have just upgraded from 2.63 to 3.0 Now SA refuses to run. Spamassassin -lint shows: warning: rule 'G_WWW141_FINANCEBIZ_COM_BR' is over 22 chars warning: rule 'G_IMAGES_LOVEOUROFFERS_COM' is over 22 chars warning: rule 'LOCAL_DRUGS_DEPRESSION_MALEDYS' is over 22 chars warning: rule

Re: [sa-list] Re: DSPAM-plugin for SpamAssassin 3.* ?

2004-09-28 Thread Nix
On Thu, 23 Sep 2004, Juhapekka Tolvanen spake: Myth 4: PERL is designed for language processing, so SpamAssassin is written in a more appropriate language. Let me preface this with the fact that I've had about 10 years of experience coding PERL. ... yet he

Re: serious problems after upgrade

2004-09-28 Thread David Hooton
On Tue, 28 Sep 2004 11:59:07 +0200, Thomas Kinghorn [EMAIL PROTECTED] wrote: Hi List. I have just upgraded from 2.63 to 3.0 Now SA refuses to run. Spamassassin -lint shows: warning: rule 'G_WWW141_FINANCEBIZ_COM_BR' is over 22 chars snip This is the beginning of the problem, you have

Spamassassin delivering to Mysql or another mailbox

2004-09-28 Thread Ketjes Jette
Hi, (I use qmail, courier-imap and vpopmail) I set up Spamassassin (3.0.0) to tag all spam-messages with a score higher then 3.5. Now I would like spam-mails with a score higher then 6 NOT to be delivered in the mailbox of my users. I would like to put all these messages in a mysql-database.

Re: a rule to catch this spam

2004-09-28 Thread Martin
Loren Wilton wrote: There are SARE rules for stock scams. Don't recall which file they are in. That's ok Loren :). Does anyone else recall which SARE-rule Loren is thinking of? Thanks!

Re: Goodbye old friend 2.4x!

2004-09-28 Thread Graham Murray
Danie Marais [EMAIL PROTECTED] writes: Well in SA v3.0 when Bayes score 99-100% it only adds 1.9 to the score as opposed to the 5.4 it added in v2.6. Sure you can override the score, but what I'm trying to say is it seems the new SA does not rely that heavily on Bayes any more. Comparing

serious problems after upgrade: UPDATE

2004-09-28 Thread Thomas Kinghorn
Ok, issues gone. Now I am left with : snip # spamassassin --lint bayes: bayes db version 2 is not able to be used, aborting! at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/BayesStore/DBM.pm line 160. bayes: bayes db version 2 is not able to be used, aborting! at

Re: SA-Learn script

2004-09-28 Thread Nix
On Thu, 23 Sep 2004, Rubin Bennett said: I've written a bash script that takes will run sa-learn against the administrator specified False-Postive and False-Negative folders. Functionality-irrelevant pedant point: #!/bin/bash # Copyright (c) 2004 by Rubin Bennett [EMAIL PROTECTED] # All

Re: Optimal amount of RAM?

2004-09-28 Thread Nix
On Thu, 23 Sep 2004, Paul Hutchings moaned: The box is a PII-350mhz with 256mb ram and a pair of mirrored 10k SCSI drives on a hardware raid controller, things vary but the machine processes around 12,000 emails a week. I don't know much about the best ways to evaluate performance under

Re: serious problems after upgrade

2004-09-28 Thread Matt Kettler
1) SA 3.0 has it's own built in support for URI RBLs, but it is implemented differently than Mail::SpamcopURI does it. rm /etc/mail/spamassassin/spamcop_uri.cf 2) you need to upgrade the version of your bayes DB, as per the instructions in the UPGRADE file sa-learn --sync 3)

Re: Preferred DNSBL

2004-09-28 Thread Bob Apthorpe
Hi, On Mon, 27 Sep 2004 15:10:30 -0700 [EMAIL PROTECTED] wrote: On Mon, 27 Sep 2004 12:52:41 -0400 (EDT), Dan Mahoney, System Admin [EMAIL PROTECTED] said: Hey guys, as a quick survey, if you're blocking ips at the MTA level, which are you using? I think it's a bad idea and don't do it

When and Why go to 3.0

2004-09-28 Thread Felipe Tonioli
Hi all, Maybe looks like a easy question, but isn't... I have a Small traffic of messages, around 350 messages per day with an average of 130 of that are spam... my big problem is the time out, what is a problem of my machine... i think that i stop around 95% of spam, and 3% of that 5% messages

RE: Preferred DNSBL

2004-09-28 Thread Chris Santerre
-Original Message- From: Ed Kasky [mailto:[EMAIL PROTECTED] Sent: Monday, September 27, 2004 5:56 PM To: Raymond Dijkxhoorn Cc: users@spamassassin.apache.org Subject: Re: Preferred DNSBL At 12:59 PM Monday, 9/27/2004, Raymond Dijkxhoorn wrote -= Hi! Rejects Since Sunday 4:00 am via

Re: Preferred DNSBL

2004-09-28 Thread Kris Deugau
Bob Apthorpe wrote: I also firewall traffic from unassigned ARIN netspace - see http://www.iana.org/assignments/ipv4-address-space. I did this for a while, but somewhere along the line some of those unassigned netblocks got assigned. I didn't discover this until about 6 months after one

Re: Preferred DNSBL

2004-09-28 Thread Tony Finch
On Tue, 28 Sep 2004, Kris Deugau wrote: I did this for a while, but somewhere along the line some of those unassigned netblocks got assigned. I didn't discover this until about 6 months after one corporate customer suddenly couldn't send mail to one of their suppliers. Fortunately I had

Re: Preferred DNSBL

2004-09-28 Thread Bob Apthorpe
On Tue, 28 Sep 2004 10:47:20 -0400 Kris Deugau [EMAIL PROTECTED] wrote: Bob Apthorpe wrote: I also firewall traffic from unassigned ARIN netspace - see http://www.iana.org/assignments/ipv4-address-space. I did this for a while, but somewhere along the line some of those unassigned

Re: clearing house question

2004-09-28 Thread Matt Kettler
At 01:32 AM 9/28/2004, Muhammad Talha wrote: Dear all what is best clearing house database ( Vipul's Razor, Pyzor, and DCC ) to be used with spamassassin. I currently use Razor 2.61 and DCC. Both work quite well. Pyzor, I've never tried. Prior to 2.61 and the introduction of e8 Razor was mostly

[OT] exit0.us wiki is down.

2004-09-28 Thread Chris Santerre
Just as it says. exit0.us seems to be down with a DB error. Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com http://www.surbl.org 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

Re: When and Why go to 3.0

2004-09-28 Thread Matt Kettler
At 10:24 AM 9/28/2004, Felipe Tonioli wrote: Maybe looks like a easy question, but isn't... I have a Small traffic of messages, around 350 messages per day with an average of 130 of that are spam... my big problem is the time out, what is a problem of my machine... i think that i stop around 95%

SA 3.0/URIDNSBL Install Problems

2004-09-28 Thread Alden Levy
Hi. I am running RH 7.3, MS 4.33.3, Perl 5.6.1 with ClamAV (Mail::ClamAV v 0.11) on a P4 with 512MB RAM. While installing SA3.0 the other day, I *think* I had a problem with URIDNSBL. I was able to fix one set of problems by putting the following in my pre.init file: loadplugin

RE: Congratulations and Thank You!!

2004-09-28 Thread Chris Santerre
-Original Message- From: Ed Kasky [mailto:[EMAIL PROTECTED] Sent: Monday, September 27, 2004 6:01 PM To: users@spamassassin.apache.org Subject: Congratulations and Thank You!! Just wanted to pass along a note of congratulations for the release of version 3.0.0. My upgrade went

Re: serious problems after upgrade: UPDATE

2004-09-28 Thread Theo Van Dinter
On Tue, Sep 28, 2004 at 02:23:09PM +0200, Thomas Kinghorn wrote: bayes: bayes db version 2 is not able to be used, aborting! at I have performed the sa-learn -sync. Run sa-learn --sync -D, and read the output. If it succeeds, you won't see the above warnings anymore, if it doesn't, the -D

Re: Congratulations and Thank You!!

2004-09-28 Thread Michael Barnes
On Mon, Sep 27, 2004 at 03:01:08PM -0700, Ed Kasky wrote: Just wanted to pass along a note of congratulations for the release of version 3.0.0. My upgrade went quickly and turned out to be bloodless. The documentation is easy to follow and just explicit enough. Thanks again for a

Re: Strange Errors from SA 3.0

2004-09-28 Thread Theo Van Dinter
On Tue, Sep 28, 2004 at 12:32:14AM -0500, Michael Parker wrote: Sometimes it is db version 0 instead of 2. Yes, you read UPGRADE right? BTW: even if the upgrade went correctly, this could also be http://bugzilla.spamassassin.org/show_bug.cgi?id=3563 -- Randomly Generated Tagline: Choose

RE: Problem with bayes autolearn on 3.0.0

2004-09-28 Thread Tan, William
It seems that it was some sort of file permission problem that prevented the creation of bayes_journal. Spamd was running as root, which probably isn't the best way to do it anyway. So rather than trying to fix the permission problem, I'm now running spamd chrooted, and the problem has gone

Re: clearing house question

2004-09-28 Thread Kelson
Matt Kettler wrote: At 01:32 AM 9/28/2004, Muhammad Talha wrote: what is best clearing house database ( Vipul's Razor, Pyzor, and DCC ) to be used with spamassassin. I currently use Razor 2.61 and DCC. Both work quite well. Pyzor, I've never tried. The last time I checked, Pyzor's hit rate was

Re: Preferred DNSBL

2004-09-28 Thread snowjack
On Tue, 28 Sep 2004 08:57:28 -0500, Bob Apthorpe [EMAIL PROTECTED] said: Hi, Hello. On Mon, 27 Sep 2004 15:10:30 -0700 [EMAIL PROTECTED] wrote: On Mon, 27 Sep 2004 12:52:41 -0400 (EDT), Dan Mahoney, System Admin [EMAIL PROTECTED] said: Hey guys, as a quick survey, if you're blocking

Re: Preferred DNSBL

2004-09-28 Thread Kelson
Chris Santerre wrote: The question is always, did you block any legit mail... The question is, can the person blocked read english? I send back a nice little message saying you have been rejected due to listing on xx.com RBL. And to send an email to [EMAIL PROTECTED] to be taken off the list.

RE: Preferred DNSBL

2004-09-28 Thread Ed Kasky
At 07:29 AM Tuesday, 9/28/2004, Chris Santerre wrote -= However, there are numerous people who don't read the nice little message. They don't get passed the Rejected part. In all I think I've had to fix maybe 5-6 customers who were blocked over the coarse of 2.5 years. That's not bad! Want to know

Some oddities building SA3 (rpmbuild)

2004-09-28 Thread Matthias Keller
Hi I'm trying to build meself a rpm from spamassassin, but I'm getting some stuff I'm not sure if it's save to ignore...? I'm building on Suse9.0, 2.4.21-243-athlon First error(?) is: Finding Provides: /usr/lib/rpm/find-provides.perl ldd: warning: you do not have execution permission for

Re: Version 3.0.0-r1 won't work with DCC Pyzor amavisd

2004-09-28 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 There's a new fix, which needs some testing in the bugzilla, at http://bugzilla.spamassassin.org/show_bug.cgi?id=3649 . If it fixes the issue, it'll go into 3.0.1. please test ;) - --j. Erik Slooff writes: Hello yesterday i've done some

Re: spamd dying?

2004-09-28 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Will Yardley writes: On Fri, Sep 24, 2004 at 10:22:01AM -0700, Justin Mason wrote: Will Yardley writes: Has anyone else seen a problem w/ spamd dying sometimes (after working for a while)? I have been seeing this in the 3.0 rcs. I'm about

deleting spam using procmail

2004-09-28 Thread KyleReynolds
I am running spamassassin 2.64 on freeBSD 5.2.1.  It is working fine for tagging spam, but now that we are satisfied with it's performance, we want to start deleting obvious spam instead of just tagging it.  I have followed (I believe...) the instructions for deleting spam with a certain score by

Bayes keeps forgetting learned messages

2004-09-28 Thread Erik Wickstrom
Hi all, 2 problems. First, when I train SA on ham or spam, it seems to forget the counterpart. Example: sa-learn --mbox --showdots --ham inbox Would add say 300 hams to the Bayes DB, but turns the spam count to 0 or a very small number and vice versa (sa-learn --dump magic) I am also noticing

Re: Bayes keeps forgetting learned messages

2004-09-28 Thread snowjack
On Tue, 28 Sep 2004 12:46:17 -0700, Erik Wickstrom [EMAIL PROTECTED] said: Hi all, 2 problems. First, when I train SA on ham or spam, it seems to forget the counterpart. Example: sa-learn --mbox --showdots --ham inbox Would add say 300 hams to the Bayes DB, but turns the spam count

Re: Bayes keeps forgetting learned messages

2004-09-28 Thread Michael Parker
On Tue, Sep 28, 2004 at 12:46:17PM -0700, Erik Wickstrom wrote: I am also noticing that even though I upgraded to DB ver 3 with sa-learn --sync -D, it keeps reverting back to ver 0 or 2. Do you have some old code accessing the database by chance? Do you have some process that copies over a

Re: spamd dying?

2004-09-28 Thread Will Yardley
On Tue, Sep 28, 2004 at 11:56:52AM -0700, Justin Mason wrote: Will Yardley writes: On Fri, Sep 24, 2004 at 10:22:01AM -0700, Justin Mason wrote: Will Yardley writes: Much more detailed information in bug #3667 (bugzilla.spamassassin.org) I'm almost certain it's a fixed bug. What

everything autolearn=spam after 3.0 upgrade?

2004-09-28 Thread Ryan Dlugosz
Hello - Just recently noticed that all of the mail coming through my system has the autolearn=spam tag in the SA header. I run SA through MailScanner and had been using 2.64 previous to 3.0. I recently noticed an increase in spam that has been getting through, and after some investigation saw

mulitple version_tags

2004-09-28 Thread Randy Gibson
Hello, I've resently upgraded to SA3.0 from SA2.64 and have noticed that I'm getting strange version headers. Before: X-Spam-Checker-Version: SpamAssassin 2.64-global_2004020301-rgibson_20040511 After: X-Spam-Checker-Version: SpamAssassin

Berkley vs SQL for SA

2004-09-28 Thread Erik Wickstrom
Hi All, Just wanted to get your opinion on whether I should be using the default Berkely DB for Bayes and AWL or if I should use SQL - what are the pro/cons? Erik

Re: Bayes filter

2004-09-28 Thread Erik Wickstrom
If this is a new install, you won't feel much of a difference. Bayes however is an extremely powerful tool once it is trained. Bayes learns what your ham and spam emails look like, and then through the magic of statistics, it classifies incoming messages as spam or ham based on your history. I

Re: serious problems after upgrade

2004-09-28 Thread Lucas Albers
Matt Kettler said: 1) SA 3.0 has it's own built in support for URI RBLs, but it is implemented differently than Mail::SpamcopURI does it. rm /etc/mail/spamassassin/spamcop_uri.cf 2) you need to upgrade the version of your bayes DB, as per the instructions in the UPGRADE file

Re: SA 3.0 with no Subject Header on Win32 Platform

2004-09-28 Thread Theo Van Dinter
On Tue, Sep 28, 2004 at 05:12:32PM -0400, Slava Madrit wrote: Basically if you remove the Subject header completely, even though SA recognizes that it's spam, it does not mark up the subject with [SPAM] since there is no Subject. I tried it with 2.63 and it adds a Subject: header to the