Re: slightly OT: sudden rise in Rumplestiltskin attacks?

2004-10-29 Thread Simon Byrnand
At 04:18 27/10/2004, Pierre Thomson wrote: One of our relays got 8500 name-guessing spams yesterday, up from an average of 2500 per day last week. So far today we have seen 6600, and the day isn't half over. If our MTA weren't checking recipients against our userlist, SA would be struggling

Re: ver 3.0 opinions

2004-10-29 Thread Bart Schaefer
On Thu, 28 Oct 2004 15:21:59 -0700, Jeff Ramsey [EMAIL PROTECTED] wrote: Is version 3 really any better at stopping spam that 2.63? Version 3 stops different spam than 2.63, in my experience so far. E.g. it's better at catching the drug spam but not as good at the earn cash for making phone

Re: ver 3.0 opinions

2004-10-29 Thread Matt Kettler
At 06:21 PM 10/28/2004, Jeff Ramsey wrote: Is version 3 really any better at stopping spam that 2.63? I'm running 2.63 and my friend who owns an ISP just upgraded to ver 3, and he claims that 2.63 stopped more spam. As far as an out of the box configuration goes, I'd say 3.0 is orders of

Re: ver 3.0 opinions

2004-10-29 Thread snowjack
On Thu, 28 Oct 2004 16:19:13 -0700, Bart Schaefer [EMAIL PROTECTED] said: On Thu, 28 Oct 2004 15:21:59 -0700, Jeff Ramsey [EMAIL PROTECTED] wrote: Is version 3 really any better at stopping spam that 2.63? Version 3 stops different spam than 2.63, in my experience so far. E.g. it's better

Re: NOT_TO_ME

2004-10-29 Thread Jonathan Nichols
Loren Wilton wrote: That rule sounds suspeciously like one I wrote a long time ago, and once posted here. If it is, then the problem is probably the double-quoting in the display name of the To line, or the fact that the display name happens to match the email address rather than something like

Using SpamAssassin, but not for spam

2004-10-29 Thread Andrews, Rick
Greetings, I'm trying to investigate whether SpamAssassin can be used in a non-spam application that we're trying to build. I've read lots of stuff on the website but I'm still not sure. I thought I would ask you, the experts. The application needs to determine whether a certain domain name is

Re: ver 3.0 opinions

2004-10-29 Thread Jeff Ramsey
Thanks for the help and info. I'll tell my friend why his 3.0 install is letting more spam through and he has autolearn turned on, so his should get better. As for me, I'll upgrade to at least version 2.64. I use lots of the custom rules - antidrug.cf, etc. If I upgrade SA to 3.0, can I still

Re: Remove BigEvil :)

2004-10-29 Thread Bob Proulx
Chris Santerre wrote: Number of hits for the bigevil file in Oct: 109328 Um.I'm not updating it anymore! Haven't in quite a while. Tell your RDJ script to stop asking for updates :) You should probably put some innocuous error in that file that will cause anyone running --lint to

Re: Remove BigEvil :)

2004-10-29 Thread Martin Hepworth
Chris may I suggest you change BE at the top (revision section), so it gives notice of BE's imminent death on 1 Dec (for example). Then repeat this every week so people might actually read the update email from RDJ and do something about it! On 1 Dec remove all the entries and merely have the

Problem !

2004-10-29 Thread Alexandr Orlov
Hello All! I have a linux box with CommunigatePro + spamassasin. All work fine, but sometimes I have failed message, exmaple: == Received: from lala.ru ([1.1.1.1] verified) by lalala.ru (CommuniGate Pro SMTP 4.2.5) with SMTP id 2916390; Fri, 29 Oct 2004

SpamAssassin timing out in Message.pm

2004-10-29 Thread Kevin Thorpe
I've suddenly started getting problems with SpamAssassin timing out. I upgraded to Mail::SpamAssassin 3.0.1 first with no luck. Initially the timeouts were in the bayes store so I turned bayes_auto_expire off and now the timeout has moved to Message.pm. Oct 29 10:59:14 linux amavis[28527]:

RE: Remove BigEvil :)

2004-10-29 Thread Michele Neylon :: Blacknight Solutions
Martin Hepworth wrote: Chris may I suggest you change BE at the top (revision section), so it gives notice of BE's imminent death on 1 Dec (for example). Then repeat this every week so people might actually read the update email from RDJ and do something about it! On 1 Dec remove all

Re: SpamAssassin timing out in Message.pm

2004-10-29 Thread Martin Hepworth
Kevin I use MailScanner rather than Amavi-new, but... have you tried sa-learn --force-expire to clear out the bayes info.. any RBL's in there??? have you tried removing them (setting score to zero). what does spamassassin --lint give yo? -- Martin Hepworth Snr Systems Administrator Solid State

Re: Remove BigEvil :)

2004-10-29 Thread Martin Hepworth
Michele hence for those using RDJ to update, you edit the version info, which *should* get emailed to a real person with the I've upgrade these rules message At least you've then informed as many people as possible the rule is going off-line.. -- Martin Hepworth Snr Systems Administrator

Re: SA 3.0.1/amavis - trouble loading uridnsbl/hashcash/spf

2004-10-29 Thread Mathieu Nantel
I do not doubt it. That's why I'm really trying on this one. I'm moving this system off Solaris to Linux soon, so I don't really need to solve this issue, but I'm curious to say the least. As someone else pointed out, I tried loading URIDNSBL.pm as a plugin by putting a loadplugin line in my

Re: Using SpamAssassin, but not for spam

2004-10-29 Thread Keith Hackworth
Greetings, I'm trying to investigate whether SpamAssassin can be used in a non-spam application that we're trying to build. I've read lots of stuff on the website but I'm still not sure. I thought I would ask you, the experts. The application needs to determine whether a certain domain name

Re: SpamAssassin timing out in Message.pm

2004-10-29 Thread Keith Hackworth
I've suddenly started getting problems with SpamAssassin timing out. I upgraded to Mail::SpamAssassin 3.0.1 first with no luck. Initially the timeouts were in the bayes store so I turned bayes_auto_expire off and now the timeout has moved to Message.pm. Oct 29 10:59:14 linux amavis[28527]:

Re: Problem !

2004-10-29 Thread Theo Van Dinter
On Fri, Oct 29, 2004 at 01:57:21PM +0400, Alexandr Orlov wrote: Received: from lala.ru ([1.1.1.1] verified) by lalala.ru (CommuniGate Pro SMTP 4.2.5) with SMTP id 2916390; Fri, 29 Oct 2004 13:26:04 +0400 X-Spam-Status: SpamAssassin Failed What is the problem and what I can do to remove

Re: sa-mysql issues

2004-10-29 Thread Michael Parker
On Fri, Oct 29, 2004 at 05:04:03AM -0400, Jason Lixfeld wrote: -Spamd's logfile below shows the from plixfeld-at-andromedas.com to jason-at-lixfeld.ca. The system things the username is nobody. I've tried with both the -q and -Q spamd switches to no avail. -anyone know what's going on

Re: problem with make

2004-10-29 Thread Matt Kettler
At 12:00 PM 10/29/2004, Moussa Fall wrote: I am using RH9. I removed the install version and downloaded the latest tarball SpamAssassin 3.0.1. Unfortunately I have a problem while installing. While running 'make' got the following error: Makefile:95: *** missing separator. Stop. Checked the

false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules

2004-10-29 Thread Mark Christoph
We are running SA 3.0.1 site wide at my company and I had some false positives due to HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR. They are probably useful rules, but I am surprised that their default scores are so high. Here are the headers of the message and the scores it got: Received: from

Re: false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules

2004-10-29 Thread Raymond Dijkxhoorn
Hi! Here are the scores: Content analysis details: (-98.8 points, 6.0 required) pts rule name description -- -- 0.5 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) 0.5 HELO_DYNAMIC_IPADDR

Re: false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules

2004-10-29 Thread Matt Kettler
At 01:26 PM 10/29/2004, Mark Christoph wrote: As a result, I lowered the scores for HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR. I also forced bayes to relearn the email as ham, etc. The other problem is that the sender of the message informed me that it is not a dynamically assigned address. It

Re: sa-mysql issues

2004-10-29 Thread Jason Lixfeld
On 29-Oct-04, at 11:13 AM, Michael Parker wrote: On Fri, Oct 29, 2004 at 05:04:03AM -0400, Jason Lixfeld wrote: -Spamd's logfile below shows the from plixfeld-at-andromedas.com to jason-at-lixfeld.ca. The system things the username is nobody. I've tried with both the -q and -Q spamd switches

Re: sa-mysql issues

2004-10-29 Thread Michael Parker
On Fri, Oct 29, 2004 at 02:31:59PM -0400, Jason Lixfeld wrote: debug: Conf::SQL: executing SQL: SELECT preference, value FROM userpref WHERE username = 'jason-at-lixfeld.ca' OR username = '$GLOBAL' OR username = CONCAT('%','lixfeld.ca') ORDER BY username ASC Run this query in the command

sa-learn dump showing only binary tokens

2004-10-29 Thread spamassassin
I've searches low and high for answers to this problem, but I believe they answers out there don't have regular predictable keywords to find them. SA 3.0.1 Redhat FC2 In short, when I run sa-learn --dump, I see a slew of binary tokens. I've isolated the problem by creating a test directory,

Re: sa-learn dump showing only binary tokens

2004-10-29 Thread Matt Kettler
At 03:36 PM 10/29/2004, [EMAIL PROTECTED] wrote: I've searches low and high for answers to this problem, but I believe they answers out there don't have regular predictable keywords to find them. SA 3.0.1 Redhat FC2 Yes, that's what it's supposed to do in SA 3.x. SA 3.0.x does not store bayes

Re: sa-learn dump showing only binary tokens

2004-10-29 Thread Michael Parker
On Fri, Oct 29, 2004 at 03:36:26PM -0400, [EMAIL PROTECTED] wrote: In short, when I run sa-learn --dump, I see a slew of binary tokens. I've isolated the problem by creating a test directory, pointing sa-dump to it via --dbpath, and creating a new db. Even after loading only a single spam

Re: Subject Rename, No Delete

2004-10-29 Thread Matt Kettler
At 04:26 PM 10/29/2004, John Chase wrote: This is my fist time posting to the list so I hope that my message is targeted to the appropriate audience. I'm running SA 3.0 with Qmail Scanner. I hope to delete all detected spam. However, some Spam is slipping by. The subject is renamed, but the

RE: sa-stats.pl

2004-10-29 Thread Matt Linzbach
-Original Message- From: Frank Pineau [mailto:[EMAIL PROTECTED] Subject: sa-stats.pl I haven't looked at sa-stats.pl from the tools dir in awhile, but since upgrading to 3.0.2, I thought I'd look at it again. Anyone have an idea why it returns all zeros? Does it even work

Re: sa-learn dump showing only binary tokens

2004-10-29 Thread Matt Kettler
At 04:42 PM 10/29/2004, [EMAIL PROTECTED] wrote: Thanks for the responses. Good explanations that make perfect sense. SO.. now that I'm past the hex-in-db issue, I clearly do have some issue nonetheless. The following spam got through with a score of -4.3, seemingly because of the AWL. My

Re: ver 3.0 opinions

2004-10-29 Thread Jon Trulson
On Thu, 28 Oct 2004, Bart Schaefer wrote: On Thu, 28 Oct 2004 15:21:59 -0700, Jeff Ramsey [EMAIL PROTECTED] wrote: Is version 3 really any better at stopping spam that 2.63? [...] Using it in local only mode, though, I've found it not very different. The spams that get through 3.x that do not get