Re: spamcop.net script (auto ack of spam submitted by spamassassin -r)

2006-03-07 Thread Andrzej Adam Filip
Andrzej Adam Filip wrote: The perl script is available at: http://anfi.homeunix.net/perl/spamcop-ack.pl *It is first public Beta* It logs into spamcop.net account (via web) and makes spamcop send LARTs about all spam previously submitted via SMTP (spamassassin -r). If you want to

Re: [sa-learn] Delete the same mail or not?

2006-03-07 Thread Loren Wilton
Another question: Is there any way to dump the rawtokens that sa learned from my corpus? I saw that there are only encoded strings. Previously they were actual tokens and could be dumped. Now they are hashes and can not be tracked back to the original tokens by any particularly easy means.

RE: Config files

2006-03-07 Thread James Smith
I think you will have to ask the VHCS people. Their site is all in German; and, I don't speak German. So I could not glean anything from their site at all when I searched for SpamAssassin. I had the same problem unfortunately, but thank you all for trying, it is most appreciated. -- Jay

Re: Commercial SA packages?

2006-03-07 Thread Patrick Sneyers
I suggest you get in touch these hardworking fellows. http://www.messagepartners.com Patrick Sneyers Belgium http://www.messagepartners.com/http://www.messagepartners.com/http:// www.messagepartners.com/ Op 6-mrt-06, om 18:05 heeft Stewart, John het volgende geschreven: We've been running

How can I increase the score of a spam message?

2006-03-07 Thread Yousef Raffah
Hi, One of the spam messages I received in my inbox today hit the following triggers: X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3 tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046] How can I increase the

Re: How can I increase the score of a spam message?

2006-03-07 Thread Loren Wilton
X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3 tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046] How can I increase the score of this message? 1.Train Bayes. It doesn't know if this is ham or spam. You

SPAM not being checked

2006-03-07 Thread Will Nordmeyer
I have bumped SpamAssassin 3.1.0 up to 10 clients (from 5) and added round-robin to the startup routine my daemon startup now looks like this: daemon /home/spam-filter/bin/spamd -d -c -m 10 --round-robin --socketpath=/home/spam-filter/tmp/spamd.sock -H /home/spam-filter/razor But

Re: SPAM not being checked

2006-03-07 Thread jdow
From: Will Nordmeyer [EMAIL PROTECTED] I have bumped SpamAssassin 3.1.0 up to 10 clients (from 5) and added round-robin to the startup routine. my daemon startup now looks like this: daemon /home/spam-filter/bin/spamd -d -c -m 10 --round-robin --socketpath=/home/spam-filter/tmp/spamd.sock

All image spam

2006-03-07 Thread Jack Gostl
I've seen some references to this in threads, but I didn't see an answer. Starting in late November, we started getting hit with spam that was almost entirely a jpeg. They seem to be mostly "stock recommendations". There is minimal message, usually HTML, and the real spam content is in the

RE: All image spam

2006-03-07 Thread Martin Hepworth
Jack If you turn on the URI-RBLs in 3.1 (see v310.pre) you should see a reduction in this type of spam. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: Jack Gostl [mailto:[EMAIL PROTECTED] Sent: 07 March 2006 11:55 To:

Re: All image spam

2006-03-07 Thread Loren Wilton
Any suggestions? The SARE stock rules. They won't catch all of 'em, but they will catch a lot. Loren

Re: How can I increase the score of a spam message?

2006-03-07 Thread Yousef Raffah
On Tue, 2006-03-07 at 02:34 -0800, Loren Wilton wrote: X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3 tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046] How can I increase the score of this message? 1.

Re: All image spam

2006-03-07 Thread leonard . gray
We jacked up the scoring on HTML_IMAGE_ONLY_12 to a 5, and are catching about 90% of these now with almost no false positives. Jack Gostl [EMAIL PROTECTED] 03/07/2006 07:26 AM To users@spamassassin.apache.org cc Subject All image spam I've seen some references to this in

Amavisd replacement suggestion

2006-03-07 Thread tsmullins
We have been running Spamassassin for two years or so now. Spamassassinhas been great. We run Postfix, Amavisd and Spamassassin.I really need some suggestions to replace Amavisd. I have two problems with Amavisd that I cannot seem to fix. Any recommendations on how to call Spamassassin

RE: All image spam

2006-03-07 Thread Randal, Phil
My experience of the SARE Stock rules to date hasn't been good. They score way too low to kick stuff into the high score region even with the help of Bayes. What's probably needed is two sets of rules or scores for the SARE Stock ruleset - one for investors/stockbrokers, another for those

RE: Amavisd replacement suggestion

2006-03-07 Thread Martin Hepworth
Shane Have a look at MailScanner as an alternative to amavisd - it's nice to have a choice isn't it.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 07 March 2006 13:23

RE: How can I increase the score of a spam message?

2006-03-07 Thread Bowie Bailey
Yousef Raffah wrote: On Tue, 2006-03-07 at 02:34 -0800, Loren Wilton wrote: X-Spam-Status: No, score=4.863 tagged_above=-100 required=6.3 tests=[BAYES_50=0.001, HTML_IMAGE_ONLY_12=1.867, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.948, RCVD_IN_SORBS_DUL=2.046] How can I increase the

Re: Amavisd replacement suggestion

2006-03-07 Thread Michael W Cocke
On Tue, 7 Mar 2006 14:10:26 -, you wrote: Shane Have a look at MailScanner as an alternative to amavisd - it's nice to have a choice isn't it.. My understanding is that mailscanner doesn't work safely with postfix. (IIRC someone on this list told me that when I first encountered mailscanner

RE: Amavisd replacement suggestion

2006-03-07 Thread Martin Hepworth
Works fine with postfix... http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos tfix:politicss=politics -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -Original Message- From: Michael W Cocke [mailto:[EMAIL PROTECTED]

Re: Amavisd replacement suggestion

2006-03-07 Thread Craig White
On Tue, 2006-03-07 at 09:57 -0500, Michael W Cocke wrote: On Tue, 7 Mar 2006 14:10:26 -, you wrote: Shane Have a look at MailScanner as an alternative to amavisd - it's nice to have a choice isn't it.. My understanding is that mailscanner doesn't work safely with postfix. (IIRC

Re: Amavisd replacement suggestion

2006-03-07 Thread Michael Monnerie
On Dienstag, 7. März 2006 16:11 Craig White wrote: personally found amavisd-new to be a PITA Isn't PITA some sort of Greek bread? The one they use for Gyros, I believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita So why is it like Greek bread? mfg zmi -- // Michael

Re: Amavisd replacement suggestion

2006-03-07 Thread Michael W Cocke
On Tue, 7 Mar 2006 15:04:11 -, you wrote: Works fine with postfix... http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos tfix:politicss=politics Thanks Martin - very interesting! When I first heard of mailscanner I was very excited - I've been using Amavisd-new

Re: Amavisd replacement suggestion

2006-03-07 Thread Ralf Hildebrandt
* Michael Monnerie [EMAIL PROTECTED]: On Dienstag, 7. März 2006 16:11 Craig White wrote: personally found amavisd-new to be a PITA Isn't PITA some sort of Greek bread? The one they use for Gyros, I believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita So why is it like

RE: Amavisd replacement suggestion

2006-03-07 Thread Bowie Bailey
Michael Monnerie wrote: On Dienstag, 7. März 2006 16:11 Craig White wrote: personally found amavisd-new to be a PITA Isn't PITA some sort of Greek bread? The one they use for Gyros, I believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita So why is it like Greek bread?

Re: [OT] Amavisd replacement suggestion

2006-03-07 Thread Chr. v. Stuckrad
On Tue, Mar 07, 2006 at 04:42:31PM +0100, Michael Monnerie wrote: Isn't PITA some sort of Greek bread? The one they use for Gyros, I believe. Wait, looking on wikipedia: http://en.wikipedia.org/wiki/Pita So why is it like Greek bread? May be, amavisd is best if toasted (as I like pita==pide

Re: Amavisd replacement suggestion

2006-03-07 Thread nick
Michael W Cocke wrote: On Tue, 7 Mar 2006 15:04:11 -, you wrote: Works fine with postfix... http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos tfix:politicss=politics Thanks Martin - very interesting! When I first heard of mailscanner I was very excited -

Re: Alarm Leaks (was: Re: [sa-list] Re: Spamd keeps getting hung up!)

2006-03-07 Thread Justin Mason
Daryl C. W. O'Shea writes: Justin Mason wrote: Dan Mahoney, System Admin writes: And 4) This whenever it gets hung up (those __alarm__ things couldn't be more vague, could they?): Mar 2 12:53:07 quark spamd[94770]: __alarm__ Mar 2 12:53:07 quark spamd[94770]: __alarm__ that's

Re: All image spam

2006-03-07 Thread Craig Baird
I'm having similar results here. As others have mentioned, the SARE stock rules do help somewhat, but it's by no means the proverbial silver bullet. As someone else also mentioned, it helps to increase the HTML_IMAGE_ONLY_XX rules. I increased 12,16,20, and 24 by one point each. However,

RE: All image spam

2006-03-07 Thread Craig Baird
Quoting Martin Hepworth [EMAIL PROTECTED]: Jack If you turn on the URI-RBLs in 3.1 (see v310.pre) you should see a reduction in this type of spam. I don't think I've ever seen a URI in one of these... They purposely leave out anything in the actual message body that could be used to

RE: All image spam

2006-03-07 Thread Dallas L. Engelken
My recommendation is to take this approach Penalize emails with inline gifs, and penalize them even more if they hit in combination with HTML_IMAGE_ONLY_*. meta __IMG_ONLY(HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 ||

Re: Amavisd replacement suggestion

2006-03-07 Thread Craig White
On Tue, 2006-03-07 at 17:29 +0100, nick wrote: Michael W Cocke wrote: On Tue, 7 Mar 2006 15:04:11 -, you wrote: Works fine with postfix... http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:pos tfix:politicss=politics Thanks Martin - very

RE: Amavisd replacement suggestion

2006-03-07 Thread Gary W. Smith
Shane, We use Vexira from centralcommand.com for our own company mail. It seems to work fairly well and isnt that tricky to setup. We had a bear of a time getting amavisd working with postfix a couple years back so we decided to go commercial. Gary Wayne Smith From:

RE: Commercial SA packages?

2006-03-07 Thread Chris Santerre
Title: RE: Commercial SA packages? We've been running SpamAssassin with amavisd-new for years... still on an old version, and been meaning to update for far too long. The fact is, I just don't have the time to give SA proper care and feeding. I know there are some commercial

RE: Commercial SA packages?

2006-03-07 Thread Stewart, John
John Stewart wrote: The fact is, I just don't have the time to give SA proper care and feeding. I know there are some commercial anti-spam packages based on SA. I'd like to know if anyone has opinions on their effectiveness and admin ease. We can afford to shell out some cash

RE: Commercial SA packages?

2006-03-07 Thread Dallas L. Engelken
-Original Message- From: Stewart, John [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 07, 2006 12:36 To: 'users@spamassassin.apache.org' Subject: RE: Commercial SA packages? John Stewart wrote: The fact is, I just don't have the time to give SA proper care and feeding.

RE: Amavisd replacement suggestion

2006-03-07 Thread Kurt Buff
Use of mailscanner with postfix is unsupported by the author of postfix. He (Mr. Venema) says that mailscanner mucks about in the internal queues of postfix, and because of that doesn't play nice. Some of the most knowledgable users on the postfix list, especially those with very large

Re: Commercial SA packages?

2006-03-07 Thread Harold Pritchett
Stewart, John wrote: So I have to triage what I do. If we can spend way too much money on a reasonable commercial product that we can slap onto our Exchange box, we'd rather do that than have my time be tied up for a few weeks while I get a new SA server built and tested. Outsource it! I'm

Re: Commercial SA packages?

2006-03-07 Thread Theo Van Dinter
On Tue, Mar 07, 2006 at 02:02:28PM -0500, Harold Pritchett wrote: Outsource it! I'm sure that there are small business computer consultants in your area who could, for a one time fee, build the hardware, install the software, and do the initial configuration and testing. Optionally,

Re: Amavisd replacement suggestion

2006-03-07 Thread Vivek Khera
On Mar 7, 2006, at 12:35 PM, Gary W. Smith wrote:We use Vexira from centralcommand.com for our own company mail.  It seems to work fairly well and isn’t that tricky to setup.  We had a bear of a time getting amavisd working with postfix a couple years back so we decided to go commercial.heh... for

RE: Amavisd replacement suggestion

2006-03-07 Thread Gary W. Smith
I just manually ran the update and it went fine. Stop scarring me! J. Gary Wayne smith From: Vivek Khera [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 07, 2006 11:28 AM To: SpamAssassin Users Subject: Re: Amavisd replacement suggestion On Mar 7, 2006, at 12:35

RE: Commercial SA packages?

2006-03-07 Thread Gary W. Smith
John, I think the group is of the opinion that these commercial apps aren't anything more than glorified SA installs with a huge price tag. Huge being more than the cost of a good SA box plus your time... We just recently upgraded our Dell 4600's to Dell 5150's (4 of them) for under $3000.

Re: Amavisd replacement suggestion

2006-03-07 Thread Vivek Khera
On Mar 7, 2006, at 2:48 PM, Gary W. Smith wrote:I just manually ran the update and it went fine.  Stop scarring me! J. seems that some time after 12:30 Eastern time it started to work again.

spamd children disobeying orders

2006-03-07 Thread Scott Russell
Greets. Running SA 3.1.0 with spamc/spamd on RHEL4 i386. I have the following options for my spamd: -d --allow-tell --max-children=30 --min-children=10 --min-spare=3 --max-spare=6 -q -x -u spamd Today I saw the following error in /var/log/maillog: spamd[23150]: prefork: ordered child to

Re: spamd children disobeying orders

2006-03-07 Thread Scott Russell
Craig Green wrote: Scott Russell wrote: Greets. Running SA 3.1.0 with spamc/spamd on RHEL4 i386. I have the following options for my spamd: -d --allow-tell --max-children=30 --min-children=10 --min-spare=3 --max-spare=6 -q -x -u spamd Today I saw the following error in /var/log/maillog:

Image MD5sums available, was Re: All image spam

2006-03-07 Thread William Stearns
Good evening, Jack, all, On Tue, 7 Mar 2006, Jack Gostl wrote: I've seen some references to this in threads, but I didn't see an answer. Starting in late November, we started getting hit with spam that was almost entirely a jpeg. They seem to be mostly stock recommendations. There is

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-07 Thread Dan Mahoney, System Admin
On Thu, 2 Mar 2006, Daryl C. W. O'Shea wrote: Daryl, Still working on clearing the other issues. I'm using MOST of the plugins that come with spamassassin, but no third party plugins -- there's some third party RULESETS including rules du jour, chickenpox, etc -- but those are all fairly

location of neural net file

2006-03-07 Thread Gabriel M. Wachman
It says in the SpamAssassin FAQ that version 3.x uses a neural network to learn scores of messages. Where is the state of this neural network saved? In other words, how does SpamAssassin keep track of the neural network from one invocation to another?

Re: location of neural net file

2006-03-07 Thread Matt Kettler
Gabriel M. Wachman wrote: It says in the SpamAssassin FAQ that version 3.x uses a neural network to learn scores of messages. Where is the state of this neural network saved? In other words, how does SpamAssassin keep track of the neural network from one invocation to another? It doesn't keep

Re: [sa-list] Re: Spamd keeps getting hung up!

2006-03-07 Thread Theo Van Dinter
On Tue, Mar 07, 2006 at 08:14:38PM -0500, Dan Mahoney, System Admin wrote: =item languages_filename If you want to be able to use the language-guessing rule CUNWANTED_LANGUAGE_BODY, and are using Cconfig_text instead of Crules_filename, Csite_rules_filename, and Cuserprefs_filename, you

Re: location of neural net file

2006-03-07 Thread Gabriel M. Wachman
Matt Kettler wrote: Gabriel M. Wachman wrote: It says in the SpamAssassin FAQ that version 3.x uses a neural network to learn scores of messages. Where is the state of this neural network saved? In other words, how does SpamAssassin keep track of the neural network from one invocation to

Re: location of neural net file

2006-03-07 Thread Theo Van Dinter
On Tue, Mar 07, 2006 at 08:44:59PM -0500, Gabriel M. Wachman wrote: The perceptron (form of neural net used in SA 3.0.0 and higher) is used by the developers to generate the scores prior to release. 99.9% of end-users do not ever use the perceptron. By do not use do you mean that

Re: location of neural net file

2006-03-07 Thread Gabriel Wachman
Theo Van Dinter wrote: On Tue, Mar 07, 2006 at 08:44:59PM -0500, Gabriel M. Wachman wrote: The perceptron (form of neural net used in SA 3.0.0 and higher) is used by the developers to generate the scores prior to release. 99.9% of end-users do not ever use the perceptron. By do not

Re: location of neural net file

2006-03-07 Thread Theo Van Dinter
On Tue, Mar 07, 2006 at 09:41:53PM -0500, Gabriel Wachman wrote: The motivation for this is that I'm comparing a filter a colleague wrote to various other filters (including SpamAssassin) and I want to make sure that the summary I give of SpamAssassin in my paper is accurate. Neural net vs.

Updated Pump and Dump rules. 2006-03-07

2006-03-07 Thread Doc Schneider
I just committed version 01.00.12 of this ruleset to: http://rulesemporium.com/rules/70_sare_stocks.cf It should appear within the hour. This new update includes better all gif stox detection. Enjoy. -Doc (SA/SARE/URIBL/SURBL -- Ninja)

Re: Image MD5sums available, was Re: All image spam

2006-03-07 Thread Dirk Bonengel
Hi, all, I wonder if the iXhash Plugin I did last summer would catch these. FYI, the plugin uses some form(s) of fuzzy MD5 checksums of the complete mail body (not seperate mime parts) and does compare the results with those I provide via DNS. It's available at