RE: How to disable this?

2006-10-13 Thread Suhas \(QualiSpace\)
Thanks for your help. Warm Regards, Suhas System Admin QualiSpace - A QuantumPages Enterprise === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com === For Any Technical Query

RE: How to disable this?

2006-10-13 Thread Suhas \(QualiSpace\)
I did that in the loca.cf file but it's not refecting. What do I have to do after modifying the local.cf file. Warm Regards, Suhas System Admin QualiSpace - A QuantumPages Enterprise === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 -

Re: How to disable this?

2006-10-13 Thread jdow
1) That should be local.cf. 2) Restart spamassassin or the tool that has spamassassin daemonized. {^_^} - Original Message - From: Suhas (QualiSpace) [EMAIL PROTECTED] I did that in the loca.cf file but it's not refecting. What do I have to do after modifying the local.cf file.

Re: Handling profanity in Spam with fuzzy matching?

2006-10-13 Thread Jason Haar
Clifton Royston wrote: On Thu, Oct 12, 2006 at 10:31:39AM -0500, [EMAIL PROTECTED] wrote: What can I do to catch and handle Spam that has profanity with fuzzy matching? Is there anything that has a good level of accuracy of trapping porn spam? Try the SARE Adult ruleset.

Upgrading to 3.1.7

2006-10-13 Thread Stéphane LEPREVOST
I'm planning to upgrade my server from SA 3.1.5 to SA 3.1.7 and want to be sure that I had well understoodabout theses warnings : spamassassin --lint[19969] warn: config: warning: score set for non-existent rule X_OSIRU_DUL[19969] warn: config: warning: score set for non-existent rule

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread Dave Pooser
The rules in question almost by definition don't address spam, they address whether people are peeved at how hard it is to contact a domain's postmaster. Which is why I dispute the score attached to them. I've also been annoyed by Yahoo FPs based on the RFCI list. However: 1) In my

Message not flagged as spam

2006-10-13 Thread Suhas \(QualiSpace\)
Hello, Can anybody explain me why SA did not flagged this message as spam? X-Spam-Status: No, score=-81.0 required=4.5 tests=BAYES_40,HELO_DYNAMIC_HCC, HELO_DYNAMIC_IPADDR2,HTML_90_100,HTML_FONT_BIG,HTML_IMAGE_ONLY_08,

Re: Message not flagged as spam

2006-10-13 Thread John Andersen
On Friday 13 October 2006 00:11, Suhas (QualiSpace) wrote:         USER_IN_WHITELIST -- _ John Andersen

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread Justin Mason
John D. Hardin writes: On Thu, 12 Oct 2006, Kurt Fitzner wrote: For the purposes of SpamAssassin, it only matters if spam is filtered and ham is let through. As I keep harping on, I don't think it's SpamAssassin's job to crusade for abuse@/postmaster@ compliance. The rules in

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread John Andersen
On Friday 13 October 2006 00:23, Justin Mason wrote: John D. Hardin writes: On Thu, 12 Oct 2006, Kurt Fitzner wrote: For the purposes of SpamAssassin, it only matters if spam is filtered and ham is let through. As I keep harping on, I don't think it's SpamAssassin's job to crusade for

netset: cannot include w.x.y.z as it has already been included

2006-10-13 Thread Gilles Hamel
Hello, We are running v3.1.5 with mimedefang. Here is our setup : our own MTA with spamassassin ---/-- MTA at our ISP, our MX is HERE w.x.y.z / INTERNET In the local.cf file we have : trusted_networks w.x.y.z # Our MX Every time mimedefang spawn a child, we get this warning in

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread Kurt Fitzner
Justin Mason wrote: OTOH, DNS_FROM_RFC_POST, DNS_FROM_RFC_ABUSE, and DNS_FROM_RFC_WHOIS will likely not make it into the next release going by those rates. Thank-you very kindly for your work. I apologize (to all) for any overzealousness on my part. I realize I addressed the issue on a

Re: Message not flagged as spam

2006-10-13 Thread Lee Manevitch
On Oct 13, 2006, at 4:11 AM, Suhas (QualiSpace) wrote:Can anybody explain me why SA did not flagged this message as spam? X-Spam-Status: No, score=-81.0 required=4.5 tests=BAYES_40,HELO_DYNAMIC_HCC,  HELO_DYNAMIC_IPADDR2,HTML_90_100,HTML_FONT_BIG,HTML_IMAGE_ONLY_08, 

Re: Increase in Spam

2006-10-13 Thread Hardik Dalwadi
Hi! Max Clark said the following, On Friday 13 October 2006 04:57 AM: I have seen an increase in the amount of spam that has made its way through our filters and in to our inboxes. Most of this seems to be the stock pitches that are image attachments. Is there any way to effectively combat

RE: Message not flagged as spam

2006-10-13 Thread Suhas \(QualiSpace\)
Yes, that was the prb. Thanks Warm Regards, Suhas System Administrator QualiSpace - A QuantumPages Enterprise === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com

SOLVED : Upgrading to 3.1.7

2006-10-13 Thread Stéphane LEPREVOST
Ok, just understood the reason of the warnings : I found a no_osiru.cf file in my /etc/mail/spamassassin no-osiru.cf:score RCVD_IN_OSIRUSOFT_COM 0no-osiru.cf:score X_OSIRU_DUL 0no-osiru.cf:score X_OSIRU_DUL_FH 0no-osiru.cf:score X_OSIRU_OPEN_RELAY 0no-osiru.cf:score X_OSIRU_SPAM_SRC

Which release of spamassassin should I use on a Debian sarge system?

2006-10-13 Thread Bart Veltman
Currently I am using spamassassin version 3.0.3 on a Debian 3.1 sarge (stable release) linux system. According to Debian this version is stable but is more than a year old. Which version should I use, or must I use, to maintain a stable environment? Still go on with version 3.0.3 or upgrade

Re: Which release of spamassassin should I use on a Debian sarge system?

2006-10-13 Thread Jeroen Tebbens
Version 3.1.3 is available from sarge-backports. This source is stable enough but do give you some recent version of programs like spamassassin. Check the backports: Adjust your /etc/apt/sources.list # BACKPORTS deb http://www.backports.org/debian/ sarge-backports main contrib non-free You

Re: netset: cannot include w.x.y.z as it has already been included

2006-10-13 Thread Matt Kettler
Gilles Hamel wrote: Hello, We are running v3.1.5 with mimedefang. Here is our setup : our own MTA with spamassassin ---/-- MTA at our ISP, our MX is HERE w.x.y.z / INTERNET In the local.cf file we have : trusted_networks w.x.y.z # Our MX Every time mimedefang spawn a

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-10-13 Thread Bob Mortimer
On Friday 01 Sep 2006 10:23, Justin Mason wrote: There's also a very good ruleset I've been using for a while now, at http://svn.apache.org/repos/asf/spamassassin/rules/trunk/sandbox/jm/20_vbou nce.cf It catches almost all my unwanted bounces. Requires a little hand-editing before it'll

Is there any way to score this?

2006-10-13 Thread Robert Swan
Is there anyway to get points added if the sending mail server has no PTR record (unknown [196.211.162.65])? I am using Redhat Fedora and Spamassassin 3.1.2 and Postfix X-Spam-Checker-Version: SpamAssassin 3.1.2 (2006-05-25) on SPAM1 X-Spam-Level: ** X-Spam-Status: No, score=3.0

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-10-13 Thread Justin Mason
Bob Mortimer writes: On Friday 01 Sep 2006 10:23, Justin Mason wrote: There's also a very good ruleset I've been using for a while now, at http://svn.apache.org/repos/asf/spamassassin/rules/trunk/sandbox/jm/20_vbou nce.cf It catches almost all my unwanted bounces. Requires a little

Having issue with a type of spam I havn't seen before

2006-10-13 Thread Thomas Lindell
Title: Having issue with a type of spam I havn't seen before !DOCTYPE html PUBLIC -//W3C//DTD HTML 4.01 Transitional//EN HTMLHEADTITLEJoin the thousands of people who got slim/TITLE /HEAD BODY IMG alt= hspace=0 src="" align=baseline border=0 p /p Note the img tag. It's using

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Dylan Bouterse
Title: Having issue with a type of spam I havn't seen before Im trying to write a rule to score src="" but I cant seem to get it right. Can somebody shed some light on what Id use for the 20_phrases.cf file so I can start scoring this? Thanks. Dylan From: Thomas Lindell

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Thomas Lindell
Title: Having issue with a type of spam I havn't seen before but whas is the CID . Is that some sort of alternate notation for an ip address? From: Dylan Bouterse [mailto:[EMAIL PROTECTED] Sent: Friday, October 13, 2006 9:38 AMTo: users@spamassassin.apache.orgSubject: RE: Having issue

RE: Is there any way to score this?

2006-10-13 Thread Coffey, Neal
Robert Swan wrote: Is there anyway to get points added if the sending mail server has no PTR record (unknown [196.211.162.65])? Received: from lyonop.com (unknown [196.211.162.65]) This is totally untested, but: header LOCAL_INVALID_PTR Received =~ /\(unknown / This might be more

Re: Razor2 doesn't trust me anymore...

2006-10-13 Thread Theo Van Dinter
On Thu, Oct 12, 2006 at 08:24:11PM -0800, John Andersen wrote: I sometimes wonder if 3.1.5 broke something in razor report because that is when I first noticed it seemed to be ineffective to report. I'm not quite sure why people think SA changed or is broken. If you're seeing different

Re: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Theo Van Dinter
On Fri, Oct 13, 2006 at 09:54:07AM -0500, Thomas Lindell wrote: but whas is the CID . Is that some sort of alternate notation for an ip address? Short for Content-ID, it'll be a reference to a MIME part (with a Content-ID header matching that value) in the message. -- Randomly Selected

Re: Is there any way to score this?

2006-10-13 Thread Andreas Pettersson
Robert Swan wrote: Is there anyway to get points added if the sending mail server has no PTR record *(unknown [196.211.162.65])?* I am using Redhat Fedora and Spamassassin 3.1.2 and Postfix I was looking for the same thing some time ago, but I couldn't easily find a way to do that in SA.

Re: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Andreas Pettersson
Thomas Lindell wrote: but whas is the CID . Is that some sort of alternate notation for an ip address? It's a reference to an attached image. -- Andreas

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Thomas Lindell
I don't see anything attached to the message though. Even when I view the source I don't see a mime attachment. -Original Message- From: Andreas Pettersson [mailto:[EMAIL PROTECTED] Sent: Friday, October 13, 2006 10:14 AM To: users@spamassassin.apache.org Subject: Re: Having issue

Problems installing FuzzyOCR on RHEL4

2006-10-13 Thread Frank Bures
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I am trying to install FuzzyOCR on RHEL4 x86_64. When running configure for libgocr-0.7.2 I get configure: error: Cannot find PNM library Yet, I have 'netpbm', 'netpbm-prog' and 'netpbm-devel' packages installed and libnetpbm.so.* are available.

R: Razor2 doesn't trust me anymore...

2006-10-13 Thread Giampaolo Tomassoni
As is usually the answer, if you're interested in knowing what's going on, run with -D (and in this case, the reporter facility), and you can see the razor agent debug output. ie: $ spamassassin -r -D reporter message [...] Oct 13 10:50:43.803625 report[512]: [ 5] mail 1.0, eng 4:

Re: Is there any way to score this?

2006-10-13 Thread Wolfgang Zeikat
On 10/13/06 17:12, Andreas Pettersson wrote: Robert Swan wrote: Is there anyway to get points added if the sending mail server has no PTR record *(unknown [196.211.162.65])?* I am using Redhat Fedora and Spamassassin 3.1.2 and Postfix With a postfix mail gateway, I use a local SA rule

Re: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Andreas Pettersson
Thomas Lindell wrote: I don't see anything attached to the message though. Even when I view the source I don't see a mime attachment. Well, the attachment is missing then. Come to think of it, that would be some excellent rule :-] -- Andreas

Re: Is there any way to score this?

2006-10-13 Thread Wolfgang Zeikat
On 10/13/06 17:34, Wolfgang Zeikat wrote: Received =~ /from \S{1,30} \(unknown \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)\s+by\s+your\.smtp\.server\.desy/ Replace your.smtp.server by your server's name ... Oops, and leave out \.desy of course ;) And - just to make sure - that's a header

Rule categories and spamassassin configuration

2006-10-13 Thread enediel gonzalez
Hello: Is it possible to configure spamassassin to update itself with some rule sets categories? Today what I know is that exist some sites on internet where I download rulesets periodically, I was thinking to have features inside the configuration files of spamassassin like

Re: Rule categories and spamassassin configuration

2006-10-13 Thread Odhiambo Washington
* On 13/10/06 15:52 +, enediel gonzalez wrote: | Hello: | | Is it possible to configure spamassassin to update itself with some rule | sets categories? | | Today what I know is that exist some sites on internet where I download | rulesets periodically, I was thinking to have features

Re: Which release of spamassassin should I use on a Debian sarge system?

2006-10-13 Thread Bob Proulx
Jeroen Tebbens wrote: Version 3.1.3 is available from sarge-backports. This source is stable enough but do give you some recent version of programs like spamassassin. Agreed. I highly recommend sarge-backports for spamassassin. Check the backports: Adjust your /etc/apt/sources.list #

Re: exclude a client from internal_networks

2006-10-13 Thread Daryl C. W. O'Shea
Gary V wrote: I failed to find an example where a client or clients can be excluded from a network that is configured in internal_networks. Some stupid NAT boxes proxy the mail so it appears to come from that host. I would like to include the internal network in internal_networks, but exclude

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-10-13 Thread Justin Mason
I copied the VBounce.pm and 20_vbounce.cf from the rulesrc SVN repository, path sandbox/jm, into my 3.1.x rules dir, then modified the code for have_any_bounce_relays() to output a warning; sure enough, running spamassassin --lint output it just fine. It really seems likely that the .pm and .cf

Re: exclude a client from internal_networks

2006-10-13 Thread Gary V
Gary V wrote: I failed to find an example where a client or clients can be excluded from a network that is configured in internal_networks. Some stupid NAT boxes proxy the mail so it appears to come from that host. I would like to include the internal network in internal_networks, but exclude

Re: Rule categories and spamassassin configuration

2006-10-13 Thread Theo Van Dinter
On Fri, Oct 13, 2006 at 06:58:42PM +0300, Odhiambo Washington wrote: | Is it possible to configure spamassassin to update itself with some rule | sets categories? You can cron-ize sa-update to do this. FWIW, the official SA rulesets aren't broken up into groups, it's really an

Re: Increase in Spam

2006-10-13 Thread Clifton Royston
On Fri, Oct 13, 2006 at 09:35:33PM +0530, Suhas (QualiSpace) wrote: I have added those to the local.cf but doesn't seems to be working, what could be the reason? These rule score adjustments depend on having added some of the SARE rules; I'm not sure which set they're from. -- Clifton ...

Re: Increase in Spam

2006-10-13 Thread Clifton Royston
On Thu, Oct 12, 2006 at 09:08:23PM -0700, Max Clark wrote: Thanks - this is exactly what I was looking for. -Max On 10/12/06, Kelson [EMAIL PROTECTED] wrote: Max Clark wrote: I have seen an increase in the amount of spam that has made its way through our filters and in to our inboxes.

RE: Increase in Spam

2006-10-13 Thread Bowie Bailey
Clifton Royston wrote: On Fri, Oct 13, 2006 at 09:35:33PM +0530, Suhas (QualiSpace) wrote: I have added those to the local.cf but doesn't seems to be working, what could be the reason? These rule score adjustments depend on having added some of the SARE rules; I'm not sure which set

Re: Is there any way to score this?

2006-10-13 Thread Micke Andersson
James Lay wrote: -Original Message- From: Wolfgang Zeikat [mailto:[EMAIL PROTECTED] Sent: Friday, October 13, 2006 9:49 AM To: users@spamassassin.apache.org Subject: Re: Is there any way to score this? On 10/13/06 17:34, Wolfgang Zeikat wrote: Received =~ /from \S{1,30}

Re: forged headers

2006-10-13 Thread Tony Finch
On Thu, 12 Oct 2006, alex wrote: just got a bunch of bounced mails that have my ip in the header, but I checked my mail logs and don't see any relaying. does that mean the header is forged? I've seen lots of this over the last couple of months. It seems to be related to malware activity,

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

2006-10-13 Thread Bob Mortimer
On Friday 13 Oct 2006 17:55, Justin Mason wrote: I copied the VBounce.pm and 20_vbounce.cf from the rulesrc SVN repository, path sandbox/jm, into my 3.1.x rules dir, then modified the code for have_any_bounce_relays() to output a warning; sure enough, running spamassassin --lint output it

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread Kenneth Porter
--On Friday, October 13, 2006 9:23 AM +0100 Justin Mason [EMAIL PROTECTED] wrote: Please bear in mind, also, that there are 5 different rules that use RFCI data, and they have wildly varying accuracies and scores: SPAM%HAM%S/ORANKSCORE NAME 3.7247 0.0540 0.986 0.85

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread John Rudd
Kenneth Porter wrote: --On Friday, October 13, 2006 9:23 AM +0100 Justin Mason [EMAIL PROTECTED] wrote: Please bear in mind, also, that there are 5 different rules that use RFCI data, and they have wildly varying accuracies and scores: SPAM%HAM%S/ORANKSCORE NAME 3.7247

Re: Concerned with scores for from rfc-ignorant.org

2006-10-13 Thread John Rudd
John Rudd wrote: Kenneth Porter wrote: --On Friday, October 13, 2006 9:23 AM +0100 Justin Mason [EMAIL PROTECTED] wrote: Please bear in mind, also, that there are 5 different rules that use RFCI data, and they have wildly varying accuracies and scores: SPAM%HAM%S/ORANKSCORE

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Chris Stone
On Fri, 2006-10-13 at 10:38 -0400, Dylan Bouterse wrote: I’m trying to write a rule to score src=cid” but I can’t seem to get it right. Can somebody shed some light on what I’d use for the 20_phrases.cf file so I can start scoring this? Thanks. Here's what I am using with success: rawbody

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread John D. Hardin
On Fri, 13 Oct 2006, Jo for Groups and Lists wrote: Date: Fri, 13 Oct 2006 12:01:32 -0400 From: Jo for Groups and Lists [EMAIL PROTECTED] To: users@spamassassin.apache.org Subject: RE: Having issue with a type of spam I havn't seen before Are you using Outlook by any chance? If you are,

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread Derek Harding
On Fri, 2006-10-13 at 15:22 -0600, Chris Stone wrote: On Fri, 2006-10-13 at 10:38 -0400, Dylan Bouterse wrote: I’m trying to write a rule to score src=cid” but I can’t seem to get it right. Can somebody shed some light on what I’d use for the 20_phrases.cf file so I can start scoring this?

RE: Having issue with a type of spam I havn't seen before

2006-10-13 Thread hamann . w
On Fri, 13 Oct 2006, Jo for Groups and Lists wrote: Date: Fri, 13 Oct 2006 12:01:32 -0400 From: Jo for Groups and Lists [EMAIL PROTECTED] To: users@spamassassin.apache.org Subject: RE: Having issue with a type of spam I havn't seen before Are you using Outlook by any chance? If

FuzzyOCR and Animated GIFs

2006-10-13 Thread Lee Manevitch
I think I already know the answer to this, but does FuzzyOCR process all frames of an animated GIF? I think the answer is no, because the spam that's getting through untagged by FOCR contains multi-frame animated GIF images, the second- to-last last frame of which contains the commercial

RE: Increase in Spam

2006-10-13 Thread Suhas \(QualiSpace\)
Thanks bowie. Warm Regards, Suhas System Admin QualiSpace - A QuantumPages Enterprise === Tel India: +91 (22) 6792 - 1480 Tel US: +1 (614) 827 - 1224 Fax India: +91 (22) 2530 - 3166 URL: http://www.qualispace.com === For Any Technical Query Please