sa ignoring whitelist_from in user_prefs

2007-02-10 Thread Rich Winkel
For a particular user, I'm finding no correlation between his whitelist_from's in user_prefs and the whitelist status as reported in incoming messages. I see messages with no USER_IN_WHITELIST when both the From and From: addresses match a whitelist_from line in the user_prefs file. I also see

whitelist problems

2007-02-10 Thread urgrue
I'm having a whitelist-related problem. -a lot of spam comes through with WHITELISTED in the headers, yet i can never find the senders, IPs, etc of said messages in any whitelists, including the auto-whitelist. -auto-whitelist is in use although I've disabled it everywhere. I'm running

Re: IADB, 70_iadb.cf and multiple A records returned

2007-02-10 Thread Raul Dias
On Sat, 2007-02-10 at 00:00 -0500, Theo Van Dinter wrote: O If the last one is true, is the ^ $ really necessary? [...] If it really is a RE, what preventes '127.0.0.1' to not match 127.0.0.10? Or 127.1.0.1 to not match 127.120.1.1 ? You answered your own question. :) Ok, this answers

pyzor error

2007-02-10 Thread Webmaster
pyzor stopped working on my fedora core 5 system. I get the following error: Traceback (most recent call last): File /usr/bin/pyzor, line 3, in ? import pyzor.client ImportError: No module named pyzor.client The contents of /usr/bin/pyzor are: #!/usr/bin/python import pyzor.client

Re: pyzor error

2007-02-10 Thread Ed Kasky
At 06:04 AM Saturday, 2/10/2007, you wrote -= pyzor stopped working on my fedora core 5 system. I get the following error: Traceback (most recent call last): File /usr/bin/pyzor, line 3, in ? import pyzor.client ImportError: No module named pyzor.client The contents of /usr/bin/pyzor are:

Re: pyzor error

2007-02-10 Thread Webmaster
yes. the that error message is slightly different but in any case I do not understand what 'define PYTHONPATH to point at ($HOME/lib/python)' means (what/where/how). - Original Message - From: Ed Kasky [EMAIL PROTECTED] To: Webmaster [EMAIL PROTECTED] Cc:

Re: whitelist problems

2007-02-10 Thread Matt Kettler
urgrue wrote: I'm having a whitelist-related problem. -a lot of spam comes through with WHITELISTED in the headers, yet i can never find the senders, IPs, etc of said messages in any whitelists, including the auto-whitelist. -auto-whitelist is in use although I've disabled it everywhere. The

Startting spamassassin

2007-02-10 Thread Mário Gamito
Hi, I've just installed spamassassin. I'ts been a long time since i've installed the last mail server and i never used version 3. Ok, i've compiled it and copied spamd to /etc/init.d If i just run ./spamd start, it will run as root and stucks the terminal. So, i'm running ./spamd -u qscand

Re: Startting spamassassin

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 16:44:16 +, Mário Gamito [EMAIL PROTECTED] wrote: Hi, I've just installed spamassassin. I'ts been a long time since i've installed the last mail server and i never used version 3. Ok, i've compiled it and copied spamd to /etc/init.d If i just run ./spamd start, it

Re: Startting spamassassin

2007-02-10 Thread Mário Gamito
Hi, I have spamassassin already 100% installed in a Linux server. I just want to know how to run it as user qscand without having to type ./spamd -u qscand start , so i can start it at boot time. Regards, Mário Gamito Nigel Frankcom wrote: On Sat, 10 Feb 2007 16:44:16 +, Mário Gamito

Re: Startting spamassassin

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 17:12:24 +, Mário Gamito [EMAIL PROTECTED] wrote: Hi, I have spamassassin already 100% installed in a Linux server. I just want to know how to run it as user qscand without having to type ./spamd -u qscand start , so i can start it at boot time. Regards, Mário Gamito

Re: whitelist problems

2007-02-10 Thread John D. Hardin
On Sat, 10 Feb 2007, Matt Kettler wrote: In particular, make sure you didn't do anything like the common mistake of whitelist_from [EMAIL PROTECTED]. Any spammer can trivially forge a From: or Return-Path header, and forging your own domain in these fields is a common tactic because spammers

Re: Startting spamassassin

2007-02-10 Thread Matt Kettler
Mário Gamito wrote: Hi, I've just installed spamassassin. I'ts been a long time since i've installed the last mail server and i never used version 3. Ok, i've compiled it and copied spamd to /etc/init.d Don't do that. spamd isn't an init script. It's a binary executable. It belongs in

A New Approach: Find the Ham

2007-02-10 Thread Dan
I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: SITUATION In the beginning, all email was ham. When spam came along, we left the ham

RE: A New Approach: Find the Ham

2007-02-10 Thread Giampaolo Tomassoni
From: Dan [mailto:[EMAIL PROTECTED] I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: SITUATION In the beginning, all email was ham.

Re: A New Approach: Find the Ham

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 20:52:17 +0100, Giampaolo Tomassoni [EMAIL PROTECTED] wrote: From: Dan [mailto:[EMAIL PROTECTED] I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier

Re: A New Approach: Find the Ham

2007-02-10 Thread Tom Allison
CHALLENGE All filtering software is written to score for results that equal spam - catch the bad SOLUTION Make filtering software score for results that equal ham - uncatch the good. Your thoughts? How can this method spend less time and energy? Aren't you going to build a mirrored

Re: A New Approach: Find the Ham

2007-02-10 Thread Miles Fidelman
Dan wrote: I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: NEW ASSUMPTION All messages are spam unless x,y,z score says they're ham. NEW

RE: A New Approach: Find the Ham

2007-02-10 Thread Giampaolo Tomassoni
From: Tom Allison [mailto:[EMAIL PROTECTED] CHALLENGE All filtering software is written to score for results that equal spam - catch the bad SOLUTION Make filtering software score for results that equal ham - uncatch the good. Your thoughts? How can this method spend

RE: A New Approach: Find the Ham

2007-02-10 Thread Giampaolo Tomassoni
From: Tom Allison [mailto:[EMAIL PROTECTED] CHALLENGE All filtering software is written to score for results that equal spam - catch the bad SOLUTION Make filtering software score for results that equal ham - uncatch the good. Your thoughts? How can this method spend

Re: A New Approach: Find the Ham

2007-02-10 Thread urgrue
One consideration is that spam getting through is never more than an annoyance. Ham getting caught can be a big problem. So any kind of deny by default system has to deal with how to respond to people sending you mail that gets trapped and provide a way for the sender to get approval. How

Re: A New Approach: Find the Ham

2007-02-10 Thread urgrue
This would be easier to filter. It would also be more adaptive to a statistical approach than a regex approach. Personally, I think HTML email should be outright discarded from the start. If you look at this arguement presented by the OP then it reinforces the idea that most ascii is ham

Re: A New Approach: Find the Ham

2007-02-10 Thread Nigel Frankcom
On Sat, 10 Feb 2007 15:14:56 -0500, Miles Fidelman [EMAIL PROTECTED] wrote: Dan wrote: I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: NEW

RE: A New Approach: Find the Ham

2007-02-10 Thread Giampaolo Tomassoni
From: Miles Fidelman [mailto:[EMAIL PROTECTED] Dan wrote: I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: NEW ASSUMPTION All

Re: A New Approach: Find the Ham

2007-02-10 Thread Dan
Clarifications: 1) I'm not talking about generating new rules. Rules stay the same. I'm describing a new scoring process only. 2) This would not be a replacement to SA, but an improvement. Just a new way to process results already generated by SA. Ideally, this would be a replacement

Re: A New Approach: Find the Ham

2007-02-10 Thread Mark Samples
Is that the same as whitelisting, maybe I do not understand, but a very rigorous approach would be a whitelist methodology which, once a new account is created, they send email to everyone they want to communicate with, and it 'autowhitelists' those addresses, so you can only receive from those

Re: whitelist problems

2007-02-10 Thread urgrue
The auto-whitelist has nothing to do with anything that says WHITELISTED. The auto-whitelist will show up as a rule named AWL. Nothing else. That said, can you be VERY specific about what your headers say? Does it say USER_IN_WHITELIST? If so, check your whitelist_from and

Re: whitelist problems

2007-02-10 Thread Theo Van Dinter
On Sat, Feb 10, 2007 at 10:34:35PM +0200, urgrue wrote: It says, precisely: X-Spam-Status: No, hits=- tagged_above=-.0 required=5.0 WHITELISTED So if its not whitelist_from or the AWL, what can it be? That's not an SA header, so I'm guessing you call SA from a third party daemon. I'd

Re: A New Approach: Find the Ham

2007-02-10 Thread Dan
On Feb 10, 2007, at 12:14, Miles Fidelman wrote: Dan wrote: I've developed a new approach to scoring that I want to 1) share with everyone and 2) make into a working system thats as accurate as what I've already built, but easier to use. First, the theory: NEW ASSUMPTION All messages are

How to Scan just incoming not outcoming emails?

2007-02-10 Thread correiob
Hi: I have a Centos Linux, running Apache, Sendmail, Spam Assassin and MailScanner. This Server is POP as well as SMTP for all the mailboxes of my customers. Actually, the SpamAssassin at this Server filters both, the emails that are being received and the emails that are being sent. This

Re: How to Scan just incoming not outcoming emails?

2007-02-10 Thread Theo Van Dinter
On Sat, Feb 10, 2007 at 07:42:55PM -0300, correiob wrote: So, my question is: is it possible to set Sendmail / Spam Assassin in order filters just the receiving emails? If so, please, tell me what to do. But, please, tell me like a cooking recipe, because I am not quite experienced with

Re: How to Scan just incoming not outcoming emails?

2007-02-10 Thread Evan Platt
At 02:42 PM 2/10/2007, correiob wrote: Hi: I have a Centos Linux, running Apache, Sendmail, Spam Assassin and MailScanner. This Server is POP as well as SMTP for all the mailboxes of my customers. Actually, the SpamAssassin at this Server filters both, the emails that are being received

Re: A New Approach: Find the Ham

2007-02-10 Thread Raul Dias
NEW SITUATION Ham is now the tiniest minority of all email. NEW ASSUMPTION All messages are spam unless x,y,z score says they're ham. NEW APPROACH Block everything, then create rules to not catch what you do want. ie, build tests that target the spam (keeping all the tests you've

Re: IADB, 70_iadb.cf and multiple A records returned

2007-02-10 Thread Theo Van Dinter
On Sat, Feb 10, 2007 at 10:09:35AM -0300, Raul Dias wrote: This also implies that the sub-test values is always a RE and needs to be proper delimeted. If you read perldoc Mail::SpamAssassin::Conf, specifically the check_rbl_sub() section, it'll explain what the subtests can be. It can be

Re: How to Scan just incoming not outcoming emails?

2007-02-10 Thread correiob
Hi, Evan / Theo: Well, until what I have understood, my Sendmail / Mailscanner are the responsible to send to Spam Assassin the emails to be filterd, so, I have to set Sendmail / Mailscanner in order they send to SA just incoming emails, right? Thanks a lot. Mario./ At 18:47 10/2/2007,

Re: A New Approach: Find the Ham

2007-02-10 Thread Mathieu Bouchard
On Sat, 10 Feb 2007, Dan wrote: With Find the Ham, whitelisting is almost obsolete. When you find an FP, How do you ever find FPs if you have so many TP to sort through that it's not even worth sorting through FP+TP to find the FP ? IMHO, that'd be why we assume that mails are ham rather

Re: IADB, 70_iadb.cf and multiple A records returned

2007-02-10 Thread Raul Dias
On Sat, 2007-02-10 at 16:53 -0500, Theo Van Dinter wrote: On Sat, Feb 10, 2007 at 10:09:35AM -0300, Raul Dias wrote: This also implies that the sub-test values is always a RE and needs to be proper delimeted. If you read perldoc Mail::SpamAssassin::Conf, specifically the check_rbl_sub()

Re: whitelist problems

2007-02-10 Thread Matt Kettler
John D. Hardin wrote: On Sat, 10 Feb 2007, Matt Kettler wrote: In particular, make sure you didn't do anything like the common mistake of whitelist_from [EMAIL PROTECTED]. Any spammer can trivially forge a From: or Return-Path header, and forging your own domain in these fields is a

Re: A New Approach: Find the Ham

2007-02-10 Thread Dan
On Feb 10, 2007, at 14:38, Mathieu Bouchard wrote: How do you ever find FPs if you have so many TP to sort through that it's not even worth sorting through FP+TP to find the FP ? IMHO, that'd be why we assume that mails are ham rather than assume that they are spam. I haven't found FP

Re: whitelist problems

2007-02-10 Thread Matt Kettler
urgrue wrote: The auto-whitelist has nothing to do with anything that says WHITELISTED. The auto-whitelist will show up as a rule named AWL. Nothing else. That said, can you be VERY specific about what your headers say? Does it say USER_IN_WHITELIST? If so, check your whitelist_from

How to use eval: methods without calling check?

2007-02-10 Thread Robert Nicholson
I'd like to programatically call the methods SA uses to check for 8bit charsets and the like but I personally do not care to make use of the rules engine at all. Do I need an instance of PerMsgStatus fully setup before I can call eval: methods programatically? For instance I already have

Charset dealing in SA

2007-02-10 Thread Raul Dias
I am writting some rules with accents which is out of ASCII. In my case it is ISO-8859-1 and I am sure it will match ISO-8859-1 equivalent messages. However, how will it behave agains different charset (utf-8) in the message body? Does SA do anything regarding this issue like converting

bad OCR with some GIF images

2007-02-10 Thread Spamy.cz - Maxim Cerny
Hello, I'm using SA 3.1.7 with FuzzyOCR 3.5.1 . This month I started having troubles with some GIF spams. The OCR can't recognize it and prints out only some letters after doing the OCR. Have anybody seen it? Max [EMAIL PROTECTED] f]# spamassassin --debug FuzzyOcr Přep\:\ Now\ this\ is\

Re: How to use eval: methods without calling check?

2007-02-10 Thread Theo Van Dinter
On Sat, Feb 10, 2007 at 06:30:50PM -0600, Robert Nicholson wrote: I'd like to programatically call the methods SA uses to check for 8bit charsets and the like but I personally do not care to make use of the rules engine at all. Do I need an instance of PerMsgStatus fully setup before I

Re: How to use eval: methods without calling check?

2007-02-10 Thread Robert Nicholson
This appears to be working sub handle_potential_faraway { my $mail = shift(@_); $spamtest-init(1); my $msg = Mail::SpamAssassin::PerMsgStatus-new($spamtest, $mail); if ($msg-check_for_faraway_charset()) { ignore_mail($mail); } elsif ($msg-check_for_faraway_charset_in_headers())

Re: A New Approach: Find the Ham

2007-02-10 Thread Burak Ueda
Good point, but will cause trouble UNLESS we find a way to recognize ham 100%. And it must me exactly 100% (99% won't be enough). As other users said, with current system, if we can filter 70-80 of the spam, remaining 20-30% will only be an annoyance, but ham will be delivered. But with the

Re: How to Scan just incoming not outcoming emails?

2007-02-10 Thread qqqq
| So, my question is: is it possible to set Sendmail / Spam Assassin in | order filters just the receiving emails? If so, please, tell me what | to do. But, please, tell me like a cooking recipe, because I am not | quite experienced with operating systems. Thanks a lot. | | Mario./ Call SA

What does this mean? FROM_ENDS_IN_NUMS From: ends in numbers

2007-02-10 Thread dreambat
Hi, I got at test mailing spam report back with a score I had never seen before for FROM_ENDS_IN_NUMS From: ends in numbers There wasn't a number in the email from or reply, so I just didn't get this. Thanks RC

Query regarding whitelist_to

2007-02-10 Thread sushma
hi, Spam mail originated to list of user, if one user in whitelist_to then score will be neagtive so all other user also get that spam mail. how to aviod this. Regards sushma

Re: Query regarding whitelist_to

2007-02-10 Thread Theo Van Dinter
On Sun, Feb 11, 2007 at 11:36:56AM +, sushma wrote: Spam mail originated to list of user, if one user in whitelist_to then score will be neagtive so all other user also get that spam mail. how to aviod this. If you scan your mails site-wide (ie: once per message), then you can't

Re: spamassassin learning method

2007-02-10 Thread Rizal Ferdiyan
John D. Hardin wrote: On Sat, 10 Feb 2007, Rizal Ferdiyan wrote: I want to create spamassassin learning method, if my client find any spam for their email they can forward it The act of forwarding completely changes the message. Yes, i know that. Email will be add with forward