Re: mass-check wiki page needs updating..

2008-01-31 Thread Justin Mason
Matt Kettler writes: Theo Van Dinter wrote: On Wed, Jan 30, 2008 at 03:07:43PM +, Justin Mason wrote: The big question is, where do the devs think folks should go to get it? from SVN directly, I guess. http://svn.apache.org/repos/asf/spamassassin/trunk/masses ...

Re: mass-check wiki page needs updating..

2008-01-31 Thread Yet Another Ninja
On 1/31/2008 11:38 AM, Justin Mason wrote: Matt Kettler writes: Theo Van Dinter wrote: On Wed, Jan 30, 2008 at 03:07:43PM +, Justin Mason wrote: The big question is, where do the devs think folks should go to get it? from SVN directly, I guess.

Re: Japanese emails being triggered as Spam incorrectly...

2008-01-31 Thread Karsten Bräckelmann
On Thu, 2008-01-31 at 13:30 +1000, David Hobley wrote: I have a very bizarre issue here - we use Zimbra and its' built in SpamAssassin to manage our Spam - we get a lot of Japanese emails in, so I have configured ok_languages en jp

Re: mass-check wiki page needs updating..

2008-01-31 Thread Matt Kettler
Justin Mason wrote: quick survey: Is anyone using mass-check without previously having SVN set up? Is this turning out to be a major barrier? Should we put mass-check back into the distro? Good survey, although I highly doubt anyone is using it that wouldn't be able to get it from SVN with

Re: mass-check wiki page needs updating..

2008-01-31 Thread Theo Van Dinter
On Thu, Jan 31, 2008 at 10:38:03AM +, Justin Mason wrote: Is this turning out to be a major barrier? FWIW, there are at least two easy ways to get a full trunk download w/ mass-check and everything else: svn co http://svn.apache.org/repos/asf/trunk download a tarball from

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread jp
Another option, if you are using postfix, is to setup mydomain.com as a virtual. Then in /etc/postfix/virtuals, you can mydomain.com virtual @mydomain.com [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] and so on... You can ommit the wildcard one if

Re: mass-check wiki page needs updating..

2008-01-31 Thread Larry Nedry
On 1/31/08 at 10:38 AM + Justin Mason wrote: Is anyone using mass-check without previously having SVN set up? Yes, I am. I don't know what's involved in using SVN but I did look at the SVN tree via the web and at first and second look, it wasn't obvious how to use the web to easily download

Re: mass-check wiki page needs updating..

2008-01-31 Thread Theo Van Dinter
On Wed, Jan 30, 2008 at 12:07:03PM -0600, Larry Nedry wrote: Is mass-check currently under development? Yes and no. The masses directory, and therefore mass-check, are open for development at any time. I don't think there's a lot of working going on at any given time though. Where is the

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread mouss
jp wrote: Another option, if you are using postfix, is to setup mydomain.com as a virtual. Then in /etc/postfix/virtuals, you can mydomain.com virtual @mydomain.com [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] and so on... You can ommit the

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Arthur Dent
On Wed, Jan 30, 2008 at 09:56:49PM +0100, Karsten Bräckelmann wrote: On Wed, 2008-01-30 at 20:12 +, Arthur Dent wrote: On Wed, Jan 30, 2008 at 08:22:55PM +0100, Karsten Bräckelmann wrote: Sorry Chaps, I had no idea this topic would grow so much. Do file-locking, when delivering to

Re: Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread Dallas Engelken
John Hardin wrote: On Tue, 2008-01-29 at 15:25 -0800, John Hardin wrote: On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: Perhaps Verizon is screwing up their DNS? Ahh, yes they are: http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this

Bulk spam scan

2008-01-31 Thread Martin Gregorie
I need to scan a set of archived mbox files for spam, mark the messages appropriately, and save them in a second mbox file. Should the following command do what I want? spamassassin --mbox mbox scanned.mbox I'm currently running spamc/spamd and know that works strictly one message at a time, but

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Arthur Dent
Apologies to everyone for wasting OT bandwidth. I have just re-read man procmailrc and realised that a copy recipe is not considered to be a delivery action and therefore does not need a lock. Removing the lock from my backup copy solves the problem. I just want to thank everyone for their

Re: Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread John Hardin
On Thu, 31 Jan 2008, Dallas Engelken wrote: Or better yet, just fix the URIBLDNS plugin code to expect responses matching ^127\. Anything else is a dns monetizer. Do any of the DNSBLs or URIBLs that return bitmapped results bitmap into the first octet? If not, then this sounds like the

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Arthur Dent
On Thu, Jan 31, 2008 at 09:36:29PM +0100, Karsten Bräckelmann wrote: On Thu, 2008-01-31 at 19:31 +, Arthur Dent wrote: Apologies to everyone for wasting OT bandwidth. I have just re-read man procmailrc and realised that a copy recipe is not considered to be a delivery action and

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Karsten Bräckelmann
Since I was about to hit the send button on this one, here is a shorter version of my original thoughts. Partially on-topic (yay!) again. ;) Fantastic! This worked perfectly out of the box! (just edited mydomain). Good. :) Thank you Guenther! When I moved it from my test rig to the live

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Karsten Bräckelmann
On Thu, 2008-01-31 at 19:31 +, Arthur Dent wrote: Apologies to everyone for wasting OT bandwidth. I have just re-read man procmailrc and realised that a copy recipe is not considered to be a delivery action and therefore does not need a lock. Uhm, where did you read that? Clearly, even a

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Arthur Dent
On Thu, Jan 31, 2008 at 09:48:20PM +0100, Karsten Bräckelmann wrote: Since I was about to hit the send button on this one, here is a shorter version of my original thoughts. Partially on-topic (yay!) again. ;) Oops - I was busy replying to your last message and didn't see this one come in...

Re: Help with SA / Procmail regex [OT] - Back On-Topic (Almost!)

2008-01-31 Thread Arthur Dent
On Thu, Jan 31, 2008 at 09:18:38PM +, Arthur Dent wrote: I've just been doing a little reading.. # Spam filter :0fw * 256000 | /usr/bin/spamc --username=mark If there is even the slightest chance, your MTA might flood your MDA with mail during a peek -- add some

Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread David Zinder
What should dig return? I too have Verizon fios. If /etc/resolve.conf contains their DNS servers I get similar dig results as you. If I change it to DNS servers I trust I get: $ dig techweb.com.multi.surbl.org ; DiG 9.2.4 techweb.com.multi.surbl.org ;; global options: printcmd ;; Got

DNS hijacking (was: Can anyone help me? surbl.org FP problems?)

2008-01-31 Thread SM
At 11:40 31-01-2008, John Hardin wrote: Do any of the DNSBLs or URIBLs that return bitmapped results bitmap into the first octet? If not, then this sounds like the best solution, even though it doesn't give the administrator any feedback that DNS hijacking is taking place... This hijacking

Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread David B Funk
On Thu, 31 Jan 2008, David Zinder wrote: What should dig return? I too have Verizon fios. If /etc/resolve.conf contains their DNS servers I get similar dig results as you. If I change it to DNS servers I trust I get: $ dig techweb.com.multi.surbl.org ; DiG 9.2.4

Re: Help with SA / Procmail regex - Back On-Topic

2008-01-31 Thread Karsten Bräckelmann
If there is even the slightest chance, your MTA might flood your MDA with mail during a peek -- add some explicit locking here, even though this is not a delivery receipt (explicit, because it is a filter, and procmail can't lock the target file). IIRC the SA docs do have a lock

Re: Help with SA / Procmail regex [OT] - Back On-Topic (Almost!)

2008-01-31 Thread John Hardin
On Thu, 31 Jan 2008, Arthur Dent wrote: http://www.issociate.de/board/post/232336/Lock_failure_on_%22spamc.lock%22.html and http://www.ii.com/internet/robots/procmail/qs/#SA which tend to suggest that one should NOT put a lock on for SA processing... A lock file is not *needed* for spamc

Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread Daryl C. W. O'Shea
David Zinder wrote: Is this a correct response from dig? If so, changing the DNS servers in /etc/resolve.conf does not fix my problem. The techweb.com email is still reported on the blocklists. Did you restart SA after editing resolv.conf? I have also tried dig from two other email servers

Re: Bulk spam scan

2008-01-31 Thread Kris Deugau
Martin Gregorie wrote: I need to scan a set of archived mbox files for spam, mark the messages appropriately, and save them in a second mbox file. Should the following command do what I want? spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning;

Re: Help with SA / Procmail regex [OT]

2008-01-31 Thread Karsten Bräckelmann
NOTE I just realized I used consecutive a couple times in my previous posts, whereas I did mean to say concurrent. Bad, bad screw up. Sorry for any confusion caused. On Thu, 2008-01-31 at 20:57 +, Arthur Dent wrote: On Thu, Jan 31, 2008 at 09:36:29PM +0100, Karsten Bräckelmann

Re: Help with SA / Procmail regex - Back On-Topic

2008-01-31 Thread Arthur Dent
On Thu, Jan 31, 2008 at 11:35:17PM +0100, Karsten Bräckelmann wrote: If there is even the slightest chance, your MTA might flood your MDA with mail during a peek -- add some explicit locking here, even though this is not a delivery receipt (explicit, because it is a filter, and

Re: Help with SA / Procmail regex - Back On-Topic

2008-01-31 Thread Karsten Bräckelmann
On Thu, 2008-01-31 at 22:57 +, Arthur Dent wrote: On Thu, Jan 31, 2008 at 11:35:17PM +0100, Karsten Bräckelmann wrote: Thanks for this. I appreciate you taking the time to explain this. I respect your opinion so I have the locks in place just as you suggest. Incidentally, with those

Re: DNS hijacking

2008-01-31 Thread Rob McEwen
Better yet, avoid being a victim of dns hijacking by accessing SURBL URIBL (and other dnsbls!) via RSYNC. If implemented correctly, this will result in performance gains as well! --Rob McEwen

Re: Bulk spam scan

2008-01-31 Thread Martin Gregorie
spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do? Not what I expected, evidently. If I accidentally mangled

Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread Matt Kettler
David Zinder wrote: What should dig return? I too have Verizon fios. If /etc/resolve.conf contains their DNS servers I get similar dig results as you. If I change it to DNS servers I trust I get: $ dig techweb.com.multi.surbl.org ; DiG 9.2.4 techweb.com.multi.surbl.org ;; global options:

Re: Bulk spam scan

2008-01-31 Thread Matt Kettler
Martin Gregorie wrote: spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do? Not what I expected,

Re: Bulk spam scan

2008-01-31 Thread Matt Kettler
Matt Kettler wrote: Martin Gregorie wrote: spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do? Not

Re: Bulk spam scan

2008-01-31 Thread Theo Van Dinter
On Thu, Jan 31, 2008 at 05:53:57PM -0500, Kris Deugau wrote: No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. Huh? SA, and spamassassin specifically, certainly does handle splitting up mbox files

Re: Bulk spam scan

2008-01-31 Thread mouss
Martin Gregorie wrote: spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do? Not what I expected,

Re: Bulk spam scan

2008-01-31 Thread Theo Van Dinter
On Thu, Jan 31, 2008 at 07:23:19PM +, Martin Gregorie wrote: I need to scan a set of archived mbox files for spam, mark the messages appropriately, and save them in a second mbox file. Should the following command do what I want? spamassassin --mbox mbox scanned.mbox Yes, though you can

Re: Bulk spam scan

2008-01-31 Thread Theo Van Dinter
On Thu, Jan 31, 2008 at 07:22:48PM -0500, Matt Kettler wrote: Ok, open mouth, insert foot.. there *IS* a --mbox option to spamassassin in the 3.2 branch. I'm not sure if it will output in mbox format.. you can give it a shot and see if the new mailbox file works.. Yes, yes it will. The

Re: Bulk spam scan

2008-01-31 Thread Bookworm
Theo Van Dinter wrote: --mbox Specify that the input message(s) are in mbox format. mbox is a standard Unix message folder format. [...] To pick a very small nit - 'mbox' isn't referring to a folder. It's a file. 'maildir' could be called a folder format.

Re: Bulk spam scan

2008-01-31 Thread Theo Van Dinter
On Thu, Jan 31, 2008 at 06:47:43PM -0600, Bookworm wrote: To pick a very small nit - 'mbox' isn't referring to a folder. It's a file. That depends if you're defining folder == directory, or if you're using the standard MUA definition of folder which is just a place to store messages. --

Creating meta rule

2008-01-31 Thread Robert Fitzpatrick
Looking at my stats I see those hitting LONGWORDS and scoring BAYES_50 or higher are all big time spam that have been hard to catch, see my posts earlier this week 'bayes and celeb spam'. Would it be a bad idea to add to the score when both hit? It looks like a score of 3.5 will be needed for the

Re: Bayes and celebrity spam

2008-01-31 Thread Chris
On Tuesday 29 January 2008 7:51 pm, Robert Fitzpatrick wrote: http://esmtp.webtent.net/test2.txt I have gone through my debug, but can't seem to spot any problems. How can one send debug output to file? And what do you think I should be looking for given the results of my test? FWIW, on my