Two servers, one database. A question

2009-02-12 Thread Lindsay Haisley
I have two servers. Currently they're both running instances of spamd with separate mysql databases, however I'd like run both instances from the same database on one of the servers. There are two ways to do this: 1. I can give the -d option to spamc where it's invoked in the mail system, with t

Re: Last-5-percent tuning

2009-02-12 Thread Martin Gregorie
On Thu, 2009-02-12 at 16:04 -0600, McDonald, Dan wrote: > On Thu, 2009-02-12 at 19:10 +, Martin Gregorie wrote: > > On Thu, 2009-02-12 at 12:50 -0500, Kris Deugau wrote: > > Is there any way that greylisting can be implemented that would allow > > users to opt in/out of it on a per-account basi

Re: please help, getting hammered with snowshoe spam

2009-02-12 Thread Chip M.
Rob McEwen wrote: >(2) ivmSIP/24 is attempting a very dangerous mission... which is to >preemptively block snowshoe spam by listing entire /24 blocks when >only a handful of IPs on that block have sent spam so far. But keep >in mind that (a) specifically--ivmSIP is going to block some spam >where t

Re: please help, getting hammered with snowshoe spam

2009-02-12 Thread Chip M.
While reading the "html picture spam" thread, it occurred to me to check the sizes of Ham hitting Barracuda. The largest one was 113,351 bytes. I then checked the nation-of-origin for all Barracuda hitting "large" spams (msg size >= 256 kb), and (during the 3-week period I checked) only 4 out of

Re: Last-5-percent tuning

2009-02-12 Thread McDonald, Dan
On Thu, 2009-02-12 at 19:10 +, Martin Gregorie wrote: > On Thu, 2009-02-12 at 12:50 -0500, Kris Deugau wrote: > Is there any way that greylisting can be implemented that would allow > users to opt in/out of it on a per-account basis? sqlgrey supports opt-out/opt-in models. It's a database tab

Re: system response message backlash from spam messages

2009-02-12 Thread mouss
Matt Garretson a écrit : > Ned Slider wrote: >> how much faith >> do you place in a mail admin deploying SPF _AND_ bouncing messages on >> SPF failure when they can't even address the issue that their servers >> are responsible for the backscatter problem > > > I think that you may be assumin

Re: system response message backlash from spam messages

2009-02-12 Thread mouss
John Hardin a écrit : > On Thu, 12 Feb 2009, Ned Slider wrote: > >> John Hardin wrote: >> >>> Huh? My mail server relays messages from my home network to the entire >>> world. I'm not talking about custom relays. >> >> I think I'm going to have to concede this point to you though on >> relays, a

Re: system response message backlash from spam messages

2009-02-12 Thread mouss
John Hardin a écrit : > On Wed, 11 Feb 2009, Ned Slider wrote: > >> John Hardin wrote: >> >>> > You won't solve the backscatter problem with SPF. >>> >>> Nobody has claimed that. It helps, but it's not a silver bullet. >> I have seen no evidence of that (that = "it helps"). and yes, I asked: thi

Re: Last-5-percent tuning

2009-02-12 Thread Kai Schaetzl
Jesse Stroik wrote on Thu, 12 Feb 2009 11:18:03 -0600: > Of course not. Of course, yes. It helped tremendously in the first years and still does. Not so good, but still. > > Do you use any MTA-level DNSBLs? > > > No. If you have ample of ressources you can do this. If you are getting tentho

RE: help with scores

2009-02-12 Thread Bowie Bailey
Karsten Bräckelmann wrote: > On Thu, 2009-02-12 at 09:17 -0800, Ricardo Kleemann wrote: > > score URIBL_BLACK 0 2.5 0 2.0 # n=0 n=2 > > score BAYES_99 0 0 4.0 4.0 > > > > However, I'm getting messages that hit both URIBL_BLACK and BAYES_99 > > and have a score of 6.0. How can that be (I would expe

Re: Last-5-percent tuning

2009-02-12 Thread John Hardin
On Thu, 12 Feb 2009, Martin Gregorie wrote: Is there any way that greylisting can be implemented that would allow users to opt in/out of it on a per-account basis? Sure. Have them send you an email with the opt-out request and edit the config file when you get it. :) http://www.decf.berke

Re: Spamassassin not working after upgrade

2009-02-12 Thread nycsurf
> Can you post the procmail ruleset that tries to run spamassassin? I've been trying several different rulesets. Here's the latest: LOGFILE=/home/gjw10/mail/maillog VERBOSE=on PATH=/bin:/usr/bin:/usr/local/bin SHELL=/bin/sh :0wf | /usr/bin/spamassassin :0: * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*

Re: Spamassassin not working after upgrade

2009-02-12 Thread John Hardin
On Thu, 12 Feb 2009, nycsurf wrote: Spamassassin correctly identifies the sample spam message when I do spamassassin -D < /usr/share/doc/spamassassin-3.2.5/sample-spam.txt Does /usr/bin/spamassassin behave properly from the command line? {sorry for two messages} procmail: Executing "/usr/b

Re: Spamassassin not working after upgrade

2009-02-12 Thread Karsten Bräckelmann
> I recently upgraded to spamassassin-3.2.5-1.el5 using up2date and > spamassassin is no longer filtering messages. Spamassassin correctly > identifies the sample spam message when I do [...] > I've googled extensively to see if anyone else is having this problem and > what possible solutions might

Re: Last-5-percent tuning

2009-02-12 Thread Kris Deugau
(Please keep this on-list, no need to CC me. Reply-to and M-F-T set accordingly.) Jesse Stroik wrote: I wasn't clear. I'm suggesting the user delete them. I'm getting the impression you haven't spent much time in an ISP helpdesk role. A *lot* of the complainers are on dialup. Telling th

Re: Last-5-percent tuning

2009-02-12 Thread Martin Gregorie
On Thu, 2009-02-12 at 12:50 -0500, Kris Deugau wrote: > John Hardin wrote: > > Do you greylist? > > Not currently. I'm not sure it's a useful option for a core ISP mail > system, either; a LOT of the more vocal customers are the ones who > expect email email to approximate instant messaging...

Re: Spamassassin not working after upgrade

2009-02-12 Thread John Hardin
On Thu, 12 Feb 2009, nycsurf wrote: Here is the relevant part of the log file for a sample email after turning the verbose option on in .procmailrc: procmail: Assigning "DROPPRIVS=yes" procmail: Assuming identity of the recipient, VERBOSE=off procmail: Assigning "PATH=/bin:/usr/bin:/usr/local/b

Spamassassin not working after upgrade

2009-02-12 Thread nycsurf
Hello, I recently upgraded to spamassassin-3.2.5-1.el5 using up2date and spamassassin is no longer filtering messages. Spamassassin correctly identifies the sample spam message when I do spamassassin -D < /usr/share/doc/spamassassin-3.2.5/sample-spam.txt from the command line, but it does not t

Re: Last-5-percent tuning

2009-02-12 Thread John Hardin
On Thu, 12 Feb 2009, Jesse Stroik wrote: John Hardin wrote: On Thu, 12 Feb 2009, Kris Deugau wrote: > What do you do to push that last 5% or so of missed spam over the > threshold from nonspam to spam? Do you greylist? Of course not. The assumption that spammers cannot follow RFCs is

Re: Last-5-percent tuning

2009-02-12 Thread Jesse Stroik
Kris Deugau wrote: Jesse Stroik wrote: You don't. Hit delete. Sorry, there aren't enough of me to hand-filter 30K ISP user accounts. I wasn't clear. I'm suggesting the user delete them. Overaggressive spam filters that get false positives are much more dangerous to email than spam.

Re: Last-5-percent tuning

2009-02-12 Thread Robert Schetterer
Kris Deugau schrieb: > John Hardin wrote: >> Do you greylist? > > Not currently. I'm not sure it's a useful option for a core ISP mail > system, either; a LOT of the more vocal customers are the ones who > expect email email to approximate instant messaging... :/ do selective greylisting look

Re: Last-5-percent tuning

2009-02-12 Thread Kris Deugau
John Hardin wrote: Do you greylist? Not currently. I'm not sure it's a useful option for a core ISP mail system, either; a LOT of the more vocal customers are the ones who expect email email to approximate instant messaging... :/ Do you use any MTA-level DNSBLs? zen. But that doesn't

Re: Last-5-percent tuning

2009-02-12 Thread Kris Deugau
Jesse Stroik wrote: You don't. Hit delete. Sorry, there aren't enough of me to hand-filter 30K ISP user accounts. Unfortunately I'm getting reports that the current catch rate is closer to 50% on a number of accounts - of course, without reporting of some kind I can't do much to improve tha

Re: help with scores

2009-02-12 Thread Karsten Bräckelmann
On Thu, 2009-02-12 at 09:17 -0800, Ricardo Kleemann wrote: > score URIBL_BLACK 0 2.5 0 2.0 # n=0 n=2 > score BAYES_99 0 0 4.0 4.0 > > However, I'm getting messages that hit both URIBL_BLACK and BAYES_99 > and have a score of 6.0. How can that be (I would expect 6.5)? The score of 6 is correct. Bo

URI with spaces are not recognized

2009-02-12 Thread Franz Schwartau
Hi! A lot of spams arrives here with URI like strings containing spaces, e.g.: www . abcdef . net After reading the source for a while I found that $schemelessRE in line 1720 of Mail::SpamAssassin::PerMsgStatus.pm seems to be responsible for that. Unfortunally this regexp doesn't care about whi

Re: Last-5-percent tuning

2009-02-12 Thread Jesse Stroik
John Hardin wrote: On Thu, 12 Feb 2009, Kris Deugau wrote: What do you do to push that last 5% or so of missed spam over the threshold from nonspam to spam? Do you greylist? Of course not. The assumption that spammers cannot follow RFCs is a silly one. There are a variety of greylisting

help with scores

2009-02-12 Thread Ricardo Kleemann
Hi, I made some changes to the scores of a few rules and included in my local.cf file. For example: score URIBL_BLACK 0 2.5 0 2.0 # n=0 n=2 score BAYES_99 0 0 4.0 4.0 However, I'm getting messages that hit both URIBL_BLACK and BAYES_99 and have a score of 6.0. How can that be (I would expect

Re: Last-5-percent tuning

2009-02-12 Thread John Hardin
On Thu, 12 Feb 2009, Kris Deugau wrote: What do you do to push that last 5% or so of missed spam over the threshold from nonspam to spam? Do you greylist? Do you use any MTA-level DNSBLs? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALahol

Re: Last-5-percent tuning

2009-02-12 Thread Jesse Stroik
Kris Deugau wrote: What do you do to push that last 5% or so of missed spam over the threshold from nonspam to spam? You don't. Hit delete. If AI is ever truly developed, then your computer may be able to more accurately determine spam from nonspam, but for a lot of spam where spamassassi

Last-5-percent tuning

2009-02-12 Thread Kris Deugau
What do you do to push that last 5% or so of missed spam over the threshold from nonspam to spam? Things already done: -> I autoupdate Justin Mason's "sought" ruleset daily -> I update the core rules on an irregular basis (although it averages out to at least once a week - usually at the same t

Re: system response message backlash from spam messages

2009-02-12 Thread Matt Garretson
Ned Slider wrote: > how much faith > do you place in a mail admin deploying SPF _AND_ bouncing messages on > SPF failure when they can't even address the issue that their servers > are responsible for the backscatter problem I think that you may be assuming too much about the way other people