SA-Learn per remote

2010-09-16 Thread Hans-Werner Friedemann
Hi @ all sorry, but I have to pick up this issue once again. I´ve installed Spamassassin with bayes on a SuseLinux-Client. My mailserver (hmailserver) is running on a Windows machine. The Mailserver has a mailbox for spam and ham inside of themself, where Users can send mails to. I want

RE: SA-Learn per remote

2010-09-16 Thread Giampaolo Tomassoni
From: Hans-Werner Friedemann [mailto:h-w.friedem...@vds-herzberg.de] Hi @ all   sorry, but I have to pick up this issue once again.   I´ve installed Spamassassin with bayes on a SuseLinux-Client. My mailserver (hmailserver) is running on a Windows machine.   The Mailserver has a mailbox

Blacklist for spam-words

2010-09-16 Thread franc
Hello, i don't know spamassassin not very well, i am using 3.2.4 on Ubuntu 8.04 LTS. I need a textfile where i can put in blacklist-words like Viagra, Chronometer, Zeitmesser and so on, if an email has one of this words, this email should directly put to the Spam-folder. Is this possible?

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
Hello, i don't know spamassassin not very well, i am using 3.2.4 on Ubuntu 8.04 LTS. I need a textfile where i can put in blacklist-words like Viagra, Chronometer, Zeitmesser and so on, if an email has one of this words, this email should directly put to the Spam-folder. Is this

RE: Blacklist for spam-words

2010-09-16 Thread Giles Coochey
You may setup a regexp rule in the /etc/local.cf file of your SA installation, but a simple rule like the one you suggest may easily yield FPs (False Positives, ie: non-spam messages may get into your trashcan). What if a friend of yours sends you an email asking to lend your chronometer...

RE: Blacklist for spam-words

2010-09-16 Thread franc
What if a friend of yours sends you an email asking to lend your chronometer... This is very unlikely because i have none. So even if he asked, it were in vain :-) SA goes farther than your simple idea. Have a look at how Bayes works, and all the available SA plugins. I trained SA since

RE: Blacklist for spam-words

2010-09-16 Thread franc
You may setup a regexp rule in the /etc/local.cf file of your SA installation Could you give me an example, or where to find one? In the local.cf i don't find RegExp-sections. -- View this message in context: http://old.nabble.com/Blacklist-for-spam-words-tp29726548p29726801.html Sent from

Re: Blacklist for spam-words

2010-09-16 Thread Yet Another Ninja
On 2010-09-16 12:29, franc wrote: You may setup a regexp rule in the /etc/local.cf file of your SA installation Could you give me an example, or where to find one? In the local.cf i don't find RegExp-sections. see http://wiki.apache.org/spamassassin/WritingRules

Re: Expiring Bayes; aka bayes files stay BIG

2010-09-16 Thread RW
On Wed, 15 Sep 2010 19:42:44 -0400 Dennis German dger...@real-world-systems.com wrote: On Sep 15, 2010, at 1:42 PM, RW wrote: On Wed, 15 Sep 2010 11:18:20 -0400 Dennis German dger...@real-world-systems.com wrote: I believe that bayes_seen is a perl hash and will not be reduced in

Re: The most amazing spam ...

2010-09-16 Thread Martin Gregorie
On Thu, 2010-09-16 at 07:28 +0200, Per Jessen wrote: http://public.jessen.ch/files/mazeweb-spam.jpeg A cynic might wonder whether it also harvests valid e-mail addresses. Martin

RE: Blacklist for spam-words

2010-09-16 Thread Per Jessen
franc wrote: You may setup a regexp rule in the /etc/local.cf file of your SA installation Could you give me an example, or where to find one? In the local.cf i don't find RegExp-sections. body FRANCS_RULE /regexp/ /Per Jessen, Zürich

Re: The most amazing spam ...

2010-09-16 Thread Giles Coochey
On Thu, September 16, 2010 13:28, Martin Gregorie wrote: On Thu, 2010-09-16 at 07:28 +0200, Per Jessen wrote: http://public.jessen.ch/files/mazeweb-spam.jpeg A cynic might wonder whether it also harvests valid e-mail addresses. Appears to be a perfectly reputable service to me... what makes

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
SA goes farther than your simple idea. Have a look at how Bayes works, and all the available SA plugins. I trained SA since months with all those chronometer-zeitmesser-spam and only 5% is now set to spam. I want to get rid of it immediately. Well, you may try putting this into

Re: The most amazing spam ...

2010-09-16 Thread Yet Another Ninja
On 2010-09-16 13:36, Giles Coochey wrote: On Thu, September 16, 2010 13:28, Martin Gregorie wrote: On Thu, 2010-09-16 at 07:28 +0200, Per Jessen wrote: http://public.jessen.ch/files/mazeweb-spam.jpeg A cynic might wonder whether it also harvests valid e-mail addresses. Appears to be a

Re: Blacklist for spam-words

2010-09-16 Thread Matus UHLAR - fantomas
What if a friend of yours sends you an email asking to lend your chronometer... This is very unlikely because i have none. So even if he asked, it were in vain :-) SA goes farther than your simple idea. Have a look at how Bayes works, and all the available SA plugins. On 16.09.10

RE: Blacklist for spam-words

2010-09-16 Thread Giampaolo Tomassoni
You're probably too late, Matus: you've got into his trash folder... ;) From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] What if a friend of yours sends you an email asking to lend your chronometer... --^ This is very unlikely because i have none. So even if he asked, it

New release of SpamAssassin for Windows

2010-09-16 Thread Daniel Lemke
Hi there, just finished a new release of SpamAssassin for Windows (a Windows port of SpamAssassin). Most important change to the previous version is the support of Razor and some improvements to stability. However, there is still a memory leak so using it with a service tool is still

Re: The most amazing spam ...

2010-09-16 Thread Martin Gregorie
On Thu, 2010-09-16 at 13:36 +0200, Giles Coochey wrote: On Thu, September 16, 2010 13:28, Martin Gregorie wrote: On Thu, 2010-09-16 at 07:28 +0200, Per Jessen wrote: http://public.jessen.ch/files/mazeweb-spam.jpeg A cynic might wonder whether it also harvests valid e-mail addresses.

Re: Blacklist for spam-words

2010-09-16 Thread Lucio Chiappetti
On Thu, 16 Sep 2010, franc wrote: I need a textfile where i can put in blacklist-words like Viagra, Chronometer, Zeitmesser and so on, if an email has one of this words, this email should directly put to the Spam-folder. Are you sure you want to embark in a project like that and will have

Re: SA-Learn per remote

2010-09-16 Thread John Hardin
On Thu, 16 Sep 2010, Hans-Werner Friedemann wrote: I?ve installed Spamassassin with bayes on a SuseLinux-Client. My mailserver (hmailserver) is running on a Windows machine. The Mailserver has a mailbox for spam and ham inside of themself, where Users can send mails to. I want to perform a

Re: Blacklist for spam-words

2010-09-16 Thread John Hardin
On Thu, 16 Sep 2010, franc wrote: i don't know spamassassin not very well, i am using 3.2.4 on Ubuntu 8.04 LTS. I need a textfile where i can put in blacklist-words like Viagra, Chronometer, Zeitmesser and so on, if an email has one of this words, this email should directly put to the

Re: Blacklist for spam-words

2010-09-16 Thread franc
But before you go trying to play whack-a-mole with lists of poison-pill words (and deal with the FPs that result), you should try upgrading to the latest release. I would like to update spamassassin, but how? -- View this message in context:

Re: Blacklist for spam-words

2010-09-16 Thread John Hardin
On Thu, 16 Sep 2010, franc wrote: But before you go trying to play whack-a-mole with lists of poison-pill words (and deal with the FPs that result), you should try upgrading to the latest release. I would like to update spamassassin, but how? The rule for reliability is update the way you

Re: Blacklist for spam-words

2010-09-16 Thread franc
Unfortunately Canonical probably is _not_ going to provide official SA 3.3.x packages for Ubuntu 8.x... This is just what i noticed: there is no Ubuntu package update after the 3.2.4-ubu1 related to: http://packages.ubuntu.com/de/hardy/spamassassin But how then to update? Can i use a

Re: Blacklist for spam-words

2010-09-16 Thread Benny Pedersen
On tor 16 sep 2010 17:41:05 CEST, John Hardin wrote that result), you should try upgrading to the latest release. 3.2.4 is several years stale and is not getting any rule updates. Its performance _will_ deteriorate over time as the nature of spam changes. agree, but if the host os still

Re: Blacklist for spam-words

2010-09-16 Thread Benny Pedersen
On tor 16 sep 2010 17:47:12 CEST, franc wrote But before you go trying to play whack-a-mole with lists of poison-pill words (and deal with the FPs that result), you should try upgrading to the latest release. I would like to update spamassassin, but how? 42, na not this time, tell more on

Re: Blacklist for spam-words

2010-09-16 Thread Benny Pedersen
On tor 16 sep 2010 18:08:46 CEST, franc wrote http://packages.ubuntu.com/de/hardy/spamassassin But how then to update? Can i use a package for Ubuntu Maverick (10.10) or is this the absolute wrong way? ask a ubuntu maintainer, make a request for this in lunchpad seems to me next step if

Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread Karsten Bräckelmann
On Thu, 2010-09-16 at 03:26 -0700, Franc Walter(?) wrote: SA goes farther than your simple idea. Have a look at how Bayes works, and all the available SA plugins. I trained SA since months with all those chronometer-zeitmesser-spam and only 5% is now set to spam. I want to get rid of it

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread franc
... Do you train *both*, spam *and* ham? Any chance these have been trained incorrectly before? What Bayes score do they actually get? The X-Spam-Status header would be sufficient to see. The few lines of 'sa-learn --dump magic' would be good, too. Oh, and you are training Bayes as the

Re: Blacklist for spam-words

2010-09-16 Thread franc
are spamassassin the only thing you like to upgrade ? what os are you running ?, and what package managedment rpm ?, cpan ?, lastly dont mix cpan with rpm yes, spamassassin is the only thing to upgrade at the moment. I am running Ubuntu 8.04 LTS (Hardy Heron) and i installed spamassassin

RE: Blacklist for spam-words

2010-09-16 Thread franc
You're probably too late, Matus: you've got into his trash folder... ;) From: Matus UHLAR - fantomas [mailto:uh...@fantomas.sk] What if a friend of yours sends you an email asking to lend your chronometer... --^ haha, this one is good! :-) But anyway, i didn't put an i to the

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread Karsten Bräckelmann
On Thu, 2010-09-16 at 11:32 -0700, franc wrote: ... Do you train *both*, spam *and* ham? Any chance these have been trained incorrectly before? What Bayes score do they actually get? The X-Spam-Status header would be sufficient to see. The few lines of 'sa-learn --dump magic' would be

Re: Blacklist for spam-words

2010-09-16 Thread Benny Pedersen
On tor 16 sep 2010 20:37:07 CEST, franc wrote yes, spamassassin is the only thing to upgrade at the moment. I am running Ubuntu 8.04 LTS (Hardy Heron) and i installed spamassassin with aptitude. then i will suggest to try here https://launchpad.net/hardy-backports make a request for upgrade

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread franc
OK, i put now till i am sure there is no more FP the threshold on -, 5, 10, 15 so between 5 and 10 it is delivered into the spam-folder, and with 10 it is bounced. I think after a while i will know if i can put 2,5,6.31,10 or something like this. Thank you for the hints! -- View this message

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread Karsten Bräckelmann
On Thu, 2010-09-16 at 14:19 -0700, franc wrote: OK, i put now till i am sure there is no more FP the threshold on -, 5, 10, 15 so between 5 and 10 it is delivered into the spam-folder, and with 10 it is bounced. I think after a while i will know if i can put 2,5,6.31,10 or something like

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread franc
I seriously hope you just mis-worded that. Bounce!? That would be after *accepting* a message, and with spam generally will be bounced to a forged, innocent bystander -- not the spammer. So please, tell me you actually meant to say REJECT. That is, not accept by the MX. No, i didn't know it

Yahoo HTML Base64 Attachments

2010-09-16 Thread Chris Owen
We're seeing a lot of what I assume are exploit files coming from yahoo.com. They are all base64 encoded HTML attachments with a bunch of javascript in them. http://pastebin.com/ZSmW0kwW I've gone ahead and put a pretty high scoring rule in place to block things that are: 1) From yahoo.com

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread Karsten Bräckelmann
On Thu, 2010-09-16 at 15:10 -0700, franc wrote: I seriously hope you just mis-worded that. Bounce!? That would be after *accepting* a message, and with spam generally will be bounced to a forged, innocent bystander -- not the spammer. So please, tell me you actually meant to say REJECT.

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread franc
The next thing i just discovered is: $final_bad_header_destiny = D_PASS; with this rule, each Subject, containing 8-Bit, is sent to the quarantine folder. I didn't know this and now i am discovering many emails in the quarantine which were no spam at all :-) I commented it out: #

Re: Blacklist for spam-words

2010-09-16 Thread Sergey Tsabolov ( aka linuxman )
Hi , in you sources.list you have 2 lines #deb http://archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse #deb-src http://archive.ubuntu.com/ubuntu/ hardy-backports main restricted universe multiverse Uncomment that lines and try to apt-get update apt-get upgrade

Re: Identifying the real problem (was: Re: Blacklist for spam-words)

2010-09-16 Thread Benny Pedersen
On tor 16 sep 2010 23:19:34 CEST, franc wrote OK, i put now till i am sure there is no more FP the threshold on -, 5, 10, 15 so between 5 and 10 it is delivered into the spam-folder, and with 10 it is bounced. rejected please, eg dont accept and bouce -- xpoint

Re: SpamAssassin version 3.2.5

2010-09-16 Thread Karsten Bräckelmann
On Fri, 2010-09-17 at 01:57 +0300, Sergey Tsabolov wrote: I Just upgrade my SpamAssassin to version 3.2.5 Can some one tell me if the SpamAssassin rules files is up to date or is older with this version : 5682 2010-01-02 17:23 10_default_prefs.cf Jan 2 2010

Re: SpamAssassin version 3.2.5

2010-09-16 Thread Sergey Tsabolov ( aka linuxman )
στις 17/09/2010 02:15 πμ, O/H Karsten Bräckelmann έγραψε: On Fri, 2010-09-17 at 01:57 +0300, Sergey Tsabolov wrote: I Just upgrade my SpamAssassin to version 3.2.5 Can some one tell me if the SpamAssassin rules files is up to date or is older with this version : 5682 2010-01-02 17:23

Looking for a How To to build Spamassassin+ClamAV mail filter

2010-09-16 Thread IT_Architect
We currently have this combination as part of our control panel with Exim, SpamAssassin, and ClamAV. I would like to be able to offer this as an e-mail scrubbing service that would allow the customer to register only his domain. Then he would make his lowest-cost MX our server. We would bring

Re: Looking for a How To to build Spamassassin+ClamAV mail filter

2010-09-16 Thread Karsten Bräckelmann
On Thu, 2010-09-16 at 16:29 -0700, IT_Architect wrote: We currently have this combination as part of our control panel with Exim, SpamAssassin, and ClamAV. I would like to be able to offer this as an e-mail scrubbing service that would allow the customer to register only his domain. Then he

Re: Yahoo HTML Base64 Attachments

2010-09-16 Thread Benny Pedersen
On fre 17 sep 2010 00:30:27 CEST, Chris Owen wrote 1) From yahoo.com 2) Have a HTML attachment 3) Are base64 encoded My question is how important is #1. check dkim if its signed by yahoo there is better chances thay listing :) I'd think a HTML attachment is a little unusual period but how

Re: Looking for a How To to build Spamassassin+ClamAV mail filter

2010-09-16 Thread John Hardin
On Thu, 16 Sep 2010, IT_Architect wrote: We currently have this combination as part of our control panel with Exim, SpamAssassin, and ClamAV. I would like to be able to offer this as an e-mail scrubbing service that would allow the customer to register only his domain. Then he would make

Re: Looking for a How To to build Spamassassin+ClamAV mail filter

2010-09-16 Thread IT_Architect
I gather from all of this you don't know how to build such a filter nor know of a How To I'm buying this type of service now from DynDNS that uses this combination and it works quite well. -- View this message in context:

RE: Looking for a How To to build Spamassassin+ClamAV mail filter

2010-09-16 Thread Brent Kennedy
You're asking for help, being rude about it will not get you very far. Little google search foo: http://www.section6.net/wiki/index.php/Setting_up_Postfix_Spamassassin_Amavi sd_Clamav Without avis: http://www.xtarutaru.com/2009/04/16/spamassassin-clamav-postfix-without-amav is-debian/ There

RE: Spamassassing not doing DNSBL lookup

2010-09-16 Thread Milind Patil
Hi I run spamassassin via MailScanner and in the MailScanner I have enabled the DNSBL check. Regards Milind Patil -Original Message- From: John Hardin [mailto:jhar...@impsec.org] Sent: 14 September 2010 11:37 To: users@spamassassin.apache.org Subject: Re: Spamassassing not