Re: Bayes learning for legitimate users

2015-03-14 Thread Matthias Leisi
> > Am 14.03.2015 um 16:45 schrieb Matus UHLAR - fantomas : > ...but as I mentioned before, training spam from mail to non-existent > recipients may be even a good thing… I would not train from mail to non-existent recipients, but would restrict to a defined set of spamtraps (which may have bee

Re: Which milter do you prefer?

2015-03-14 Thread Noel Butler
Doesn't always mean nobody's home, I have great hesitation in using something that releases often, its an indication the developer(s) are hopeless, especially if its constant bug fixes - you only need to look at phpmy as an example, it used to be good, but in recent years, dev_#1 brought on

Re: Which milter do you prefer?

2015-03-14 Thread Greg Troxel
"@lbutlr" writes: > On 13 Mar 2015, at 17:54 , Greg Troxel wrote: >> Currently I'm using spamass-milter, which seems to have been teetering >> on the edge of unmaintained, although the 0.4.0 release on 2014-09-11 >> staved that off for a while. Note that the previous release was >> 2006-04-05

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread David F. Skoll
On Sat, 14 Mar 2015 20:45:16 +0100 Robert Schetterer wrote: > In the last ten years i saw a handfull of these, but ok, perhaps > different at your site. Mostly they're spams with the payload in a PDF document, a Word document or an image. Very occasionally, we see ones where the plain-text is p

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread Robert Schetterer
Am 14.03.2015 um 20:22 schrieb David F. Skoll: > On Sat, 14 Mar 2015 20:17:27 +0100 > Robert Schetterer wrote: > >> Ok, but big spam mails are extrem rare, i wouldnt invest time in that > > They are quite rare, but common enough IMO that our customers would be > annoyed if we didn't scan them. >

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread David F. Skoll
On Sat, 14 Mar 2015 20:17:27 +0100 Robert Schetterer wrote: > Ok, but big spam mails are extrem rare, i wouldnt invest time in that They are quite rare, but common enough IMO that our customers would be annoyed if we didn't scan them. Regards, David.

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread Robert Schetterer
Am 14.03.2015 um 18:11 schrieb Reindl Harald: > > > Am 14.03.2015 um 18:01 schrieb Robert Schetterer: >> Am 14.03.2015 um 17:55 schrieb David F. Skoll: >>> On Sat, 14 Mar 2015 17:08:50 +0100 >>> Reindl Harald wrote: >>> Am 14.03.2015 um 17:00 schrieb Kevin A. McGrail: > On 3/14/2015 1:1

Re: Which milter do you prefer?

2015-03-14 Thread Kevin A. McGrail
On 3/14/2015 1:31 PM, Reindl Harald wrote: hm - that's all additional layers leading to more complexity couldn't SA at the end internally cut the message after configuration value XX size for scanning while add the headers to the unaltered version? Sure but I have lots of feature requests a

Re: Which milter do you prefer?

2015-03-14 Thread Reindl Harald
Am 14.03.2015 um 18:27 schrieb Kevin A. McGrail: On 3/14/2015 12:08 PM, Reindl Harald wrote: how do you truncate messages for the scan? I use MD and pass the load average for the box to the milter. From there, depending on the load average, I chop large messages to be smaller and send them to

Re: Which milter do you prefer?

2015-03-14 Thread Kevin A. McGrail
On 3/14/2015 12:08 PM, Reindl Harald wrote: how do you truncate messages for the scan? I use MD and pass the load average for the box to the milter. From there, depending on the load average, I chop large messages to be smaller and send them to SA for classification. We then use the score an

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread David F. Skoll
On Sat, 14 Mar 2015 18:01:10 +0100 Robert Schetterer wrote: > define oversize..., It's configurable, obviously. > cutting mail content may not allowed in many countries, Ummm... WTF? We cut what we pass to SpamAssassin. We don't actually alter the original message. That is either accepted,

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread Reindl Harald
Am 14.03.2015 um 18:01 schrieb Robert Schetterer: Am 14.03.2015 um 17:55 schrieb David F. Skoll: On Sat, 14 Mar 2015 17:08:50 +0100 Reindl Harald wrote: Am 14.03.2015 um 17:00 schrieb Kevin A. McGrail: On 3/14/2015 1:14 AM, David B Funk wrote: truncating a large message and only passing t

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread Kevin A. McGrail
On 3/14/2015 1:01 PM, Robert Schetterer wrote: define oversize..., cutting mail content may not allowed in many countries, most legal policy, is reject ( at income smtp level ) or pass , tag passed mail is allowed if the reciept accepts this We are talking about modifying a stateful copy of the e

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread Robert Schetterer
Am 14.03.2015 um 17:55 schrieb David F. Skoll: > On Sat, 14 Mar 2015 17:08:50 +0100 > Reindl Harald wrote: > >> Am 14.03.2015 um 17:00 schrieb Kevin A. McGrail: >>> On 3/14/2015 1:14 AM, David B Funk wrote: truncating a large message and only passing the first N-KB to SA. As that involv

Handling very large messages (was Re: Which milter do you prefer?)

2015-03-14 Thread David F. Skoll
On Sat, 14 Mar 2015 17:08:50 +0100 Reindl Harald wrote: > Am 14.03.2015 um 17:00 schrieb Kevin A. McGrail: > > On 3/14/2015 1:14 AM, David B Funk wrote: > >> truncating a large message and > >> only passing the first N-KB to SA. As that involves munging MIME > >> headers it has to be done inside

Re: Which milter do you prefer?

2015-03-14 Thread Reindl Harald
Am 14.03.2015 um 17:00 schrieb Kevin A. McGrail: On 3/14/2015 1:14 AM, David B Funk wrote: truncating a large message and only passing the first N-KB to SA. As that involves munging MIME headers it has to be done inside the milter. I just truncate the message hard and it generally works bett

Re: Which milter do you prefer?

2015-03-14 Thread Kevin A. McGrail
On 3/14/2015 1:14 AM, David B Funk wrote: truncating a large message and only passing the first N-KB to SA. As that involves munging MIME headers it has to be done inside the milter. I just truncate the message hard and it generally works better than not scanning. What do you do to truncate?

Re: Bayes learning for legitimate users

2015-03-14 Thread Matus UHLAR - fantomas
On 14.03.15 15:00, Filip Havlíček wrote: I manage email through ISPConfig, I think wildcard for any domain is not set. seems you have relay_recipient_maps set, isn't your domain listed there? note that postfix rejects non-existing recipients by default (http://www.postfix.org/postconf.5.html#sm

Re: Bayes learning for legitimate users

2015-03-14 Thread Filip Havlíček
I manage email through ISPConfig, I think wildcard for any domain is not set. Dne 13.3.2015 v 16:02 Matus UHLAR - fantomas napsal(a): Filip Havlí?ek wrote: I would like to ask you, how can I *allow **only **legitimate* email addresses (existing users) for bayes learning? On 13.03.15 14:54, F

Re: Which milter do you prefer?

2015-03-14 Thread Reindl Harald
Am 14.03.2015 um 14:08 schrieb sha...@shanew.net: On Fri, 13 Mar 2015, David B Funk wrote: Looking at the source for spamass-milter it looks like they're taking the "-p socket" argument and passing it directly to smfi_setconn so you should be able to give an INET socket address if you use the

Re: Which milter do you prefer?

2015-03-14 Thread shanew
On Fri, 13 Mar 2015, David B Funk wrote: Looking at the source for spamass-milter it looks like they're taking the "-p socket" argument and passing it directly to smfi_setconn so you should be able to give an INET socket address if you use the correct syntax (see docs for smfi_setconn). The sp

Re: Which milter do you prefer?

2015-03-14 Thread shanew
I just came across that in my searching yesterday, but hadn't had a chance to dig deeper. I had seen roundhouse, and a few other things here and there, but they all seemed lacking. After all, as others have mentioned, cloning your mail stream is not to be done lightly. On Fri, 13 Mar 2015, Ted

Re: whitelist filter not matching

2015-03-14 Thread Benny Pedersen
David B Funk skrev den 2015-03-14 01:23: As usps.com publishes SPF records you can use "whitelist_from_auth" and be safer from abuse. thay miss to add dkim, and dmarc says fo=1 oh crap :=)

Re: whitelist filter not matching

2015-03-14 Thread Benny Pedersen
Rick Hantz (TirNanOg) skrev den 2015-03-14 00:14: For some reason, whitelist_from *@*.usps.gov whitelist_from *@*.usps.com doesn't work on the header below. Anyone spot something that I missed? id D8.68.23218.0CC53055; Fri, 13 Mar 2015 16:55:12 -0500 (CDT) Return-Path: From: whitelist_from