Re: Re[2]: Is Bayes Really Necessary?

2005-05-27 Thread List Mail User
... Hello List, Thursday, May 26, 2005, 10:05:26 AM, you wrote: LMU Though nobody seems to have said it exactly this way: It seems LMU to be becoming very obvious that the people who say the have problems LMU with Bayes are those who support a diverse group of users (e.g. ISPs LMU and email

Custom Black list question

2005-05-27 Thread Philip Wege
I have a custom black list with rules like : blacklist_from [EMAIL PROTECTED] How can one make sure these rules are picked up by spamassassin as these emails are still getting through Spamassassin running on Freebsd.

Re[4]: Is Bayes Really Necessary?

2005-05-27 Thread Robert Menschel
Hello List, Thursday, May 26, 2005, 11:01:23 PM, you wrote: LMU P.S. I know the account says List Mail User, but why is this the only LMU mailing list that almost uniformly references me that way? Though, I do LMU get called by the sobriquet Administrative User when I use accounts LMU which are

Re[3]: [SARE] obfu.cf, specific.cf updated

2005-05-27 Thread Robert Menschel
header.cf and specific.cf files updated. Other than correcting version numbers and dates (used next version number, 5/27 as date), the only changes are moving two rules from header0 to header1. Anyone who does manual updates and has this morning's versions in place can leave them there. If you

Re: Re[4]: Is Bayes Really Necessary?

2005-05-27 Thread List Mail User
Bob, The Staples mention was of interest since I get their weekly ads to an account here. The very last one hit BAYES_50, but all the others were from BAYES_00 to (from a 3.0.1 install) BAYES_44. - Most were BAYES_20 (I looked back 4 months - how long that account's mail is kept

RE: Expiry issues, SPF, Trusted path and more

2005-05-27 Thread Ben Wylie
Where can I get the latest version for windows? Will this do: http://search.cpan.org/~freeside/Mail-SPF-Query-1.997/ When I do: F:\Perl\binppm verify --upgrade Mail-SPF-Query I get: Package 'Mail-SPF-Query' is up to date. Thanks Ben -Original Message- From: Matt Kettler [mailto:[EMAIL

Re: Is Bayes Really Necessary?

2005-05-27 Thread jdow
From: Matt Kettler [EMAIL PROTECTED] (Sneaky one you are - you got around my Reply-To markup for this list. For that you get an extra copy. {^_-}) jdow wrote: One way to keep Bayes from running is to never train it. {^_^} You'd also disable autolearning. By default SA will eventually

Re: Is Bayes Really Necessary?

2005-05-27 Thread jdow
From: List Mail User [EMAIL PROTECTED] Though nobody seems to have said it exactly this way: It seems to be becoming very obvious that the people who say the have problems with Bayes are those who support a diverse group of users (e.g. ISPs and email providers) and those who find it works

Re: Is Bayes Really Necessary?

2005-05-27 Thread jdow
From: Jim Maul [EMAIL PROTECTED] Gotta stop smokin the green ;) Yeah, it's better if you shovel the random greens you find into the compost pit. Not many people will look for them in a compost pit when they get reported as missing persons. {O,o}

Re: [SARE] Whitelist.cf updated

2005-05-27 Thread Jeff Chan
On Thursday, May 26, 2005, 5:58:02 PM, Robert Menschel wrote: JC 2. Would they be appropriate to whitelist (i.e. exclude from JC listing) in SURBLs? Unlikely, since the web sites mentioned in the emails are rarely the same as the From address or routing server. However, the primary web sites

Re: Custom Black list question

2005-05-27 Thread Loren Wilton
I have a custom black list with rules like : blacklist_from [EMAIL PROTECTED] How can one make sure these rules are picked up by spamassassin as these emails are still getting through You don't say if there are any indications of whether these rules are hitting and the mail is still

Re: Re[2]: [SARE] obfu.cf, specific.cf updated

2005-05-27 Thread Joe Zitnik
Sorry. If I'm not bitching, I'm not happy. Robert Menschel [EMAIL PROTECTED] 5/26/2005 8:39 PM Hello Joe,Thursday, May 26, 2005, 7:37:55 AM, you wrote:JZ Can someone get the file specific information straight forJZ those of us who download manually? ...Sure, someone could. Apparently not me.

Whitelisting Word or Phrases

2005-05-27 Thread mailsec2
Hi, it ist possible to whitlist word or phrases? In my blacklist i've got the most freemailer adresses like hotmail, gmx lycos a.s.o. But sometimes i got ebay responses or online contacts from people who uses freemail adresses. it is possible to whitelist phrases like Ebay antwort or online

Re: Whitelisting Word or Phrases

2005-05-27 Thread Loren Wilton
it is possible to whitelist phrases like Ebay antwort or online kontakt ... ? Depends on what you mean by 'whitelist'. The specific answer is 'no'. The general answer is 'yes'. There is no whitelist random phrase command. But there are rules, which can look for random phrases in the body or

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Martyn Drake
JamesDR wrote: As far as ease of setup? When I first started with SA I was more of the doze admin than the Linux admin. I've been doing Linux stuff since around 1996/1997 and have my own dedicated server that I get to ruin^H^H^H^play with before rolling it across work-related matters. I'd

RE: Comparison of SA and commercial solutions

2005-05-27 Thread Peuhkurinen, Kevin
Title: RE: Comparison of SA and commercial solutions 2 hours is better than an hour and a half? {O,o} (Yes, I know that you were free to do other stuff while on hold with SpamAssassin. The numbers just sort of tickled me.) Well, of course, let's assume another 30 minutes for the second

problem with split line URL's

2005-05-27 Thread Martin Hepworth
Hi I've been attempting to get the split line URL rule working - this one.. rawbody __LW_URI_CR1 /href=\[^]*\r[^\n]/is full __LW_URI_CR2 /href=\[^]*\r[^\n]/is meta LW_URI_CR __LW_URI_CR1 || __LW_URI_CR2 score LW_URI_CR 2 describe LW_URI_CR unescaped cr in uri I get quite a few spams

Re: problem with split line URL's

2005-05-27 Thread Loren Wilton
Which dont seem to trigger the above rule. Any ideas? Not really. That's my rule and it works fine here, and many other places. However, you aren't the first to say it doesn't work for them. I'm guessing you are using something other than procmail/spamd to process mail, or maybe you are

whitelist

2005-05-27 Thread Ronan McGlue
I think i may be overlooking something to do with the white list here... I like a lot of you regularly get SA list traffic being diverted to the junk folder.. mydomain.com as a main focus in our examples... So step in whitelist_from Running sitewide (atm) for a university (may soon switch to

Re: problem with split line URL's

2005-05-27 Thread Martin Hepworth
Loren ok I've added the alternative in with a slightly different name so I've got both in the setup. I note that if I run spamassassin -D test.eml on an example the rules don't fire either, so I don't think its MailScanner getting in the way. Running SA 3.0.3 (from CPAN) with perl 5.8.5

Re: problem with split line URL's

2005-05-27 Thread Martin Hepworth
Loren Wilton wrote: Which dont seem to trigger the above rule. Any ideas? Not really. That's my rule and it works fine here, and many other places. However, you aren't the first to say it doesn't work for them. I'm guessing you are using something other than procmail/spamd to process

Re: whitelist

2005-05-27 Thread Loren Wilton
I may well be wrong, but I didn't think you could put more than one host identifier on a single whitelist_from command. So what you showed would take 4 lines. whitelist_from [EMAIL PROTECTED] [EMAIL PROTECTED] *.apache.org *.exim.org whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL

RE: Comparison of SA and commercial solutions

2005-05-27 Thread aecioneto
2 hours is better than an hour and a half? {O,o} (Yes, I know that you were free to do other stuff while on hold with SpamAssassin. The numbers just sort of tickled me.) Well, of course, let's assume another 30 minutes for the second level support person to finally fix my

RE: Comparison of SA and commercial solutions

2005-05-27 Thread aecioneto
2 hours is better than an hour and a half? {O,o} (Yes, I know that you were free to do other stuff while on hold with SpamAssassin. The numbers just sort of tickled me.) Well, of course, let's assume another 30 minutes for the second level support person to finally fix my

[Fwd: My OECD paper on spam]

2005-05-27 Thread Martin Hepworth
Original Message Subject: My OECD paper on spam Date: Fri, 27 May 2005 18:21:00 +0530 From: Suresh Ramasubramanian [EMAIL PROTECTED] To: [EMAIL PROTECTED] Downloadable from http://www.oecd.org/dataoecd/5/47/34935342.pdf This is linked from the OECD antispam toolkit page, as

RE: whitelist

2005-05-27 Thread Kristopher Austin
Ronan, whitelist_from hits on the from header. This list sets the from header to the person sending the email (as it should). Therefore your whitelist_from entries won't work as you have them. I use whitelist_from_rcvd instead. This is my entry for this list: whitelist_from_rcvd [EMAIL

Re: Custom Black list question

2005-05-27 Thread Matt Kettler
At 11:19 AM 5/27/2005, Philip Wege wrote: I have a custom black list with rules like : blacklist_from [EMAIL PROTECTED] How can one make sure these rules are picked up by spamassassin as these emails are still getting through Hmm, sounds like the blacklist isn't matching. blacklist_from

Logfile analyzer

2005-05-27 Thread Jon Gray
Can anyone recommend a good logfile analyzer for Spamassassin?

embedded image spams

2005-05-27 Thread Rakesh
Hi I have been bugged a lot by embedded image spams recently, although some of these spams got trapped due URI checks, some managed to pass as well as the url wasn't yet blocked in the SURBLs. I probably found something tht i wanted to share with u guys and try and see if we can trap those

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Lima Union
On 5/27/05, aecioneto [EMAIL PROTECTED] wrote: 2 hours is better than an hour and a half? {O,o} (Yes, I know that you were free to do other stuff while on hold with SpamAssassin. The numbers just sort of tickled me.) Hi there, Any idea how many 'commercial solutions'

RE: Logfile analyzer

2005-05-27 Thread Chris Santerre
-Original Message- From: Jon Gray [mailto:[EMAIL PROTECTED] Sent: Friday, May 27, 2005 9:25 AM To: SpamAssassin Users Subject: Logfile analyzer Can anyone recommend a good logfile analyzer for Spamassassin? Depends on what you want to analyze. One of the ninjas wrote a great script

Re: SpamAssassin-3.0.3 test failure

2005-05-27 Thread Mark G. Thomas
Hi, On Wed, May 25, 2005 at 06:38:00PM -0700, Robert Menschel wrote: Hello Mark, Wednesday, May 25, 2005, 10:29:16 AM, you wrote: ... MGT I had no troubles with SpamAssassin-3.0.2, but after following the same MGT configure and build steps, I'm getting a test failure on 3.0.3, for a MGT

Re: Is Bayes Really Necessary?

2005-05-27 Thread Jake Colman
OK. I misunderstood. The URIBLS are working fine. Interestingly, although I use the SARE rules and URIBLS, some spam is still slipping through. This spam is fairly obvious spam some I am a bit surprised. Should I be tweaking the scoring? MK == Matt Kettler [EMAIL PROTECTED] writes: MK

Re: embedded image spams

2005-05-27 Thread Jeff Chan
On Friday, May 27, 2005, 6:24:08 AM, Rakesh Rakesh wrote: Hi I have been bugged a lot by embedded image spams recently, although some of these spams got trapped due URI checks, some managed to pass as well as the url wasn't yet blocked in the SURBLs. Please provide the URI and the

RE: Is Bayes Really Necessary?

2005-05-27 Thread Chris Santerre
-Original Message- From: Jake Colman [mailto:[EMAIL PROTECTED] Sent: Friday, May 27, 2005 9:47 AM To: users@spamassassin.apache.org Subject: Re: Is Bayes Really Necessary? OK. I misunderstood. The URIBLS are working fine. Interestingly, although I use the SARE rules and URIBLS,

Re: Logfile analyzer

2005-05-27 Thread Paolo Cravero as2594
Chris Santerre wrote: Can anyone recommend a good logfile analyzer for Spamassassin? Depends on what you want to analyze. One of the ninjas wrote a great script to parse the logs and show rule hit statistics. If you are looking for that I can see if I can find it my vast archive of ninja

Re: whitelist

2005-05-27 Thread Kris Deugau
Loren Wilton wrote: I may well be wrong, but I didn't think you could put more than one host identifier on a single whitelist_from command. So what you showed would take 4 lines. whitelist_from [EMAIL PROTECTED] [EMAIL PROTECTED] *.apache.org *.exim.org whitelist_from [EMAIL PROTECTED]

SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Tony pace
we are looking to implement SA in our environment this best describes what we want to do. [SPAM/HAM] -- [ SA GATEWAY] - [MS EXCHANGE] - system wide filtering - all user mailboxes - postfix transport -

RE: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Chris Santerre
Lik Evan has stated, it just queues locally. Same for Sendmail installs. If we a retalking VERY high traffic, with 1000s of users, then you better have more then one server. Or a big HD for the queue ;) --Chris -Original Message- From: E. Falk [mailto:[EMAIL PROTECTED] Sent: Friday,

RE: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Kristopher Austin
Tony, Your main question has already been answered, but I noticed something in your proposed setup that concerns me. You state in your diagram that you plan to have the MSE box as the secondary MX record. This would not be a good idea. From experience, we have seen that spammers try the

Re: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread E. Falk
Additionally, I was going to point you to a great How-To on setting up just such a system, but it looks like the wiki was taken over by spammers! Here's a link to a clean version of the wiki... http://flakshack.com/anti-spam/wiki/index.php?page=FairlySecureAntiSpamWikiversion=43 Explains the

RE: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Matthew.van.Eerde
Kristopher Austin wrote: You state in your diagram that you plan to have the MSE box as the secondary MX record. This would not be a good idea. From experience, we have seen that spammers try the secondary MX first in hopes of finding a server that is not protected by a spam scanner. This

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Lima Union writes: On 5/27/05, aecioneto [EMAIL PROTECTED] wrote: 2 hours is better than an hour and a half? {O,o} (Yes, I know that you were free to do other stuff while on hold with SpamAssassin. The numbers just sort of

70_sare_header.cf dupe

2005-05-27 Thread Donald.Dawson
Title: 70_sare_header.cf dupe Checking for duplicate rules using the following command, cat *.cf | awk '/^score/ {print $2}' | sort | uniq -c | sort -nr | awk '{if ($1 1) print $0}' | more I found the following duplicate: # grep -n SARE_MSGID_LONG50 * | grep score

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Kelson
David B Funk wrote: Yes, but don't forget, while Kevin was on hold waiting for his SA support message -he- got to pick the music that he listened to rather than being forced to listen to the commercial vender's 'elevator muzak' and ads, makes the price all the easier to take. ;) That probably

Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steve Prior
My domain geekster.com has been Joe jobbed for the last couple of weeks. In spite of the fact that I responsibly created SPF records for my domain, I am getting flooded with bounce messages from other mail systems that don't understand most spam from addresses are forged. Fortunatly AOL seems

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Martyn Drake
Lima Union wrote: Any idea how many 'commercial solutions' depend on SA ? The Barracuda does IIRC and doesn't MessageLabs also use SA (amongst other things)? Regards, Martyn

Re: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread David Brodbeck
Tony pace wrote: Thanks for all the input. The diagram was simplistic - the real MSE is a couple layers away. One thing that no one has mentioned is that it's vitally important that the edge gateway (the postfix system) have a way of knowing what users are valid. Otherwise you will end up

Re: dynamic IP range and good RBL?

2005-05-27 Thread Ing. Alejandro Rodriguez
list most of dynamic IPs not just the dynamic IPs sending spam. Ing. Alejandro Rodriguez Gerente Tecnico Cybercom Ryan L. Sun wrote: Does "dul.dnsbl.sorbs.net" list all the dynamic IPs? Or just the dynamic IPs which fall in spamtrap? Thanks. On 5/25/05, Ing. Alejandro Rodriguez [EMAIL

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Matthew S. Cramer
On Fri, May 27, 2005 at 12:16:52PM -0500, [EMAIL PROTECTED] wrote: I think this is an awesome idea! I hate getting stupid emails about how my spam or virus was rejected from someone I've never heard of. I can't very well be sending out Outlook viruses from a Linux box! Its just adding

Re: 70_sare_header.cf dupe

2005-05-27 Thread Bill Landry
70_sare_header.cf dupe- Original Message - From: [EMAIL PROTECTED] Checking for duplicate rules using the following command, cat *.cf | awk '/^score/ {print $2}' | sort | uniq -c | sort -nr | awk '{if ($1 1) print $0}' | more I found the following duplicate: # grep -n

RE: 70_sare_header.cf dupe

2005-05-27 Thread Donald.Dawson
I sent an email to '[EMAIL PROTECTED]' about those the first two (VIRUS_WARN...) -Original Message- From: Bill Landry [mailto:[EMAIL PROTECTED] Sent: Friday, May 27, 2005 12:47 PM To: users@spamassassin.apache.org Subject: Re: 70_sare_header.cf dupe 70_sare_header.cf dupe- Original

Re: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread David Brodbeck
Frank Coons wrote: Does Exim allows LDAP queries across a DMZ or do both machines need to be either inside or outside the DMZ for it to work? I've never tried it, but it's just a TCP connection. As far as I know it should work, as long as the firewall is not blocking the connection. I

Re: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Jim Maul
David Brodbeck wrote: Frank Coons wrote: Does Exim allows LDAP queries across a DMZ or do both machines need to be either inside or outside the DMZ for it to work? Exim (and anything else) shouldnt care if one machine is in the DMZ. They dont both need to be in the DMZ to work. However,

whitelist

2005-05-27 Thread Craig Jackson
Where I can find docs for local.cf and usaer_templates rules and tests. For instance, I have added some whitelist entries like this, whitelist_from_rcvd [EMAIL PROTECTED]google.com which is not working. The spam score is 5.0/5.0 so it is still tagged. Thanks, Craig Jackson

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Steven Dickenson
Eric A. Hall wrote: Every filtering system requires admin time, and if the reviews don't say as much then they're junk. There is a critical difference with SA, however, which is that the admins need to be proficient at stuff like CPAN, Perl, etc., while some of the packaged offerings provide

Turn off AWL

2005-05-27 Thread Craig Jackson
I'd like to turn off AWL. I remember there used to be a switch in SA to do this but it's not there any more. I start spamd with -x -L Thanks, Craig Jackson

RE: Comparison of SA and commercial solutions

2005-05-27 Thread Matthew.van.Eerde
Steven Dickenson wrote: Eric A. Hall wrote: simple click-the-button GUI, apt-get install exim4-daemon-heavy spamassassin clamav-daemon razor Steven, I don't think you give yourself enough credit :) -- Matthew.van.Eerde (at) hbinc.com 805.964.4554 x902 Hispanic Business

Re: Comparison of SA and commercial solutions

2005-05-27 Thread Steven Dickenson
Martyn Drake wrote: Ironically, after many years of faithful Linux use we're going down the Exchange route and mail handling to be given over to another department. I doubt we'll see a SA Linux box there. Oh well. I'm used to disapointments over the years, so it wasn't too much of a

Re: Turn off AWL

2005-05-27 Thread Steven Dickenson
Craig Jackson wrote: I'd like to turn off AWL. I remember there used to be a switch in SA to do this but it's not there any more. I start spamd with -x -L It was moved to the configuration files in v3. Put use_auto_whitelist 0 in your local.cf. - S

Re: whitelist

2005-05-27 Thread Steven Dickenson
Ronan McGlue wrote: I like a lot of you regularly get SA list traffic being diverted to the junk folder.. mydomain.com as a main focus in our examples... but in the local.cf file i have the following whitelist_from [EMAIL PROTECTED] [EMAIL PROTECTED] *.apache.org *.exim.org Use

Re: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Steven Dickenson
[EMAIL PROTECTED] wrote: Bingo. I have a similar setup in place (s/postfix/sendmail/) and I don't have my Exchange box listed as an MX at all. I also have port 25 to the Exchange box firewalled off at the router to avoid portscanning. Not a good idea, IMHO. What happens if your SA gateway

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steven Dickenson
Matthew S. Cramer wrote: If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject the mail with a 554 and Bounced message did not originate here. This has eliminated all the bogus

Re: whitelist

2005-05-27 Thread Craig Jackson
Craig Jackson wrote: Where I can find docs for local.cf and usaer_templates rules and tests. For instance, I have added some whitelist entries like this, whitelist_from_rcvd [EMAIL PROTECTED]google.com which is not working. The spam score is 5.0/5.0 so it is still tagged. Thanks,

http://bugzilla.spamassassin.org/show_bug.cgi?id=4337

2005-05-27 Thread Wolfgang Zeikat
Is there a way to apply the fix in 3.0.2 ? regards, wolfgang

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Steve Prior writes: My domain geekster.com has been Joe jobbed for the last couple of weeks. In spite of the fact that I responsibly created SPF records for my domain, I am getting flooded with bounce messages from other mail systems that don't

Re: http://bugzilla.spamassassin.org/show_bug.cgi?id=4337

2005-05-27 Thread Theo Van Dinter
On Fri, May 27, 2005 at 09:13:44PM +0200, Wolfgang Zeikat wrote: Is there a way to apply the fix in 3.0.2 ? First, it's http://bugzilla.spamassassin.org/show_bug.cgi?id=4213 that you want to look at (it has the patches). Second, you can try downloading the patches and applying to the 3.0.2

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steve Prior
Justin Mason wrote: A BL would probably be helpful -- but sadly some *really big* networks (Earthlink's challenge-response) and companies (Fortune 500s) produce these bounces, too, so it'd have serious FP potential, since those mail relay IP addresses produce both the bounces and the legit

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Antonio DeLaCruz
Actually, you can forward viruses from a Linux box if the virus is an attachment or embedded in the message. It makes no difference what OS you are using when you send the message. Linux only protects us from the viruses that want to harm Windows. Thanks, Antonio DeLaCruz Quoting [EMAIL

Re: http://bugzilla.spamassassin.org/show_bug.cgi?id=4337

2005-05-27 Thread Stuart Johnston
Wolfgang Zeikat wrote: Is there a way to apply the fix in 3.0.2 ? I've tried applying the patch but I'm not sure if it fixed the problem. Do you have an example of a URL that is supposed to be fixed?

a question for exiscan and exim users

2005-05-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Recently we've been seeing a *lot* of Exim users asking questions (here and on IRC) about spamd chewing up massive quantities of RAM. It appears that Exiscan has now become part of Exim by default, and it also appears that (at least in the default

RE: SA Gateway - MS Exchange -- what if MSE down?

2005-05-27 Thread Matthew.van.Eerde
Steven Dickenson wrote: [EMAIL PROTECTED] wrote: Bingo. I have a similar setup in place (s/postfix/sendmail/) and I don't have my Exchange box listed as an MX at all. I also have port 25 to the Exchange box firewalled off at the router to avoid portscanning. Not a good idea, IMHO. What

Re: http://bugzilla.spamassassin.org/show_bug.cgi?id=4337

2005-05-27 Thread Wolfgang Zeikat
On 05/27/05 21:39, Stuart Johnston wrote: Wolfgang Zeikat wrote: Is there a way to apply the fix in 3.0.2 ? I've tried applying the patch but I'm not sure if it fixed the problem. Do you have an example of a URL that is supposed to be fixed? echo -e Subject:

Re: a question for exiscan and exim users

2005-05-27 Thread Steven Dickenson
Justin Mason wrote: It appears that Exiscan has now become part of Exim by default, and it also appears that (at least in the default exiscan patch) it doesn't modify the config files directly to add itself to the MTA's flow. This is correct. The shipped configuration file doesn't include any

Spam

2005-05-27 Thread Jason Bennett
Hi there, Can anyone help me out with the attached message? To me this is obvious spam, but I dont know why it got through. I have my spamassassin score set to 5, but when I run spamassassin D on this, I only get a couple points. Im wondering if Im missing some important ruleset or

Re: Spam

2005-05-27 Thread Roman Volf
Jason Bennett wrote: Hi there, Can anyone help me out with the attached message? To me this is obvious spam, but I dont know why it got through. I have my spamassassin score set to 5, but when I run spamassassin D on this, I only get a couple points. Im wondering if Im missing some

Spam

2005-05-27 Thread Jason Bennett
Sorry all, let me try this again. Attached is the message I was referring to in my previous posting. Thanks Jason Microsoft Mail Internet Headers Version 2.0 Received: from calgty1.forzani.com ([172.16.112.6]) by CALMAIL01.fglcorporate.net with Microsoft

sa-learn from imap

2005-05-27 Thread Tim Litwiller
I needed to get this working this week and found the RemoteImapFolder wiki page. I decided to use that method here are the steps I did to make this work for me. I use qmail instead of cyrus so needed to change the redelivery method also. I don't have a username on the wiki and thought I see if

Re: whitelist

2005-05-27 Thread Robert Menschel
Hello Craig, Friday, May 27, 2005, 11:10:55 AM, you wrote: CJ Where I can find docs for local.cf and usaer_templates rules and tests. It would help to know which version of SA you're using, since syntax sometimes changes. CJ For instance, I have added some whitelist entries like this, CJ

Re: 70_sare_header.cf dupe

2005-05-27 Thread Robert Menschel
Hello Donald, Friday, May 27, 2005, 9:54:15 AM, you wrote: DDbc Checking for duplicate rules using the following command, DDbc cat *.cf | awk '/^score/ {print $2}' | sort | uniq -c | DDbc sort -nr | awk '{if ($1 1) print $0}' | more DDbc I found the following duplicate: DDbc # grep -n

Re[2]: 70_sare_header.cf dupe

2005-05-27 Thread Robert Menschel
Hello Bill, Friday, May 27, 2005, 10:46:32 AM, you wrote: BL 70_sare_header.cf dupe- Original Message - BL From: [EMAIL PROTECTED] Checking for duplicate rules using the following command, cat *.cf | awk '/^score/ {print $2}' | sort | uniq -c | sort -nr | awk '{if ($1 1) print $0}'

Re[2]: [SARE] Whitelist.cf updated

2005-05-27 Thread Robert Menschel
Hello Jeff, Friday, May 27, 2005, 1:06:46 AM, you wrote: JC On Thursday, May 26, 2005, 5:58:02 PM, Robert Menschel wrote: JC 2. Would they be appropriate to whitelist (i.e. exclude from JC listing) in SURBLs? Unlikely, since the web sites mentioned in the emails are rarely the same as the

Re: problem with split line URL's

2005-05-27 Thread Robert Menschel
Hello Martin, Friday, May 27, 2005, 3:52:25 AM, you wrote: MH Hi MH I've been attempting to get the split line URL rule working - this one.. I believe the working rule that matches all active spam using this trick is now active in 70_sare_obfu.cf Bob Menschel

Re: Spam

2005-05-27 Thread Robert Menschel
Hello Jason, Friday, May 27, 2005, 2:52:40 PM, you wrote: JB Sorry all, let me try this again.  Attached is the message JB Iwas referring to in my previous posting. Here in SA 3.0.3 your example hits: Content analysis details: (9.0 points, 5.0 required) pts rule name

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Dan Hollis
On Fri, 27 May 2005, Matthew S. Cramer wrote: You could probably do this with a SA rule. I do it with MIMEDefang milter. If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject

Re[6]: Is Bayes Really Necessary?

2005-05-27 Thread Robert Menschel
Hello List, Friday, May 27, 2005, 12:08:46 AM, you wrote: LMUBob, LMUThe Staples mention was of interest since I get their weekly ads LMU to an account here. The very last one hit BAYES_50, but all the others LMU were from BAYES_00 to (from a 3.0.1 install) BAYES_44. - Most were

Re: [SPAM-TAG] Spam

2005-05-27 Thread Jeff Chan
On Friday, May 27, 2005, 2:41:50 PM, Jason Bennett wrote: Can anyone help me out with the attached message? To me this is obvious spam, but I don't know why it got through. I have my spamassassin score set to 5, but when I run spamassassin -D on this, I only get a couple points. I'm

Re: embedded image spams

2005-05-27 Thread Loren Wilton
So my question is can we have rulesets in spamassassin that can compare the sending host domain with the latter part of @ of content id or look for @ in the content id. Nice analysis! Yes, we can make rules that will (often, not always) catch this sort of thing. The problem is they require a

Re: SpamAssassin-3.0.3 test failure

2005-05-27 Thread Loren Wilton
I am pleased to report the problem is solved. I obtained and installed the latest Berkeley DB from sleepycat.org, then the perl module DB_File-1.811. This resolved the problem. Please open a bug in BZ showing the symptoms and documenting the fix, and give it a title of something like

Re: Spam

2005-05-27 Thread List Mail User
Just to keep up; pictilpict4. com is the multitrade group, who now calls themselves omnicorporation. biz (since every domain with multitrade in its name has been suspended). These guys are *very* good at finding techniques to beat both SA and the SpamCop parser, but they don't

RE: [SPAM-TAG] Spam

2005-05-27 Thread Jason Bennett
Hmm, then I must have something wrong because I have the URIDNSBL plugin installed and my network tests are active (not using -L on command line) and amavisd-new has $SALocalTestsOnly = 0; When I run this email against commandline spamassassin, I get this (can anyone point out what I may have

open source blocklist

2005-05-27 Thread List
Hi, Anyone know of a open sourceproject which can create and manage an email blacklist and also run using qmail, rblsmtpd and even SpamAssassin rules. thanks

Re: embedded image spams

2005-05-27 Thread hamann . w
So my question is can we have rulesets in spamassassin that can compare the sending host domain with the latter part of @ of content id or look for @ in the content id. Hi, honestly the fact that outlook uses different strings and this spam uses similar strings for the boundary and the

RE: [SPAM-TAG] Spam

2005-05-27 Thread Jason Bennett
Thanks! Can you direct me to the patch? I downloaded and installed Spamassassin 3.1.0-r170109, but I still get the same results. Thanks again! Jason -Original Message- From: Loren Wilton [mailto:[EMAIL PROTECTED] Sent: Friday, May 27, 2005 10:44 PM To: users@spamassassin.apache.org

Re: [SPAM-TAG] Spam

2005-05-27 Thread Loren Wilton
Bug 4337. Loren