Most of these static customers are legitimate business networks
running their own mail server, and have neither the need nor desire
to relay their mail through Comcast's SMTP servers. I think your
general idea is very good, but you're reaching a little too far with
this one.
Hi All,
I am want to disable all tests but bayes to do some benchmark of bayes
classify. So I changed all rules' score to 0.
It seems that it's currect.
But I saw some line like this:
[18176] info: rules: meta test RCVD_DOUBLE_IP_LOOSE has dependency
'RCVD_DOUBLE_IP_SPAM' with a zero score
Hi,
When I run spamassassin, there always a warn message about Text::Wrap
[18288] warn: (?:(?=[\s,]))* matches null string many times in regex; marked
by -- HERE in m/\G(?:(?=[\s,]))* -- HERE \Z/ at
/usr/lib/perl5/5.8.5/Text/Wrap.pm line 46.
I remember that this occurs when I upgrade
Hi,
When i send a mail from my local office ID to yahoo it is bouncing back with Greeting failed
Is this due to domain key verification ?
regards
On Thu, 02 Nov 2006 10:28:18 +, [EMAIL PROTECTED] (Justin Mason)
wrote:
Nigel Frankcom writes:
On Thu, 2 Nov 2006 01:47:31 -0500, Dylan Bouterse
[EMAIL PROTECTED] wrote:
In the 80_additional.cf file I have a list of TVD* rules that are not
explained on the
Hi :)
I successfully processed ham and spam emails with sa-learn, throught spam
and ham mail accounts, now, i will wait for users to send me new spam
messages to rich the bayesian filter.
What is the best to do with the old processed spam messages? deleted them o
re-apply the learn on them with
Chris [EMAIL PROTECTED] wrote in message
I usually come home from work to find about 60-80 spam's in my spam
folder.
Today upon bringing up the mailer there were over 400! Looks like a large
bonnet attack or something. Has anyone else noticed this? I've not finished
looking at the Ash's to see
Chris [EMAIL PROTECTED] wrote in message
I usually come home from work to find about 60-80 spam's in my spam
folder.
Today upon bringing up the mailer there were over 400! Looks like a large
bonnet attack or something. Has anyone else noticed this? I've
not finished
looking at the
On 11/2/06, Debbie D [EMAIL PROTECTED] wrote:
Yes Chris I did notice.. my server was attacked with spam yesterday
morning.. it was coming from several different ip, so fast I could not keep
it quiet
There's been a lot of chatter about this:
I installed spamassassin-3.1.3.
I have bayes_seen and bayes_toks, but I have not bayes_journal. Why?
Can you help me?
Thank
Andrea
Am Donnerstag, 2. November 2006 16:04 schrieb Amos:
(...)
Actually, it's getting to the extent that some at work are raising
questions as to whether our SA setup will be able to maintain adequate
protection from this growing onslaught.
Amos
Only AFTER adequate initial RBL filtering.
On 11/2/06, Debbie D [EMAIL PROTECTED] wrote:
Yes Chris I did notice.. my server was attacked with spam yesterday
morning.. it was coming from several different ip, so fast I
could not keep
it quiet
There's been a lot of chatter about this:
I have it set to go about about every six hours yet blacklist_uri always
seems to have an update. Is there any reason I couldn't up it to like
every four hours? Would that stress the rules servers a bit too much?
How often does everyone else update?
I've attached the patch file this time.. give it a go..
Use this command to patch your file.
patch RelayChecker.patch
and it should work.. This is just the patch for the .pm file.. the other
one was simply adding in the default score values..
Thanks, Billy
- Original Message -
Greylisting is not always good... The greylisting insert delay in delevery and sometimes the email have to be delever fast. For example: on some public wireless network, you have to register to have access to the internet. You can access internet without authentification for 15 minutes. In this 15
At 07:38 AM 11/2/2006, you wrote:
I have it set to go about about every six hours yet blacklist_uri always
seems to have an update. Is there any reason I couldn't up it to like
every four hours? Would that stress the rules servers a bit too much?
How often does everyone else update?
Well
Oops, I musta missed that part. Hmm.. Maybe I could make a copy of
dujour that just looked for updates to blacklist_uri.
-Original Message-
From: Evan Platt [mailto:[EMAIL PROTECTED]
Sent: Thursday, November 02, 2006 7:44 AM
To: users@spamassassin.apache.org
Subject: Re: RulesduJour
On Thu, Nov 02, 2006 at 02:08:46PM +0100, Andrea Bencini wrote:
I have bayes_seen and bayes_toks, but I have not bayes_journal. Why?
The journal goes away when its data is synced into the DB.
--
Randomly Selected Tagline:
Direct from the Ministry of Silly Walks.
pgpm0Uu7Gw5DD.pgp
I have it set to go about about every six hours yet blacklist_uri always
seems to have an update. Is there any reason I couldn't up it to like
every four hours? Would that stress the rules servers a bit too much?
How often does everyone else update?
/ME: Once per day.
Also note that
On Thu, Nov 02, 2006 at 06:53:27AM +, Nigel Frankcom wrote:
In the 80_additional.cf file I have a list of TVD* rules that are not
explained on the http://spamassassin.apache.org/tests_3_1_x.html page
I Think the TVD rules are to do with gif spams. If your users use
Outlook and stationary
On Thu, Nov 02, 2006 at 05:19:53PM +0800, Xueron Nee wrote:
[18288] warn: (?:(?=[\s,]))* matches null string many times in regex; marked
by -- HERE in m/\G(?:(?=[\s,]))* -- HERE \Z/ at
/usr/lib/perl5/5.8.5/Text/Wrap.pm line 46.
What's the matter?
Greylisting is not always good... The greylisting insert delay in
delevery and sometimes the email have to be delever fast. For
example: on some public wireless network, you have to register to have access
to the internet. You can access internet without authentification for 15
On Thu, Nov 02, 2006 at 05:14:22PM +0800, Xueron Nee wrote:
I am want to disable all tests but bayes to do some benchmark of bayes
classify. So I changed all rules' score to 0.
It seems that it's currect.
Sure. You can also just remove the rule files, it would be easier.
But I saw some line
On Thursday 02 November 2006 08:42, François Rousseau wrote:
Greylisting is not always good...
The greylisting insert delay in delevery and sometimes the email have to be
delever fast.
For example: on some public wireless network, you have to register to have
access to the internet. You
On Thu, Nov 02, 2006 at 10:56:39AM -0500, Theo Van Dinter wrote:
http://wiki.apache.org/spamassassin/TextWrapError
Can you tell me, since I am not a perl guru, how to downgrade this
module ?
Jonathan
On Thu, Nov 02, 2006 at 04:04:45PM +, Jonathan Allen wrote:
http://wiki.apache.org/spamassassin/TextWrapError
Can you tell me, since I am not a perl guru, how to downgrade this
module ?
For example, my system comes with version 2001.0929. So you can download the
version from CPAN:
Theo Van Dinter writes:
On Thu, Nov 02, 2006 at 05:14:22PM +0800, Xueron Nee wrote:
I am want to disable all tests but bayes to do some benchmark of bayes
classify. So I changed all rules' score to 0.
It seems that it's currect.
Sure. You can also just remove the rule files, it would
I would like also to report the spams, but i dont wont get so much spams as
i can see there.
This is probably because you have an unconditional
warn message = X-Spam-Report: $spam_report
in your Exim configuration - check your ACL.
I dont know what you exactly meen, what wrong is? But i
On Thu, 02 Nov 2006 16:31:26 +, Markus Braun
[EMAIL PROTECTED] wrote:
I would like also to report the spams, but i dont wont get so much spams as
i can see there.
This is probably because you have an unconditional
warn message = X-Spam-Report: $spam_report
in your Exim configuration -
Last week I made some changes to my rules and I performed
-- lint
which showed no errors..
Yesterday AM there was a HUGE influx of spam and I SSH'd in when I saw the
loads jumping up.
The first thing I did after verifying I had loads up over 30% was shut down
exim, which normally brings the
On Thu, 2 Nov 2006 12:03:14 -0500, Debbie D
[EMAIL PROTECTED] wrote:
Last week I made some changes to my rules and I performed
-- lint
which showed no errors..
Yesterday AM there was a HUGE influx of spam and I SSH'd in when I saw the
loads jumping up.
The first thing I did after verifying I
Nigel Frankcom wrote:
On Thu, 2 Nov 2006 12:03:14 -0500, Debbie D
[EMAIL PROTECTED] wrote:
Last week I made some changes to my rules and I performed
-- lint
which showed no errors..
Yesterday AM there was a HUGE influx of spam and I SSH'd in when I saw the
loads jumping up.
The first thing
On Thu, 02 Nov 2006 22:53:38 +0530, Dhawal Doshy
[EMAIL PROTECTED] wrote:
Nigel Frankcom wrote:
On Thu, 2 Nov 2006 12:03:14 -0500, Debbie D
[EMAIL PROTECTED] wrote:
Last week I made some changes to my rules and I performed
-- lint
which showed no errors..
Yesterday AM there was a HUGE
Thanks all for your comments I see now that this is informational only and I
wont let it concern me
Amos wrote:
On 11/2/06, Debbie D [EMAIL PROTECTED] wrote:
Yes Chris I did notice.. my server was attacked with spam yesterday
morning.. it was coming from several different ip, so fast I could
not keep
it quiet
There's been a lot of chatter about this:
What I do is sort of partial greylisting. If a connection is suspicious
I give them a temp error on my lowest MX but accept them on higher MX
records. So that way most MTA will try a higher MX right away and it
doesn't add much of a delay.
François Rousseau wrote:
Greylisting is not always
On Thu, 2 Nov 2006, itdelany wrote:
I successfully processed ham and spam emails with sa-learn, throught spam
and ham mail accounts, now, i will wait for users to send me new spam
messages to rich the bayesian filter.
What is the best to do with the old processed spam messages? deleted them o
On Thu, 2 Nov 2006, [ISO-8859-1] Fran?ois Rousseau wrote:
Greylisting is not always good...
The greylisting insert delay in delevery and sometimes the email have to be
delever fast.
For example: on some public wireless network, you have to register to have
access to the internet. You
I already deleted them based on Matt's answer, but your point is good.. I'll
keep some of them with the 2nd learning.
To backup learning files, do i only have to copy bayes_seen and bayes_toks
right ?
thanks
John D. Hardin wrote:
It depends on the size and whether you are doing purely
-Original Message-
From: Marc Perkel [mailto:[EMAIL PROTECTED]
Sent: donderdag 2 november 2006 19:00
To: users@spamassassin.apache.org
Subject: Re: BIG increase in spam today
I'm not an appliance vendor but I run a fornt end spam
filtering service and it's been a struggle.
On Thu, 2 Nov 2006, itdelany wrote:
To backup learning files, do i only have to copy bayes_seen and bayes_toks
right ?
I was speaking of backing up the original messages.
Backing up the bayes_* files would let you restore the database to a
particular point in time, which is useful if you know
Da: Marc Perkel [mailto:[EMAIL PROTECTED]
What I do is sort of partial greylisting. If a connection is suspicious
I give them a temp error on my lowest MX but accept them on higher MX
records. So that way most MTA will try a higher MX right away and it
doesn't add much of a delay.
Well,
Da: John D. Hardin [mailto:[EMAIL PROTECTED]
'course, I only have four users...
Wow! I though I was the tinniest here: I got around 60 (can't get the exact
number: they're too many :) ).
---
Giampaolo Tomassoni - IT Consultant
Piazza VIII Aprile 1948, 4
Mark wrote:
-Original Message-
From: Marc Perkel [mailto:[EMAIL PROTECTED]
Sent: donderdag 2 november 2006 19:00
To: users@spamassassin.apache.org
Subject: Re: BIG increase in spam today
I'm not an appliance vendor but I run a fornt end spam
filtering service and it's been a
Hi.
I'm running FC3 on an AMD64 platform for my mail server,
and I had last installed SpamAssassin 3.1.5. Well, I grabbed the
tarball for 3.1.7, and did a rpmbuild -tb ... of the tarball.
Worked fine.
Then I tried to upgrade via RPM:
# rpm -v -U
On Thu, Nov 02, 2006 at 12:00:50PM -0700, Philip Prindeville wrote:
# rpm -v -U
/home/src/redhat/RPMS/x86_64/perl-Mail-SpamAssassin-3.1.7-1.x86_64.rpm
error: Failed dependencies:
perl-Mail-SpamAssassin = 3.1.5-1 is needed by (installed)
spamassassin-3.1.5-1.x86_64
any ideas why
Philip Prindeville wrote:
Hi.
I'm running FC3 on an AMD64 platform for my mail server,
and I had last installed SpamAssassin 3.1.5. Well, I grabbed the
tarball for 3.1.7, and did a rpmbuild -tb ... of the tarball.
Worked fine.
Then I tried to upgrade via RPM:
# rpm -v -U
On Thu, 02 Nov 2006 12:00:50 -0700, Philip Prindeville
[EMAIL PROTECTED] wrote:
Hi.
I'm running FC3 on an AMD64 platform for my mail server,
and I had last installed SpamAssassin 3.1.5. Well, I grabbed the
tarball for 3.1.7, and did a rpmbuild -tb ... of the tarball.
Worked fine.
Then I tried
-Original Message-
From: Jim Maul [mailto:[EMAIL PROTECTED]
Sent: donderdag 2 november 2006 19:58
To: users@spamassassin.apache.org
Subject: Re: BIG increase in spam today
92% (!) of all incoming spam uses an invalid HELO.
9% pretends to be me in their HELO.
Is
Jim Maul wrote:
Philip Prindeville wrote:
Hi.
I'm running FC3 on an AMD64 platform for my mail server,
and I had last installed SpamAssassin 3.1.5. Well, I grabbed the
tarball for 3.1.7, and did a rpmbuild -tb ... of the tarball.
Worked fine.
Then I tried to upgrade via RPM:
# rpm -v -U
On Thu, Nov 02, 2006 at 12:38:55PM -0700, Philip Prindeville wrote:
Is there any reason to not have a single container contain multiple
packages? Since they do both need to be installed simultaneously?
The packages are independent. spamassassin relies on
perl-Mail-SpamAssassin being the same
I'm sorry, but your query below does not parse. The envelope sender
does not change depending on which host it arrives from when using
Thunderbird et al. The host from which it arrives changes, but that's
not part of the envelope.
And yes, you can disable anything with a network profile.
Leon Kolchinsky wrote:
Hello All,
I'm running Cyrus as my IMAP server
(Cyrus+Postfix+Amavis_ClamAV+Spamassassin+Web-Cyradm).
I've wrote a script for reporting spam to Razor DB and teaching with it
Bayesian DB, revoking false positives from Razor DB and teaching Bayesian DB
with false
Hello All,
I'm running a system with Cyrus+Postfix+Amavisd-new+SA+ClamAV.
I've seen on this list that there is a possibility to show in the SA headers
the exact score for all tests scored for particular message, like this:
No, hits=-0.8 required=5.0 tests=BAYES_00=-2.599,
On Wed, 1 Nov 2006, Chris wrote:
I usually come home from work to find about 60-80 spam's in my spam folder.
Today upon bringing up the mailer there were over 400! Looks like a large
botnet attack or something. Has anyone else noticed this? I've not finished
looking at the ASN's to see where
Leon Kolchinsky wrote:
Thanks Cris,
What about resending false positives, after all filters learned that
this is a ham, how should I resend these messages (on Cyrus system)
to the original recipients?
Any sample code would be very welcome :)
If I understand you correctly, your setup
Leon Kolchinsky wrote:
Hello All,
I'm running a system with Cyrus+Postfix+Amavisd-new+SA+ClamAV.
I've seen on this list that there is a possibility to show in the SA headers
the exact score for all tests scored for particular message, like this:
No, hits=-0.8 required=5.0
Hi,
You're right, this is my situation exactly.
Your method is good for smart (intelligent) users.
This is not my case (my users here are very hard nut :)).
Just thought that may be someone have such script (for resending ham to its
original recipients) running and could spare it with me :)
I'm running a system with Cyrus+Postfix+Amavisd-new+SA+ClamAV.
I've seen on this list that there is a possibility to show in the SA
headers the exact score for all tests scored for particular message, like
this:
No, hits=-0.8 required=5.0 tests=BAYES_00=-2.599,
On Thursday November 2 2006 11:28, sokka wrote:
When i send a mail from my local office ID to yahoo it is bouncing back
with Greeting failed
Is this due to domain key verification ?
Not likely.
Greeting is called the first status response
from a SMTP server after connection establishment.
From: Mark [EMAIL PROTECTED]
From: Marc Perkel [mailto:[EMAIL PROTECTED]
I'm not an appliance vendor but I run a fornt end spam
filtering service and it's been a struggle. Most of my spam
defense isn't SA though. I'm using Exim rules to do most of the
work and SA gets what's left.
Same
From: Giampaolo Tomassoni [EMAIL PROTECTED]
Da: Marc Perkel [mailto:[EMAIL PROTECTED]
What I do is sort of partial greylisting. If a connection is suspicious
I give them a temp error on my lowest MX but accept them on higher MX
records. So that way most MTA will try a higher MX right away and
From: Mark [EMAIL PROTECTED]
From: Jim Maul [mailto:[EMAIL PROTECTED]
92% (!) of all incoming spam uses an invalid HELO.
9% pretends to be me in their HELO.
Is this 9% included in the above 'invalid HELO' number?
Yes. I should have been more clear about that. 92% fails the HELO
Well ok... if you want to pick nits :-)
I guess I should have said:
The listserver, and one of the email accounts, originate mail on the
host (the email account, using pine) - so, for SPF purposes, the mail
comes from an IP address listed in the SPF record for the domain in the
envelop
I've put up a new version of Relay checker, in
http://people.ucsc.edu/~jrudd/spamassassin
as as before: put RelayChecker.* wherever you put your plugins.
Changes:
1) The score is now fixed instead of variable. default=6
2) Each test can be ignored (it says skipped, but the test is still
Hi There,
Using spamassassin 3.1.3-0bpo1 from backports.org on debian sarge. We
did have the standard 3.0.x sarge package. Using amavis-new to call
spamassassin and after upgrading spamassassin we are now getting these
messages in the mail.log. Would someone please be able to assist in
where to
Hey all,Recently my domain came under 'Spam attack' as my users are calling it, we have been flooded with hundreds of Spam messages. :( So over the last week I have been setting up SA (3.1.3) along with Amavis, ClamAV, postfix and dovecot. Just out of the box we have noticed a huge drop in Spam
Simon wrote:
Hi There,
Using spamassassin 3.1.3-0bpo1 from backports.org on debian sarge. We
did have the standard 3.0.x sarge package. Using amavis-new to call
spamassassin and after upgrading spamassassin we are now getting these
messages in the mail.log. Would someone please be able to
On 11/3/06, Matt Kettler [EMAIL PROTECTED] wrote:
Simon wrote:
Hi There,
Using spamassassin 3.1.3-0bpo1 from backports.org on debian sarge. We
did have the standard 3.0.x sarge package. Using amavis-new to call
spamassassin and after upgrading spamassassin we are now getting these
messages
Jason Wellman wrote:
Hey all,
Recently my domain came under 'Spam attack' as my users are calling
it, we have been flooded with hundreds of Spam messages. :( So over
the last week I have been setting up SA (3.1.3) along with Amavis,
ClamAV, postfix and dovecot. Just out of the box we have
Is your amavis set with an abnormally short timeout for SA?
Hmm.. Where do find this setting in my amavis conf file?
The default is 30 seconds (at least in older versions of amavisd-new). You
can add:
$sa_timeout = 50;
As Matt says, 'lock_method flock' will also help. Are you using
Simon wrote:
On 11/3/06, Matt Kettler [EMAIL PROTECTED] wrote:
Simon wrote:
Hi There,
Using spamassassin 3.1.3-0bpo1 from backports.org on debian sarge. We
did have the standard 3.0.x sarge package. Using amavis-new to call
spamassassin and after upgrading spamassassin we are now
Ok, this isn't right. I upgraded my SA install to 3.1.17 day
before yesterday. I cycled the server and now all of a sudden I'm getting
50% of the spam coming through that's getting completely missed. Do I need
to reset something or maybe bayes or is there a change somewhere I need to
On Fri, Nov 03, 2006 at 12:31:36AM -0500, Steve Lake wrote:
Ok, this isn't right. I upgraded my SA install to 3.1.17 day
before yesterday. I cycled the server and now all of a sudden I'm getting
50% of the spam coming through that's getting completely missed. Do I need
to reset
Steve Lake wrote:
Ok, this isn't right. I upgraded my SA install to 3.1.17 day
before yesterday. I cycled the server and now all of a sudden I'm
getting 50% of the spam coming through that's getting completely
missed. Do I need to reset something or maybe bayes or is there a
change
Steve Lake wrote:
Ok, this isn't right.
Agreed.
I upgraded my SA install to 3.1.17 day
before yesterday. I cycled the server and now all of a sudden I'm
getting 50% of the spam coming through that's getting completely
missed. Do I need to reset something or maybe bayes or is
How did you upgrade?
Via the freebsd ports collection
What version did you upgrade from?
3.1.5
Where did you get 3.1.17 from? :)
That would be a typo. I meant 3.1.7, not 3.1.17. Must have had a
finger malfunction. ;)
Steven Lake
Owner/Technical Writer
What do the hits look like on the spam getting through?
I'm seeing a wide variety of different hits. Nothing in
common. I'm also seeing ham scores on obvious spam. Is this bayes
poisoning and if so, how do I reset bayes to clear that?
What kinds of spam are they, anything in
78 matches
Mail list logo
