Re: whitelist

2007-12-06 Thread Matt Kettler
Matt Kettler wrote: Jack Gostl wrote: I have an odd problem. I have a user receiving spam from something like [EMAIL PROTECTED] Since he does business with verybigcompany.com, he had them in his white list, and as expected, the spam slipped through. Based on the advice I got

Re: the opposit of ok_locales ??

2007-12-06 Thread Matt Kettler
[EMAIL PROTECTED] wrote: MK Let's say you speak English and Chinese, and hate Russian because you MK get lots of spam in that text format and don't speak it. That's me, English and Chinese, and hate Russian. MK In this situation, why would you want not_ok_localles ru instead of MK

Re: the opposit of ok_locales ??

2007-12-06 Thread Matt Kettler
[EMAIL PROTECTED] wrote: Anyway, Mail::SpamAssassin::Conf should admit that it doesn't mention What if I hate a specific language, people, culture. Is there e.g., a not_ok_locales? Don't put the answer here, put it on Mail::SpamAssassin::Conf, even if the answer is that there is no answer.

Re: whitelist

2007-12-06 Thread Matt Kettler
Jack Gostl wrote: - Original Message - From: Matt Kettler [EMAIL PROTECTED] To: Jack Gostl [EMAIL PROTECTED] Cc: spam users@spamassassin.apache.org Sent: Thursday, December 06, 2007 8:19 PM Subject: Re: whitelist Matt Kettler wrote: Jack Gostl wrote: I have an odd problem. I

Re: the opposit of ok_locales ??

2007-12-06 Thread Matt Kettler
[EMAIL PROTECTED] wrote: MK I'll be happy to change my assumptions, but can you name any good reason MK why they would want to do so? The Matt theme: restrict oneself from getting mail from any but a few safe people, languages, or whatever. Life goes on in its familiar grey days. But alas,

Re: the opposit of ok_locales ??

2007-12-07 Thread Matt Kettler
Daniel J McDonald wrote: It would be a harmless confusion, but if you specified: not_ok_locales se ok_locales en The ok_locales would do nothing at all. We'll have to document that *very* carefully. Maybe something like: ok_locales !se all Hmm, that's a bit confusing to me,

Re: the opposit of ok_locales ??

2007-12-07 Thread Matt Kettler
Stefan Jakobs wrote: Let's assume you running a mailrelay for a university and your users are from different countries. Lets assume further on you have no Swedish people at your university (and you get a lot of spam from Sweden). Then it would be nice to have a not_ok_locales option,

Re: the opposit of ok_locales ??

2007-12-07 Thread Matt Kettler
Matt Kettler wrote: Stefan Jakobs wrote: Let's assume you running a mailrelay for a university and your users are from different countries. Lets assume further on you have no Swedish people at your university (and you get a lot of spam from Sweden). Then it would be nice to have

Re: the opposit of ok_locales ??

2007-12-07 Thread Matt Kettler
Karsten Bräckelmann wrote: Maybe the devs can briefly explain how the charset is being determined. Or at least, where exactly in the code one could find it... Matt, also, I got a feeling, that logic is what the OP is actually about. He does not want to leave out what he wants to be

Re: the opposit of ok_locales ??

2007-12-07 Thread Matt Kettler
[EMAIL PROTECTED] wrote: M or does he think All we know is users don't think like we do. http://www.useit.com/alertbox/ Fundamentally, SpamAssassin is a tool written by system administrators, for system administrators and advanced users. Like it or not, the project's primary goal has always

Re: Learning and verifying ham

2007-12-07 Thread Matt Kettler
Asif Iqbal wrote: Hi All I took a message and learned it as ham like this cat email-with-headers | sa-learn --ham Now I should expect the exact same email to be considered as ham. Correct? No. You'd expect the bayes score to go down, but that alone might not be enough. But it does

Re: MIME_HTML_ONLY BODY problems

2007-12-07 Thread Matt Kettler
Iann Gorrill wrote: Hello everyone, We have a form that makes use of the phpmail class (http://phpmailer.sourceforge.net) that for one reason or another, triggers the MIME_HTML_ONLY BODY rule on every scan, stating that only a text/html Content type was found, yet there is clearly a plain

Re: Using Bayes Files for Other Users

2007-12-08 Thread Matt Kettler
Matthew Goodman wrote: Hi all, I have some pretty good bayes_seen and bayes_toks files, I’m down to about 2-3 spams per day (if that) with 50+ a day getting caught. Would it be helpful for me to copy my bayes_seen and bayes_toks files to other users? Using qmail with vpopmail

Re: Learning and verifying ham

2007-12-08 Thread Matt Kettler
Asif Iqbal wrote: On Dec 7, 2007 10:13 PM, Matt Kettler [EMAIL PROTECTED] wrote: Asif Iqbal wrote: Hi All I took a message and learned it as ham like this cat email-with-headers | sa-learn --ham Now I should expect the exact same email to be considered as ham. Correct

Re: only simple text rules work, no regex at all

2007-12-08 Thread Matt Kettler
irzyxel wrote: ive created a custome.cf in my spamassassin folder, sa is readin it, cause my simple text rule body TEST_RULE /gwx/ score TEST_RULE 0.1 0.1 0.1 0.1 describe TEST_RULE Test Regel is working. but as soon as i do the slightest regex, it doesnt trigger anymore ... rawbody

Re: spamd throughput issues

2007-12-10 Thread Matt Kettler
Philipp Snizek wrote: You use Bayes? Have you tried turning off auto_expire? From my expierence this can cause significant performance issues. It shouldn't cause performance issues. It should only cause, at worst, one message every 12 hours or so to take a long time (ie: 10 minutes).

Re: add_header error

2007-12-10 Thread Matt Kettler
[EMAIL PROTECTED] wrote: hi all, I add this lines in user_prefs: add_header spam Flag _YESNOCAPS_ add_header all Level _STARS(*)_ add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ add_header all Tests _TESTS_ add_header all Autolearn _AUTOLEARN_ \n Version=_VERSION_ add_header

Re: Razor Problems

2007-12-11 Thread Matt Kettler
Marc Perkel wrote: What causes this? reporter: razor2 report failed: No such file or directory report requires authentication You didn't run razor-admin --register?

Re: Razor Problems

2007-12-11 Thread Matt Kettler
Michael Grant wrote: On Dec 12, 2007 1:09 AM, Matt Kettler [EMAIL PROTECTED] wrote: Marc Perkel wrote: What causes this? reporter: razor2 report failed: No such file or directory report requires authentication You didn't run razor-admin --register? Funny, I too

Re: Razor Problems

2007-12-12 Thread Matt Kettler
Michael Grant wrote: -report? Ahh, I had to do a razor-admin like this: su - root # razor-admin -create # razor-admin -register Even though I had done this initially as just 'su', it was using my homedir to create the .razor directory. Yep. Technically you only needed the -,

Re: AWL: dont understand it

2007-12-12 Thread Matt Kettler
peter pilsl wrote: sorry for posting again a question regarding the same topic, but I think I found out more in the meantime and can ask a better question. I've a user [EMAIL PROTECTED] with the following entries in my autowhitelist: 20.0(40.0/2) -- [EMAIL

Re: Manuel check vs. auto

2007-12-13 Thread Matt Kettler
Theo Van Dinter wrote: On Thu, Dec 13, 2007 at 11:29:21AM -0500, Randy Ramsdell wrote: I have doing some checking of spam messages that make it through our mail filtering systems and noticed that the spam score does not reflect what I get when checking manually. An example spam report:

Re: Custom Plugins

2007-12-13 Thread Matt Kettler
Jason Bennett wrote: Is there a central repository somewhere of custom plugins available for SA? I've find a few in the wiki but I was wondering if there was a site that had a good selection of them? Well, the wiki has a list 29 of them, which I would consider more than a few:

Re: blackholes.us ?

2007-12-17 Thread Matt Kettler
Per Jessen wrote: John Rudd wrote: The server is in Germany - anyway, I can't be bothered to deal with a mailadmin who rejects based on blackholes.us ... I just curious given the staleness of the data. If the server is in Germany, then I don't see how staleness of the data

Re: blackholes.us ?

2007-12-18 Thread Matt Kettler
Per Jessen wrote: Matt Kettler wrote: Per Jessen wrote: It doesn't as far as the rejected mail goes - but it does matter wrt the usefulness of blackholes.us. Which is all I'm asking about. True. Although this is the SpamAssassin mailing list, so, within context

Re: Custom Plugins

2007-12-18 Thread Matt Kettler
Alex Woick wrote: Matt Kettler schrieb am 14.12.2007 03:46: 1) Plugins are somewhat new to SA (ie: 3.0.0 and higher) 2) While not really hard, the work involved in making a sa plugin is non-trivial 3) You have to know perl. The real challenge in writing a plugin is not the coding itself

Re: [guinevere-discuss] Lint errors in 3.4

2007-12-18 Thread Matt Kettler
Clay Davis wrote: I've see several people write this. Can someone point me to some debate I can review? It seems to me that if you set the autolearn threshold fairly high and keep any eye on your bayes scoring, it would be a good thing. IMHO, autolearning is a good thing. However,

Re: Rules penalizing The BAT!

2007-12-18 Thread Matt Kettler
Ken Morley wrote: I'm using Postfix 2.4.6, Amavisd-new 2.5.2, ClamAV 0.91.2 and Mail-SpamAssassin 3.2.3 in a Linux mail filter. As I recall, SA used to have some rules that penalized e-mail originating from mass-emailing applications like The Bat!. I see some of these now slipping

Re: [guinevere-discuss] Lint errors in 3.4

2007-12-18 Thread Matt Kettler
Joe Zitnik wrote: On 12/18/2007 at 9:00 AM, Matt Kettler [EMAIL PROTECTED] wrote: Clay Davis wrote: I've see several people write this. Can someone point me to some debate I can review? It seems to me that if you set the autolearn threshold fairly high and keep any eye on your bayes

Re: blackholes.us ?

2007-12-18 Thread Matt Kettler
Per Jessen wrote: Matt Kettler wrote: That's easily checked - we could run a comparison of any up-to-date geoip database against blackholes.us. True. Well, I've answered my own question. I ran a test of maxmind addresses dated 2007/04/04 against the blackholes.us data

Re: How often is the main rules channel updated?

2007-12-19 Thread Matt Kettler
James E. Pratt wrote: -Original Message- From: Dan Grossman [mailto:[EMAIL PROTECTED] Sent: Tuesday, December 18, 2007 7:21 PM To: users@spamassassin.apache.org Subject: How often is the main rules channel updated? I'm worried that my cronjob for sa-update is not working

Re: Stop tests when score is high

2007-12-20 Thread Matt Kettler
Paolo De Marco wrote: Hi. There is a way to stop tests when the score of the mail is higher then a value? Not in a general sense, but there is a shortcircuit plugin that can be used to stop checking when a particular rule hits. You can also use the rule priority to cause the trusted

Re: Deleting from server

2007-12-20 Thread Matt Kettler
Chris wrote: Can anyone let me know how to delete from server, if the score is over 8 please ? Any help appreciated. Spamassassin itself can't delete mail, as it has no control over the envelope. If it tried, most tools that call SA would assume it crashed and recover the original, unscanned

Re: SpamAssassin 3.2.3 looks for user_prefs in the wrong place

2007-12-20 Thread Matt Kettler
R. Portier wrote: Hello, Context === I use SpamAssassin 3.2.3 on Debian 4.0 i386 spamd is invoked with options : -u spamassassin -m 5 -H /etc/spamassassin (-D -u spamassassin -m 5 -H /etc/spamassassin when in debug mode) The home for user spamassassin is /none (this directory does

Re: SpamAssassin 3.2.3 looks for user_prefs in the wrong place

2007-12-20 Thread Matt Kettler
Remy PORTIER wrote: Hello, Thank you for your answer. I agree with you, but there is still something puzzling me. I have an old SpamAssassin 3.0.3 running on another server. Pretty much the same configuration (running as user spamassassin, allow_user_prefs 1, ...). This old version of

Re: spam rules

2007-12-20 Thread Matt Kettler
Yet Another Ninja wrote: On 12/20/2007 10:44 PM, jikke wrote: Hi, I'm new to SpamAssassin and have checked the web on spam rules. I just can't seem to find the info I'm looking for. I want to create a rule where all mail to [EMAIL PROTECTED] with a certain text like 'new message' is passed

Re: Local.cf partially obeyed

2007-12-22 Thread Matt Kettler
rboynton wrote: We're using 3.2.3 with Mailtraq calling the spamd. If I change the required_score to 9.0 and reboot the system, spam messages still show the required=6.3. We have no user_prefs defined. I assume by this you mean your user_prefs file is empty... If you mean something else,

Re: issues starting spamd

2007-12-24 Thread Matt Kettler
Saurabh Bhasin wrote: Hello, I recently upgraded to p5-Mail-SpamAssassin-3.2.3. The vpopmail version I'm using is: pkg_info | grep vpop p5-vpopmail-0.08Perl module to provide access to vpopmail API qmailadmin-1.2.10,1 CGI program for administering Qmail with vchkpw/vpopmail

Re: Spamassassin Upgrade

2007-12-27 Thread Matt Kettler
Nikos K. wrote: Dear All, I had a mail server with the following characteristics: Redhat9 (Kernel 2.4.20-8) Squirrelmail-1.4.3a-1 Spamassassin 3.0.1. The mail server was working fine but the spamassassing was missing a lot of spam messages. So, I tried to upgrade it to version 3.1.8. by

Re: question on reverse DNS

2007-12-29 Thread Matt Kettler
Leonardo Rodrigues Magalhães wrote: i would like to give some score for messages that came from IP addresses that does not have the reverse correctly configured. I have seen a lot of IPs that have some reverse name, but that name does not point back to the IP address. is it possible

Re: Headers not being updated

2007-12-29 Thread Matt Kettler
Henk S wrote: I experience the same problem. Lots of spam and normal e-mail have X_Spam_Status: No, score=. And X_spam_Flag: NO But not all. Sometimes it is: Yes, score=7.7 and marked as spam, sometimes No, score=2.0 and ofcourse not marked as spam. Even No, score=0.0. What is causing this

Re: sending the entire message for scanning (was Re: spamc/spamd failure)

2008-01-02 Thread Matt Kettler
Justin Mason wrote: Theo Van Dinter writes: It depends on your SA version. It used to be 256k, but apparently 3.2 upped it to 500k. not be an issue. These messages are well below 256M. milter-spamc only sends down the first 64K of the message in fact. Wow, that would

Re: Question about getting a blacklist included in SA

2008-01-02 Thread Matt Kettler
Marc Perkel wrote: I was wondering about how to get a blacklist included in the SA distribution. I have a blacklist and whitelist that are both very good. I've been publishing it for about a year now. But I have a few questions. What are the licensing requirements that I have to give to be

Re: Spamassassin fallback to process owner.

2008-01-03 Thread Matt Kettler
Sven Juergensen (KielNET) wrote: Hi list, i was posting this subject a while ago and recently had some time to look into it some more. Apparently, whenever $SOMETHING isn't part of the envelope and/or body, spamassassin falls back to the user which is owning the process. Spamassassin

Re: Question about getting a blacklist included in SA

2008-01-03 Thread Matt Kettler
Per Jessen wrote: Matt Kettler wrote: What kind of bandwidth does it usually pull from servers when it is part of the default distribution? I have 5 servers now at 3 locations and soon to add a 6th at a 4th location. Is this enough? For that, I have no clue.. probably not a lot

Re: [Sare-users] Spam content checker

2008-01-04 Thread Matt Kettler
Sg wrote: Hi Thanks your reply. Already I went through the site , but we are using Linux with Spamassasin. We need to check the newsletter's body content only in SA. Please tell me the exact rules in SA for spamassassin body content. There's hundreds of rules for body content used in

Re: New credit card scams .. how to catch these

2008-01-04 Thread Matt Kettler
ram wrote: https://ecm.netcore.co.in/tmp/dinner.eml.txt The scam works like this: They send you a mail asking wether you accept credit cards at your hotel They get you to confirm you will accept credit card for payment. Once you agree they ask you to bill them extra fictional charges

Re: (no report template found)

2008-01-04 Thread Matt Kettler
Loren Wilton wrote: There is a standard template that gives the form of the report in the mail message. I don't recall which cf file this is normally in, but it sounds like that file is not being included in the cf files in your configuration. I would check include paths and possibly

Re: Whitelist_from_rcvd not working

2008-01-05 Thread Matt Kettler
Dan Barker wrote: [9060] dbg: metadata: X-Spam-Relays-Trusted: There are no trusted relays. [9060] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=169.200.184.174 rdns= helo=sls-sn-smtp-pmail3.wachovia.com by=mail.visioncomm.net ident= envfrom= intl=0 id= A1253F3B0064 auth= msa=0 ] [

Re: How to restart the spamassassin in command prompt

2008-01-07 Thread Matt Kettler
Sg wrote: Hi Thanks for your reply. I need to checck the body content only not header. What are all the rules used to check only body content? You already asked this question, and I already answered it in your thread titled Spam content checker: -- There's hundreds

Re: Spamassassin fallback to process owner.

2008-01-07 Thread Matt Kettler
Sven Juergensen (KielNET) wrote: Hello Matt, turns out that the script supplied by the designers of the whole mess is, well, suboptimal. I kicked it entirely and used a single command line to run a per-recipient checking. Just for info: whenever spamc can't find the $recipient or is lacking a

Re: Problem with handle_user

2008-01-07 Thread Matt Kettler
Stefan Suurmeijer wrote: Hi list, I'm trying to use spamassassin with per-user rules on a machine running Linux with sendmail 8.14.2 and cyrus imapd 2.2.12. I'm running into a small problem: it seems that spamd doesn't know which user the mail is intended for and therefore always uses the

Re: auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile

2008-01-08 Thread Matt Kettler
Noah wrote: Hi there list, I installed the following spamassasin proggies on my FreeBSD machine and receiving an error auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile Any clues what I am doing wrong? # pkg_info | grep Spam p5-Mail-SpamAssassin-3.2.3 A highly

Re: Problem with handle_user

2008-01-08 Thread Matt Kettler
Stefan Suurmeijer wrote: Hi Matt, On Jan 8, 2008 2:36 AM, Matt Kettler [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: Stefan Suurmeijer wrote: Jan 8 00:47:29 smtp1 spamd[11786]: spamd: connection from localhost [ 127.0.0.1 http://127.0.0.1 http://127.0.0.1

Re: [OT] Volume of mail thru SpamAssassin.

2008-01-08 Thread Matt Kettler
Ben Lentz wrote: Has anyone done anything like this? Any suggestions on how to do it? Any other way to get the count? man mailstats I like mailgraph: http://mailgraph.schweikert.ch/ There's also six dozen other tools out there that will graph using rrdtool or MRTG. A simple web search

Re: [Sare-users] Spam content checker

2008-01-08 Thread Matt Kettler
Sg wrote: Hi In the SA rules, i've hide the header test names in all the .cf files and restarted the spamassassin. But i believe, it displaying wrong result (compared this with lyris content checker). Please guide me, how to check the score for content checker using SA rules. Since SA is

Re: [Sare-users] Spam content checker

2008-01-08 Thread Matt Kettler
using any API (php, perl, python)? Thanks Sg On Jan 9, 2008 5:51 AM, Matt Kettler [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: Sg wrote: Hi In the SA rules, i've hide the header test names in all the .cf files and restarted the spamassassin. But i believe

Re: Crazy AWL score

2008-01-09 Thread Matt Kettler
Michael Weber wrote: Hello! I have gotten several emails over the past 3 weeks with a really crazy AWL score. Here's the headers from a message with a 4138 AWL score. Where should I begin looking for this one? That's so crazy, I'd want to see the AWL debugging.. spamassassin -D

Re: USER_IN_WHITELIST Rule

2008-01-11 Thread Matt Kettler
Matthew Goodman wrote: Why does spam continually get a “hit” on this rule? I noticed a lot more spam coming in off the upgrade to 3.2.4. Are spammers getting crafty with their mail messages to appear as coming from myself TO myself? I could always reduce the adjustment that USER_IN_WHITELIST

Re: I'm still getting question marks in spam scores.

2008-01-11 Thread Matt Kettler
fchan wrote: Hi, I updated from spamassassin 3.2.3 to 3.2.4 and I'm still getting these question marks in score from spamassassin. Here is a sample of the header I get with this message: Return-Path: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Received: (qmail 23882 invoked by uid 501);

Re: Problem with handle_user

2008-01-12 Thread Matt Kettler
Matthew Goodman wrote: I am also having this error in my spamd.log file. Spamd is being run with: SPAMD_OPTS=-c -d -v -m 40 -s local4 -q -u vpopmail --virtual-config-dir=/var/vpopmail/domains/%d/%l/.spamassassin/ -H /var/vpopmail And spamc is being called by qmail-scanner-2.01 with

Re: Problem with handle_user

2008-01-13 Thread Matt Kettler
Matthew Goodman wrote: A downgrade to SpamAssassin 3.2.3 returns functionality with per-user settings immediately. Any notes on what handle_user does and whether this is a new function of 3.2.4? It's not new. In fact, it was introduced into spamd somewhere between SA 1.3 (October 2001) and

Re: are the NORMAL_HTTP_TO_IP scores still valid?

2008-01-16 Thread Matt Kettler
Jason Haar wrote: Hi there I just got a one-line piece of spam with a ipaddress-based URL. Probably pointing at some auto infect your Windows PC app. Anyway, it got a score of 0.1 out of 5 when it came in. 4 hours later it had showed up in several RBLs and the score was pushed up to 4.9.

Re: Problem with sa-learn and virtual user

2008-01-17 Thread Matt Kettler
Jean-Edouard Babin wrote: Hi, My mail system use virtual user. I use spamd like this spamd --virtual-config-dir=/srv/spamassassin/%d/%l -x -u dovecot -c -i 127.0.0.1 http://127.0.0.1 -d -r /var/run/spamd.pid I run spamc with /usr/pkg/bin/spamc -u ${recipient} -f -e ... This work fine, each

Re: disable all network test except ...

2008-01-18 Thread Matt Kettler
Stefan Jakobs wrote: Hello list, I'm using amavisd-new with spamassassin and for some tests I have to disable all network tests in spamassassin except for sorbs, njabl, uribl and maybe some other blackhole lists. I guess I can comment out the corresponding header lines in the files

Re: more efficent big scoring

2008-01-18 Thread Matt Kettler
You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows for good, efficient use of memory cache. By running rules in score-order,

Re: more efficent big scoring

2008-01-19 Thread Matt Kettler
Robert - elists wrote: You can't run the rules in score-order without driving SA's performance into the ground. The key here is SA doesn't run tests sequentially, it runs them in parallel as it works its way through the body. this allows for good, efficient use of memory cache. By running

Re: more efficent big scoring

2008-01-19 Thread Matt Kettler
Matt Kettler wrote: No, I'm saying it breaks the emails into pieces, then for the first piece, it runs all the rules. Then it runs all the rules on the second piece, and the third, and the fourth, etc. Forcing score order causes it to run the whole message on one rule, then then whole

Re: more efficent big scoring

2008-01-20 Thread Matt Kettler
Loren Wilton wrote: Well, it looks like I need to spend some time reading the code to study exactly how SA runs rules, and see if it's doing something that pollutes the memory cache, which would cause the over-sorting to not matter.. As best I recall, it runs rules by type, and sorted by

Re: user_prefs rules not being used

2008-01-21 Thread Matt Kettler
[EMAIL PROTECTED] wrote: I'm running SpamAssassin version 3.1.8 on SuSE 9.3. Spamassassin is invoked through amavisd. I have a series of whitelist_from commands in my /etc/mail/spamassassin/local.cf, which spamassassin recognizes. I also have allow_user_rules 1 in my local.cf. However,

Re: Expiry problem

2008-01-23 Thread Matt Kettler
Steven Stern wrote: We had a server go crazy last night and reset its date into August of 2277. In any case, we've resolved that, but now I can't get bayes to expire. After the clocks was correctly set, I deleted all tokens that had a lastupdate in the future, and also removed similar

Re: whois plugin .. where to get it

2008-01-23 Thread Matt Kettler
Giampaolo Tomassoni wrote: Right, it is. The URIWhois does not detect the registrar. It detects the name and the address of the DNS- and whois-defined NSes for that domain. So how is this substantially different from the URIDNSBL plugin that comes with SA? Bear in mind this plugin

Re: Fired rules stats understanding

2008-01-24 Thread Matt Kettler
Sébastien AVELINE wrote: Hello, You will find my top rules fired with spamassassin. I have spamassassin on several boxes, each have his own bayes_db files, I use razor, dcc_check, uribl, bayes We have hundreds of thousand messages per day. In my top rules for spam you will see a lot of

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
John D. Hardin wrote: On Thu, 24 Jan 2008, Jeff Chan wrote: Quoting Matt Kettler [EMAIL PROTECTED]: The only big difference I see at face value is it uses whois instead of DNS to find the NS records.. that hardly seems efficient.. Whois is definitely the wrong protocol to use

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
Giampaolo Tomassoni wrote: -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Thursday, January 24, 2008 6:38 AM Giampaolo Tomassoni wrote: Right, it is. The URIWhois does not detect the registrar. It detects the name and the address of the DNS

Re: whois plugin .. where to get it

2008-01-24 Thread Matt Kettler
Matt Kettler wrote: Giampaolo Tomassoni wrote: It doesn't use whois *instead of* dns. It uses both and attempts even to detect any discrepancy between their responses. How are these going to be different?? The information published to whois has to match the information published

Re: Particular subject blacklist seems not to work

2008-01-24 Thread Matt Kettler
[EMAIL PROTECTED] wrote: I am running SpamAssassin version 3.1.7 with Postfix via amavisd on a FreeBSD machine. In the last few weeks, all of a sudden messages with the same 4 or 5 subject lines started coming through undetected for some reason. So I decided to add patterns matching those

Re: unsubscribe

2008-01-25 Thread Matt Kettler
Post to the unsubscribe address, not the list. See the headers of any message: List-Unsubscribe: mailto:[EMAIL PROTECTED] Andrew Xiang wrote:

Re: whois plugin .. where to get it

2008-01-25 Thread Matt Kettler
Jeff Chan wrote: Quoting Matt Kettler [EMAIL PROTECTED]: Matt Kettler wrote: Giampaolo Tomassoni wrote: It doesn't use whois *instead of* dns. It uses both and attempts even to detect any discrepancy between their responses. Both types of queries can cause problems. How are these going

Re: Gateway_antispam

2008-01-25 Thread Matt Kettler
Pardeep Sharma wrote: Hello sir , Is it possible to configure spamassassin at the gateway machine without using any MTA or mail server to protect spam mail for internal mailserver Do you mean like a transparent SMTP proxy? That's ugly business, but if you really want to go

Re: whois plugin .. where to get it

2008-01-25 Thread Matt Kettler
Giampaolo Tomassoni wrote: -Original Message- From: Matt Kettler [mailto:[EMAIL PROTECTED] Sent: Friday, January 25, 2008 2:21 AM Ahh, I see what you're doing, you're looking up the SOA. Which is basically forcing the query down to the spammer's DNS server, and opening yourself up

Re: No Bayes Headers (no errors in debug/logs)

2008-01-27 Thread Matt Kettler
Mitchell Hudson wrote: Hello there, I have spamassassin loaded and is running pretty well, it's supposed to be using bayes and I can't find any errors that would tell me why it's not, but it's not. When I do a debug log there are no db connection errors, in fact it's auto-learning just fine.

Re: p0f not catching Windows XP

2008-01-27 Thread Matt Kettler
McDonald, Dan wrote: I'm using amavisd-new and p0f with BOTNET.pl, and some Windows XP machines are not being caught. Here are my rules: header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP(?![^(]*\b2000 SP)/ score L_P0F_WXP 2.3 header L_P0F_W X-Amavis-OS-Fingerprint =~ /^Windows(?!

Re: No Bayes Headers (no errors in debug/logs)

2008-01-27 Thread Matt Kettler
Matt Kettler wrote: Mitchell Hudson wrote: Hello there, I have spamassassin loaded and is running pretty well, it's supposed to be using bayes and I can't find any errors that would tell me why it's not, but it's not. When I do a debug log there are no db connection errors, in fact it's

Re: p0f not catching Windows XP

2008-01-27 Thread Matt Kettler
Mark Martinec wrote: header L_P0F_WXP X-Amavis-OS-Fingerprint =~ /^Windows XP(?![^(]*\b2000 SP)/ score L_P0F_WXP 2.3 header L_P0F_W X-Amavis-OS-Fingerprint =~ /^Windows(?! XP)/ score L_P0F_W 1.0 [...] Matt Kettler wrote: Well, that much should be obvious. Both rules

Re: spamassassin accuracy test

2008-01-28 Thread Matt Kettler
Hard Coder wrote: Hello, I decided to benchmark the accuracy of spamassassin. Is there anything special I should take into consideration before I start to flood with both ham and spam? It's probably easiest if you have them on disk and use the mass-check utility.

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Matt Kettler
Mitchell Hudson wrote: I did actually pull out the number of tokens and I have quite a few in there: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23930 0 non-token data: nspam 0.000 0 8304 0 non-token data:

Re: One SPAM that got through

2008-01-28 Thread Matt Kettler
--[ UxBoD ]-- wrote: Hi, I just had this message get through :- snip and it only scored 5.6. These are the rules it hit :- 1.23 ADVANCE_FEE_2 0.00 BAYES_50 0.72 SARE_URGBIZ Contains urgent matter -0.00 SPF_PASS 2.08 SUBJ_ALL_CAPS 1.58 URG_BIZ Looks like you might want to do

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
Note: I fixed your subject line to try to draw the attention of the right people. Generic subject lines tend to get overlooked by folks with specific interests, since many just skim the subject lines. David Zinder wrote: I think my problem is related to surbl.org, but I can't figure out how

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
David Zinder wrote: Thank you for the response and suggestions. Yes - lists.surbl.org - I was using the link Contacts-mailing lists from www.surbl.org If I understand the request for more info... It seems to get caught by all the lists. Here is an example from an email this morning. I'm not

Re: Can anyone help me? surbl.org FP problems?

2008-01-29 Thread Matt Kettler
John Hardin wrote: On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: Perhaps Verizon is screwing up their DNS? Ahh, yes they are: http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this increasingly-common feature, perhaps a URIBL/DNSBL rule could

Re: envelope and From: sender matching rule

2008-01-30 Thread Matt Kettler
Cirrus wrote: i'm looking for any rule which can check if sender address given in envelope matches address given in header From: field. Why? This isn't generally a useful rule, as mismatches are very common. For example, this mailing list (or any other mailing list).. The From: header will

Re: over zealous awl

2008-01-30 Thread Matt Kettler
Michael Grant wrote: I noticed when I use spamassasin -r that it seems to add virtually every email address inside the email to the auto-whitelist db with high values (ie it's blacklisting them), even my own address, even addresses in received header lines. This isn't what I expected, I would

Re: Can anyone help me? surbl.org FP problems?

2008-01-30 Thread Matt Kettler
mouss wrote: Matt Kettler wrote: John Hardin wrote: On Tue, 2008-01-29 at 17:51 -0500, Matt Kettler wrote: Perhaps Verizon is screwing up their DNS? Ahh, yes they are: http://www.freedom-to-tinker.com/?p=1227 Hrm. As a troubleshooting hack for this increasingly-common feature

mass-check wiki page needs updating..

2008-01-30 Thread Matt Kettler
According to the wiki: http://wiki.apache.org/spamassassin/MassCheck mass-check lives in the masses of the source tarball. This was true for SA 3.1.x and older, but 3.2.x no longer includes it. It can still be grabbed SVN, or even the web interface to SVN, but the wiki should point to the

Re: mass-check wiki page needs updating..

2008-01-30 Thread Matt Kettler
Theo Van Dinter wrote: On Wed, Jan 30, 2008 at 03:07:43PM +, Justin Mason wrote: The big question is, where do the devs think folks should go to get it? from SVN directly, I guess. http://svn.apache.org/repos/asf/spamassassin/trunk/masses ... Yes. The main idea was to

Re: mass-check wiki page needs updating..

2008-01-31 Thread Matt Kettler
Justin Mason wrote: quick survey: Is anyone using mass-check without previously having SVN set up? Is this turning out to be a major barrier? Should we put mass-check back into the distro? Good survey, although I highly doubt anyone is using it that wouldn't be able to get it from SVN with

Re: Can anyone help me? surbl.org FP problems?

2008-01-31 Thread Matt Kettler
David Zinder wrote: What should dig return? I too have Verizon fios. If /etc/resolve.conf contains their DNS servers I get similar dig results as you. If I change it to DNS servers I trust I get: $ dig techweb.com.multi.surbl.org ; DiG 9.2.4 techweb.com.multi.surbl.org ;; global options:

Re: Bulk spam scan

2008-01-31 Thread Matt Kettler
Martin Gregorie wrote: spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do? Not what I expected,

Re: Bulk spam scan

2008-01-31 Thread Matt Kettler
Matt Kettler wrote: Martin Gregorie wrote: spamassassin --mbox mbox scanned.mbox No, SA doesn't know how to split up messages for scanning; sa-learn is the only SA component that can extract messages from an mbox mail folder. In that case, what does the --mbox option do

<    1   2   3   4   5   6   7   8   9   10   >