RE: FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Sietse van Zanen
And you have added all the users, that need access to the users group in /etc/group? IE your /etc/group file contains a line like: users:x:100:user1,user2,user3,user4,useretc If so, than it is spamassassin that does not switch the user context correctly. -Sietse From: Robert S Sent: Tue

Re: ??

2006-11-21 Thread Philip Prindeville
John D. Hardin wrote: On Mon, 20 Nov 2006, twofers wrote: I would like to know what local rule I could invoke to tag email that the subject is not in english. header NOT_IN_ENGLISH Subject !~ /English/i describe NOT_IN_ENGLISH Subject Contains Non English

Them spammers are getting smarter..

2006-11-21 Thread Evan Platt
So used to be mail from Richard Smith, subject Me again Richard. Now they're using the last name, ie Me again Smith I'm almost at the point of rejecting anything with the subject Me again... Off topic: In postfix in header_checks, can I specity something at the START? ie if I say /Me again/

Re: ****Re: blarsbl

2006-11-21 Thread Craig White
On Tue, 2006-11-21 at 12:07 -0500, DAve wrote: Thomas Lindell wrote: Att mail servers use his service. Which means I can't send to mediacom which is an att partner I couldn't believe att used his service. What's odd is that my company uses att backhaul bandwidth in the form of

FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Robert S
I've installed this FuzzyOcrPlugin on two machines (debian and gentoo). Everything works fine on the gentoo box, but on the debian box I get the following in the error log: [2006-11-20 04:06:11] Unable to open/create Image Hash database at /usr/local/var/FuzzyOcr/FuzzyOcr.hashdb, check

Re: amavisd-new or mailscanner?

2006-11-21 Thread Ralf Hildebrandt
* Mark Martinec [EMAIL PROTECTED]: As far as invoking SA and getting its results, it should be about the same. You forget your own p0f fingerprinting :) -- Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED] Charite - Universitätsmedizin BerlinTel. +49 (0)30-450

Re: DNS Whitelist - rule optimization

2006-11-21 Thread Matthias Leisi
Theo Van Dinter wrote: My suggestion was going to be to have the plugin define tags that can be used via add_header. No need for calling add_header() internally. Sounds like an interesting idea. Since I've never written plugins for SA: what is the best starting point / documentation?

RE: Is my Bayes DB borked?

2006-11-21 Thread Kurt Buff
Nope - it's not that. Looking through my syslog more closely reveals that I'm getting 'SA TIMED OUT' messages all over the place, and referring to rules as well as Bayes. So, I'm just as confused as ever, and don't know what's going on. More analysis needed, I suppose, but I'm not sure where to

Re: Greylisting

2006-11-21 Thread uxbod
Just to add to the pot I have started working for a company who was receiving +30,000 emails a day and acknowledged they had a spam problem. I got the go ahead to pilot Postfix, MailScanner, SpamAssassin + FuzzyOCR and PolicyD and have now reduced that to ~ 40 emails per day being delivered.

Re: blarsbl

2006-11-21 Thread DAve
Thomas Lindell wrote: Att mail servers use his service. Which means I can't send to mediacom which is an att partner I couldn't believe att used his service. What's odd is that my company uses att backhaul bandwidth in the form of 4 t1's Grr the whole thing is frustrating Tom

if plugin lines with else functionality?

2006-11-21 Thread Fred T
Hello users, Does anyone thing it might be nice to have if plugin lines with else functionality? Say we create some nice rules that rely on plugins but those plugins aren't available, if we could create alternate rules for when the plugins are not available it might help in some cases.

Re: Them spammers are getting smarter..

2006-11-21 Thread Karl Auer
On Tue, 2006-11-21 at 12:33 -0800, Evan Platt wrote: In postfix in header_checks, can I specity something at the START? ie if I say /Me again/Reject I only want to reject Me again Smith but not Hey, it's Me again... Put a caret at the start of the pattern: /^Me again/. To anchor

Re: blarsbl

2006-11-21 Thread DAve
Thomas Lindell wrote: Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that runs the

Re: Them spammers are getting smarter..

2006-11-21 Thread Kelson
Theo Van Dinter wrote: On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote: So used to be mail from Richard Smith, subject Me again Richard. Now they're using the last name, ie Me again Smith FWIW, this is why it's pointless to try keeping up with those things. There's an infinite

Re: user_prefs not used

2006-11-21 Thread twofers
Are you saying that you have separate rules in user_prefs and those rules are not being processed? or are you talking about just configuration lines in user_prefs like use_bayes 1? Wes Chris Willard [EMAIL PROTECTED] wrote: Hi all, I am using spamd and calling spamc from .procmail

Re: spammers dodging OCR

2006-11-21 Thread alex
lol, just got a spam with the image obfuscated like captchas in a bbs, to avoid detection by ocr. On Mon, Nov 06, 2006 at 02:06:45PM -0600, Jorge Valdes wrote: Gary V wrote: This morning I received my copy of networkworld. Here is an interesting article:

Re: Log Mail Caught As Spam

2006-11-21 Thread Panagiotis Christias
On 11/20/06, itdelany [EMAIL PROTECTED] wrote: François Rousseau wrote: In your log, do you have any things like top 10 spammer, 10 top spam ... or something like this? URIBL_AB_SURBL=3.812, URIBL_PH_SURBL=2.8, URIBL_SC_SURBL=4.498, URIBL_WS_SURBL=2.14] those tags indicate

Re: Bayes Database Missing

2006-11-21 Thread twofers
You can try: mkdir /var/lib/MailScanner/ #Creates the directory cp /etc/mail/spamassassin/bayes* /var/lib/MailScanner/ #Copies the bayes databases from the default spamassassin directory to the bayes_path directory /etc/init.d/spamassassin restart or /etc/init.d/psa-spamassassin

Re: Bayes column 'token'

2006-11-21 Thread Jonas Eckerman
CREATE TABLE bayes_token ( PRIMARY KEY (id, token), INDEX bayes_token_idx1 (token), INDEX bayes_token_idx2 (id, atime) ) TYPE=MyISAM; PRIMARY for `id` and `token` should not have INDEX for `id` and `token` added, too. Why not? IIRC the three indexes above makes perfect sense. Like

joe-job/backscatter

2006-11-21 Thread Chris
Anyone else seeing anything like this? I've been getting these for about two days or so now: Return-Path: Received: from pop.earthlink.net [209.86.93.201] by localhost with POP3 (fetchmail-6.2.5) for [EMAIL PROTECTED] (single-drop); Tue, 21 Nov 2006 13:19:50 -0600 (CST)

Re: would SA benefit from port to Java

2006-11-21 Thread Justin Mason
Giampaolo Tomassoni writes: Recently in the perl blead code, one of the perl hackers has added a trie-based regexp matcher (with Aho-Corasick optimisations) to efficiently match multiple regular expressions in parallel, to the perl core regexp matching code. That's pretty

Re: FuzzyOcr and blank lines?

2006-11-21 Thread Marc Perkel
Matthias Keller wrote: Marc Perkel wrote: I'm running the latest one that is not the devel version. Bill Landry wrote: Marc Perkel wrote the following on 11/19/2006 6:15 PM -0800: Does FuzzyOCR not skip blank lines? * 33 FUZZY_OCR BODY: Mail contains an image with common spam

Re: blarsbl

2006-11-21 Thread snowcrash+spamassassin
[EMAIL PROTECTED]: host gateway.mchsi.com[204.127.203.150] said: 550-12.175.23.161 blocked by ldap:ou=rblmx,dc=mso,dc=att,dc=net 550 Blocked for abuse. Please contact the administrator of your ISP or sending mailservice. (in reply to MAIL FROM command) aha. the mchsi-variant of

Re: blarsbl

2006-11-21 Thread Marc Perkel
DAve wrote: Thomas Lindell wrote: Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that

Re: blarsbl

2006-11-21 Thread snowcrash+spamassassin
On 11/21/06, Thomas Lindell [EMAIL PROTECTED] wrote: Att mail servers use his service. can you please share/point-to some evidence of that fact? if that *is* the case, i'll be chatting with my reps at att! if i've missed it here, i apologize in advance ... thanks.

Redundant QP encoding of Subject/From fields...

2006-11-21 Thread Philip Prindeville
I got the following spam. I've included the header: Return-Path: [EMAIL PROTECTED] Received: from mail.libertysurf.net (webmail-out.libertysurf.net [213.36.80.105]) by mail.redfish-solutions.com (8.13.8/8.13.7) with ESMTP id kAM1ckKs008704 for [EMAIL PROTECTED]; Tue, 21 Nov

Re: getting mail directly and not via mail-relay

2006-11-21 Thread David B Funk
On Mon, 20 Nov 2006, Leon Kolchinsky wrote: Hello, There is a Mail-Relay administered by another person and its MX record stand before MX record of my mail server, so theoretically mail should go first through Mail-Relay to my server. The thing is that for some reason there are much

Re: fuzzyocr 342 fires error warn, but scores anyway ... does it work?

2006-11-21 Thread AnonymousDog
Looks like what happens when your giflib/libungif binaries are not where FuzzyOcr expects them to be. Check your actual paths against those in FuzzyOcr.cf. snowcrash+spamassassin wrote: GIF-LIB error: Failed to Read from given file. but, the message does score: 1.5

Re: FuzzyOcrPlugin hashdb permissions

2006-11-21 Thread Thiago LPS
Here my FuzzyOCR runs with spamd (the daemon of spamassassin) and the default user that run it is the user spamd -rw-r--r-- 1 spamd spamd 433905 Nov 21 08:51 FuzzyOcr.hashdb my FuzzyOcr.hashdb is set to user spamd and all works fine... :) On 11/20/06, Robert S [EMAIL PROTECTED] wrote: I

Re: Àú=·Å=ÇÑ ¼­=¹Î= ÀÚ=±Ý=´ë==Ãô=¾È= ³»~!

2006-11-21 Thread LuKreme
On 20-Nov-2006, at 05:52, twofers wrote: header NOT_IN_ENGLISH Subject !~ /English/i describe NOT_IN_ENGLISH Subject Contains Non English Characters score NOT_IN_ENGLISH 3.5 What regexp could I use? Well, that's tricky. Sometimes the subject is

Bayes database: per-user or system-wide?

2006-11-21 Thread Robert S
I have two mailservers running SA. On one (with a very small number of users), there is a shared bayes database (bayes_path /var/work/bayes/bayes in local.cf), and in the other one I use the default per-user databases. In both machines I run sa-learn as a weekly cron job on spam in a Spam

RE: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Actually I was replying to my forum thread and deleted my original message that it quoted as I thought it had already hit the list. Sietse van Zanen wrote: Probably with him being too lazy to copy and paste his original message from the other board, or list.. Well, I am too lazy to

Re: blarsbl

2006-11-21 Thread Michael W Cocke
On Tue, 21 Nov 2006 10:29:15 -0600, you wrote: Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The

Using SpamAssassin variables

2006-11-21 Thread John W Mickevich
Hello all! I am relatively new to SpamAssassin and subscribing to this group had really helped me in understanding many of SpamAssassin's intricacies. Thanks to everybody who posts replies to the questions asked here. Also, if this is not the proper place for me to post this question, I

Sudden drop in spam-rate, parallel to a surge of new trojans - beware

2006-11-21 Thread Chr. v. Stuckrad
Hi! Yesterday we had a sudden drop in spam-percentage from 80% to near 60%. Parallel to it I got six copies of an undetectable (by NAI and ClamAV) new trojan 'exe' in the Mail. Do we have to prepare for a new flood by an updated (just now reorganizing) botnet? Stucki -- Christoph von Stuckrad

Re: Greylisting

2006-11-21 Thread Charlie Clark
Am 21.11.2006 um 01:12 schrieb John Andersen: On Monday 20 November 2006 15:08, Rick Macdougall wrote: It's possible that they could send it all twice but I've never seen it. Remember that some unbelievable number of infected Windows clients are the main source of spam and it would just

Re: Forged From, Other servers bouncing back

2006-11-21 Thread Kelson
Mark Adams wrote: One of the many spammers around has sent out a LOAD of email from [EMAIL PROTECTED] Currently our server is being over-run by the bounce backs, spamassassin is choking due to the extensive checking it is doing and exim will not accept any more connections. OK, keep in mind

RE: getting mail directly and not via mail-relay

2006-11-21 Thread Leon Kolchinsky
Thanks David, I didn't thought of that simple solution :) Firewall will certainly do the job here. Best Regards, Leon -Original Message- From: David B Funk [mailto:[EMAIL PROTECTED] Sent: Tuesday, November 21, 2006 5:59 AM To: לאון קולצ'ינסקי Cc: users@spamassassin.apache.org

Re: Need an ISP who offers shell account, SA etc....

2006-11-21 Thread John D. Hardin
On Mon, 20 Nov 2006, Robert Nicholson wrote: Is this practical without static ip? Free public dynamic DNS services can make it tolerable. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key:

amavisd-new or mailscanner?

2006-11-21 Thread Michael W Cocke
I started out using amavisd-new then switched to MailScanner as my mail tester 'framework' (SpamAssassin has been a constant) Looking thru the docs of Mailscanner, it doesn't come out and SAY that it just does the 'basic' spam test features, but reading between the lines it seems to - I have a

Re: blarsbl

2006-11-21 Thread hamann . w
Hi, I recently got a call from someone trying to send to my email @t-online.de (this is a division of german telecom). While I believe that my friend's ISP might occasionally send spam (any big isp might get unwanted customers), I searched for blacklists and found that isplisted only at blars.

Is my Bayes DB borked?

2006-11-21 Thread Kurt Buff
My postfix queue is climbing like crazy, and I'm getting *lots* of messages in my syslog that look like this: 2006-11-21 16:50:39 Mail.Warningzetmail3Nov 21 16:54:43 amavis[29824]: (29824-01-4) SA TIMED OUT, backtrace: at

Re: Log Mail Caught As Spam

2006-11-21 Thread Panagiotis Christias
On 11/21/06, itdelany [EMAIL PROTECTED] wrote: Panagiotis Christias wrote: Thanks for your answer, and yes, spam word is everywhere in that email, I forgot to say that I already did an sa-learn -ham on this email. What else can I do ? Hello, you have probably not setup correctly

Re: Greylisting

2006-11-21 Thread Vivek Khera
On Nov 20, 2006, at 7:29 PM, Mike Jackson wrote: FYI, I work for a large hosting provider, and I've seen customers who have implemented greylisting, but spammers are getting smart enough to work around it. I doubt that they're wasting resources on queuing for redelivery, but they are

Re: Bayes column 'token'

2006-11-21 Thread Jonas Eckerman
Michael Alan Dorman wrote: CREATE TABLE bayes_token ( PRIMARY KEY (id, token), INDEX bayes_token_idx1 (token), INDEX bayes_token_idx2 (id, atime) ) TYPE=MyISAM; If the primary key was changed to (token, id), it should be able to be used in the second sort of query as well as the first,

Re: SpamAssassin for FuzzyOCR only

2006-11-21 Thread Odhiambo Washington
* On 21/11/06 12:48 -0500, Theo Van Dinter wrote: | On Tue, Nov 21, 2006 at 08:12:03PM +0300, Odhiambo Washington wrote: | I'd like to run SA with only the minimalist set of config ( and .cf | files) that would suffice to just run FuzzyOCR checks only. | SA version is 3.1.7. | | Interesting.

RE: blarsbl

2006-11-21 Thread Thomas Lindell
Here is what I can give you [EMAIL PROTECTED]: host gateway.mchsi.com[204.127.203.150] said: 550-12.175.23.161 blocked by ldap:ou=rblmx,dc=mso,dc=att,dc=net 550 Blocked for abuse. Please contact the administrator of your ISP or sending mailservice. (in reply to MAIL FROM command)

RE: Not all Stock Spam is bad

2006-11-21 Thread Chris Santerre
-Original Message- From: Jim Maul [mailto:[EMAIL PROTECTED] Sent: Monday, November 20, 2006 2:36 PM To: spamassassin Subject: Re: Not all Stock Spam is bad DAve wrote: Randal, Phil wrote: With FuzzyOCR 3.4.2 and using ocrad, $ocrad -s5 -i $pfile should catch them,

Re: Greylisting

2006-11-21 Thread Benny Pedersen
On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote: Dylan Bouterse wrote: Do you have a compiled list of those IPs? And what method are you using to whitelist? Email offlist if more appropriate. Thanks! We whitelist the main Irish ISPs, so our list wouldn't be of much use to

Re: Bayes Database Missing

2006-11-21 Thread Matt Kettler
leemansvg wrote: I see in my spam.assassin.pref.conf file this entry, bayes_path /var/lib/MailScanner/bayes however when I navigate to this directory this database is not there, is there a way to generate this database. I've been noticing a lot of spam getting through and

Re: Greylisting

2006-11-21 Thread Rick Macdougall
John Andersen wrote: On Monday 20 November 2006 15:08, Rick Macdougall wrote: It's possible that they could send it all twice but I've never seen it. Remember that some unbelievable number of infected Windows clients are the main source of spam and it would just be too much trouble for the

Re: How do I stop these?

2006-11-21 Thread Duncan Hill
On Mon, November 20, 2006 15:00, Nathan Zabaldo wrote: I am getting pounded by these types of emails. Does anyone else get these? What rule can I apply to have them killed. It's driving me nuts. SARE Stock ruleset. Available from fine ninjas everywhere. Well trained Bayes would probably

user_prefs not used

2006-11-21 Thread Chris Willard
Hi all, I am using spamd and calling spamc from .procmail using | /usr/bin/spamc -u chris Only the rules in /ec/mail/spamassassin/local.cf are being processed. My $HOME/.spamassassin/user_prefs file is not being used! /etc/mail/spamassassin/local.cf has allow_user_rules 1 in it but I can not

Re: blarsbl

2006-11-21 Thread Kelson
Michael W Cocke wrote: He is. My system is on his list too, which is pretty amazing when you consider that my mail server supports 3, count them, 3 users - myself, my wife, and my 10 year old son - and he's somehow determined that my site hosts spammers. Last I looked, he listed all of

Re: Bayes Database Missing

2006-11-21 Thread Matt Kettler
Matt Kettler wrote: leemansvg wrote: I see in my spam.assassin.pref.conf file this entry, bayes_path /var/lib/MailScanner/bayes however when I navigate to this directory this database is not there, is there a way to generate this database. I've been noticing a lot of

Re: amavisd-new or mailscanner?

2006-11-21 Thread Ralf Hildebrandt
* Matt Hampton [EMAIL PROTECTED]: What do you mean by more than the 'basic' features? Bear in mind as well that MailScanner and amavisd-new check for spam at completely different stages of the mail processing - amavisd-new at connection time and MailScanner after it has been queued. Tha's

Re: amavisd-new or mailscanner?

2006-11-21 Thread Matt Hampton
Ralf Hildebrandt wrote: * Matt Hampton [EMAIL PROTECTED]: What do you mean by more than the 'basic' features? Bear in mind as well that MailScanner and amavisd-new check for spam at completely different stages of the mail processing - amavisd-new at connection time and MailScanner after it

Bayes Database Missing

2006-11-21 Thread leemansvg
I see in my spam.assassin.pref.conf file this entry, bayes_path /var/lib/MailScanner/bayes however when I navigate to this directory this database is not there, is there a way to generate this database. I've been noticing a lot of spam getting through and would like to tighten

Re: Bayes column 'token'

2006-11-21 Thread Michael Alan Dorman
On Tue, 21 Nov 2006 13:42:09 +0100 Jonas Eckerman [EMAIL PROTECTED] wrote: CREATE TABLE bayes_token ( PRIMARY KEY (id, token), INDEX bayes_token_idx1 (token), INDEX bayes_token_idx2 (id, atime) ) TYPE=MyISAM; PRIMARY for `id` and `token` should not have INDEX for `id` and

RE: Greylisting

2006-11-21 Thread Giampaolo Tomassoni
-Original Message- From: Vahric MUHTARYAN [mailto:[EMAIL PROTECTED] Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's

Re: user_prefs not used

2006-11-21 Thread Loren Wilton
Did you restart spamd after changing any options? Loren

Re: How do I stop these?

2006-11-21 Thread Justin Mason
Duncan Hill writes: On Mon, November 20, 2006 15:00, Nathan Zabaldo wrote: I am getting pounded by these types of emails. Does anyone else get these? What rule can I apply to have them killed. It's driving me nuts. SARE Stock ruleset. Available from fine ninjas everywhere. Well

Re: ??

2006-11-21 Thread John D. Hardin
On Mon, 20 Nov 2006, Philip Prindeville wrote: Of course, that would exclude messages with ISO Latin 1 (8859.1) characters like Yen, Pound Sterling, Trademark, etc. Plus, there are words in English that when properly written do contain accents, such as resume, dais, cliche, cooperation, etc.

Re: DNS Whitelist - rule optimization

2006-11-21 Thread Theo Van Dinter
On Tue, Nov 21, 2006 at 03:21:12PM +, Justin Mason wrote: And a third and last point: Is it possible to add a dedicated header when one of the rules triggered? I see that add_header can only differentiate between spam, ham and all -- any additional options? The idea is that MUAs could

blarsbl

2006-11-21 Thread Thomas Lindell
Has anyone had any dealings with this guy. I take my mail server very seriously. Further I take spamming very seriously in general. Even when I detect one of my customers sending spam I disable there internet until the problem is resolved The guy that runs the blarsbl list wants to charge my

Re: Bayes Database Missing

2006-11-21 Thread leemansvg
sorry, I there's no bayes files in /etc/mail/spamassassin/ directory. I'm using MailScanner. twofers wrote: You can try: mkdir /var/lib/MailScanner/ #Creates the directory cp /etc/mail/spamassassin/bayes* /var/lib/MailScanner/ #Copies the bayes databases from the default

Re: Greylisting

2006-11-21 Thread Philip Prindeville
John Andersen wrote: On Monday 20 November 2006 15:08, Rick Macdougall wrote: It's possible that they could send it all twice but I've never seen it. Remember that some unbelievable number of infected Windows clients are the main source of spam and it would just be too much trouble for the

Re: Problems running Spam Assassin

2006-11-21 Thread Magnus Holmgren
On Sunday 19 November 2006 18:04, CosmicPerl wrote: Hi, I installed the latest SpamAssassin on my server. At first all my tests looked good, apart from load. So I setup spamc and spamd and everything seemed great, for a short while at least. A day later my mqueue had about 1500 messages in

RE: Problems running Spam Assassin

2006-11-21 Thread Sietse van Zanen
These mails stay there for 5 days. At least if you set up sendmail according to RFC's. that's the whole idea of SMTP store and forward. If address is unavailable, keep trying for a while before giving up. You can set the grace time to any period you like btw. -Sietse From: CosmicPerl

RE: Adding new rules for pump and dump

2006-11-21 Thread Chris Santerre
There is a new wave hitting. I've already written rules to catch this simple change the spammers did over the weekend. I expect the results will be very very good. I hope to have the SARE stock ruleset updated later today. So, no you aren't teh only one seeing stock spams slip buy over the

Braindeath in the Navy

2006-11-21 Thread Philip Prindeville
Well, I tried to contact some people responsible for the servers below that what they were doing was broken, including citing chapter and verse where in RFC-2822 in syntax of the Received: lines was spec'd out: Received: from Gate2-sandiego.nmci.navy.mil (gate2-sandiego.nmci.navy.mil

Re: getting mail directly and not via mail-relay

2006-11-21 Thread Stuart Johnston
Leon Kolchinsky wrote: Hello, There is a Mail-Relay administered by another person and its MX record stand before MX record of my mail server, so theoretically mail should go first through Mail-Relay to my server. The thing is that for some reason there are much e-mails (and spam among them

Re: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Hi All, Ok, I've figured that having define(`confSEPARATE_PROC', `True') in my SendMail config was what was causing the flushing of the mail queue to create such a huge server load as it was spawning a new sendmail, procmail, and spamassassin child for each message in the mqueue. So I've

Re: Greylisting

2006-11-21 Thread Andy Jezierski
Vahric MUHTARYAN [EMAIL PROTECTED] wrote on 11/20/2006 04:33:23 PM: Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too

Re: Greylisting

2006-11-21 Thread Michele Neylon :: Blacknight
Vahric MUHTARYAN wrote: Hello, Do you come across with any problem from your clients for mails are not arriving at right time ? Because I afraid of people mta's all of them are configured with different retry times . We whitelist the main ISPs SMTPs to avoid this issue -- Mr Michele

RE: Greylisting

2006-11-21 Thread Randal, Phil
Not to mention that the mail queues are backing up for over half an hour because of all the spam in the first place :-p Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: uxbod [mailto:[EMAIL PROTECTED] Sent: 21 November 2006 15:13 To:

Re: Greylisting

2006-11-21 Thread John D. Hardin
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote: Do you come across with any problem from your clients for mails are not arriving at right time ? Because I afraid of people mta's all of them are configured with different retry times . Whitelist your clients' known MTA IP addresses.

Re: SPF and SMTP AUTH

2006-11-21 Thread Magnus Holmgren
On Tuesday 21 November 2006 12:07, Rene Caspari wrote: Hi, I have a little problem with SPF: For domain.tld there is a SPF record, which says that mail.domain.tld is allowed to sending mails from [EMAIL PROTECTED] If I use mail.domain.tld with a dialin account by SMTP AUTH, spamassassin

Re: Them spammers are getting smarter..

2006-11-21 Thread Theo Van Dinter
On Tue, Nov 21, 2006 at 12:33:36PM -0800, Evan Platt wrote: So used to be mail from Richard Smith, subject Me again Richard. Now they're using the last name, ie Me again Smith FWIW, this is why it's pointless to try keeping up with those things. There's an infinite number of ways they can

Re: Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello, Actually we are receiving too much mail, and % 60 - % 70 of this are spam , also my hardwares are not enough to handle all load because of this I can miss some mails and they are spam. Instead of using fuzzy ocr or any other think I guess that I can use greylisting How they

Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think that try greylisting . I wonder are there anybody use

RE: Not all Stock Spam is bad

2006-11-21 Thread Randal, Phil
With FuzzyOCR 3.4.2 and using ocrad, $ocrad -s5 -i $pfile should catch them, according to a post from decoder on the FuzzyOCR list. And it seems to here. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK -Original Message- From: DAve

Re: blarsbl

2006-11-21 Thread twofers
I'm sure the FTC and US Attorny General's office would like to know about this. All you have to do is write a a letter addressed to Attn: of Consumer Affairs and these guys will check it outin a big way. Wes Thomas Lindell [EMAIL PROTECTED] wrote: Has anyone had any dealings

Re: Greylisting

2006-11-21 Thread Leander Koornneef
On 20-nov-2006, at 23:33, Vahric MUHTARYAN wrote: Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking too much cpu. I think

Re: Greylisting - branching further off topic

2006-11-21 Thread Matt Hampton
Benny Pedersen wrote: On Tue, November 21, 2006 00:23, Michele Neylon :: Blacknight wrote: Dylan Bouterse wrote: Do you have a compiled list of those IPs? And what method are you using to whitelist? Email offlist if more appropriate. Thanks! We whitelist the main Irish ISPs, so our list

Re: Problems running Spam Assassin

2006-11-21 Thread CosmicPerl
Can anyone help with this? -- View this message in context: http://www.nabble.com/Problems-running-Spam-Assassin-tf2664618.html#a7471981 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Braindeath in the Navy

2006-11-21 Thread Matt Kettler
Philip Prindeville wrote: Well, I tried to contact some people responsible for the servers below that what they were doing was broken, including citing chapter and verse where in RFC-2822 in syntax of the Received: lines was spec'd out: snip It just boggles my mind why anyone would go

RE: Spamassassin

2006-11-21 Thread Michael Scheidell
-Original Message- From: Maccie Roux [mailto:[EMAIL PROTECTED] Sent: Monday, November 20, 2006 4:47 AM To: users@spamassassin.apache.org Subject: Spamassassin I think amvis is not looking at spamassassin, I also struggle to get the system to send the spam mail to a

Re: Greylisting

2006-11-21 Thread Chr. v. Stuckrad
On Tue, 21 Nov 2006, Vahric MUHTARYAN wrote: I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and they are tring to change it day by day. I'm tring to use fuzzyocr but it's taking Same Problem here ... too much cpu. I

RE: would SA benefit from port to Java

2006-11-21 Thread Giampaolo Tomassoni
From: Matt Kettler [mailto:[EMAIL PROTECTED] Giampaolo Tomassoni wrote: ...omissis But if we are speaking of a /10 mem*cpu factor, well, it could easily be interesting, isn't it? No. I think it would be patently stupid because of the massive effort involved and loss of mind-power.

Re: Greylisting

2006-11-21 Thread Vahric MUHTARYAN
Hello, Do you come across with any problem from your clients for mails are not arriving at right time ? Because I afraid of people mta's all of them are configured with different retry times . Regards Vahric - Original Message - From: Rick Macdougall [EMAIL PROTECTED] To:

Re: How do I stop these?

2006-11-21 Thread John Tice
These are scoring at about 4X my threshold without the SARE stock ruleset. You may need to tweak you scoring. I find bayes_99 to be reliable. FROM_LOCAL_NOVOWEL FORGED_RCVD_HELO BAYES_99 RCVD_IN_SORBS_DUL RCVD_IN_NJABL_DUL On Nov 20, 2006, at 10:00 AM, Nathan Zabaldo wrote: I am getting

Sharing bayes DB between accounts - help

2006-11-21 Thread Evan Dorn
I have multiple shell accounts with my ISP that function as multiple inboxes. I want to run SA on all three, and it would be convenient to share the bayesian DB between all three accounts so I only have to train one. I've installed everything in a way that I think should work, but only

Re: Greylisting

2006-11-21 Thread John Andersen
On Monday 20 November 2006 21:06, Duncan Hill wrote: Greylisting has been used now for over 2 years.  I haven't seen any spammer adapt their botnets to handle it in that time frame. But its used on .0002% of MTAs. Not worth anybody's effort until it goes mainstream, or gets talked up here on

Re: would SA benefit from port to Java

2006-11-21 Thread Justin Mason
That's not even mentioning the metaprogramming and higher-order programming techniques that we use extensively in SpamAssassin -- those are basically *just not possible* in C/C++. ;) --j. Matt Kettler writes: Giampaolo Tomassoni wrote: From: Matt Kettler [mailto:[EMAIL PROTECTED]

Re: How do I stop these?

2006-11-21 Thread Justin Mason
Larry Rosenman writes: [EMAIL PROTECTED] wrote: As would running sa-update. --j. Speaking of sa-update Is there a list of the changes from day-to-day with sa-update? I have an auto-update script that runs for it, but I'd like to see what Gets added as time goes on. Hmm.

OT sendmail mailing list - WAS:Re: Greylisting

2006-11-21 Thread Jerry Kemp
Can anyone suggest a 'sendmail' mailing list? I am aware of NNTP comp.mail.sendmail Usenet news. Thanks, Jerry Rick Macdougall wrote: Vahric MUHTARYAN wrote: Hello Everybody, I'm using SA for a long time without any problem, nowadays spammers are using too much graphical objects and

Re: Problems running Spam Assassin

2006-11-21 Thread Theo Van Dinter
On Tue, Nov 21, 2006 at 06:16:15AM -0800, CosmicPerl wrote: Can anyone help with this? With what? -- Randomly Selected Tagline: ... the menu is written in more elementary Spanish than a Dora the Explorer episode ... - Karl Chalabala about a lunch menu at work pgpDc6YlHHGbl.pgp

Re: How do I stop these?

2006-11-21 Thread John Rudd
John Tice wrote: On Nov 20, 2006, at 10:00 AM, Nathan Zabaldo wrote: I am getting pounded by these types of emails. Does anyone else get these? What rule can I apply to have them killed. It's driving me nuts. Please help!!! These are scoring at about 4X my threshold without the SARE

Re: Greylisting

2006-11-21 Thread Brian Godette
On Monday 20 November 2006 19:06, Rick Macdougall wrote: John Andersen wrote: ... the spammers are not actually storing the email addresses on the infected machines, they just send an email to go out). I'm not saying they won't do it, I'm saying they aren't doing it currently. Actually they

  1   2   >