http://permalink.gmane.org/gmane.mail.spam.spamassassin.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137352 <pre>On Tue, 22 May 2012 08:53:39 +0100 corpus.defero wrote: It's just ordinary Bayes with autolearning. It's covered in the main configuration page: man (or perldoc) Mail::SpamAssassin::Conf which in turn references Mail::SpamAssassin::Plugin::AutoLearnThreshold </pre> RW 2012-05-22T12:32:34 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137351 <pre>I can't seem to find any documentation on bayes_auto_learn, in particular how it works / where it creates the db / how it sources spam/ham. Is there a link anyone knows of that gives some detail on it? </pre> corpus.defero 2012-05-22T07:53:39 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137350 <pre> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just as a note to everyone who will stumble upon similair problems. The easiest way I know of to print certain fields in the mailheaders to the logs is to use header_checks in postfix to print out the matching field to the syslog which later on can be parsed in a "standardized" way. x-originating-ip is a nice example to compare against an expected pattern. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPuVhKAAoJEOVOmoKjmKMk2ygH/3dlsIOl/+ISdXXjQg9HZms2 2lO6xA/LkNquGCLFF4LY+9Ym19p28pYdzp1mOL5sMRsSKBAYpaU16722TTX1LWIi EXdSzCVhAhgQkiEl6Kc9oBTdq/ioJ3NOQK4hJHeZoizJX/8omjIpPhwsftLbxPrT Pgmfvl0N9MiWzwryF9XO2sH3JOiLYHSIC7U10hV3Q+LfAp/vjUUl0uOl5NT3Ib42 jLjYZfiFdZMDu/s1PUnX6RxinNph5OP0fSgWmALQtA2nzrbk7AA9tVkQu5Jte/Nv mPWdLccGrJDIKwi7Aornq1FdJeqr1ER53ncQ00wKRkvffdBPVXG493lRUxkw+Ck= =b16w -----END PGP SIGNATURE----- </pre> Per-Erik Persson 2012-05-20T20:47:06 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137349 <pre>Good Afternoon Everyone, I am both humbled and honored to report that I have accepted the nomination of the SpamAssassin PMC to serve as the new project chair. On April 18th, the Board of Directors for the Apache Software Foundation accepted the nomination and appointed me to the position. Unfortunately and for very good reasons, our previous chair, Daryl C. W. O'Shea is no longer unavailable to help the project. I hope all can join me in thanking Daryl for his service to the project. And while he will be sorely missed, for privacy reasons, I can only tell you that he is urgently needed elsewhere. But I'm certain he needs and would appreciate all the good karma we can send his way. Over the past few weeks, I've been working to get up to speed on my duties. Luckily, I attended the ASF BarCamp DC conference yesterday. Not only was it a great conference with great people that taught me a few things but several of the attendees were very helpful in helping me overcome a few hurdles. Many t</pre> Kevin A. McGrail 2012-05-20T19:34:07 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137348 <pre>I remember seeing this as well. Can you send me the message.txt off-list and I'll see if I can reproduce? Regards, KAM </pre> Kevin A. McGrail 2012-05-20T00:20:49 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137347 <pre>&lt;p&gt;Online Business Opportunity for you&lt;br&gt;&lt;a href="http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/"&gt;http://www.selbsthilfe.narod.ru/newsjournal/96AlanRichardson/&lt;/a&gt;&lt;/p&gt; </pre> Jose Sanchez 2012-05-18T23:55:41 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137346 <pre> For anyone who cares, this is what I came up with. Please note my Perl skills are really weak, so if anyone has any optimizations, I'd welcome them : --- spamd.orig 2012-05-17 21:52:27.000000000 -0700 +++ spamd 2012-05-18 15:56:06.000000000 -0700 &lt; at &gt;&lt; at &gt; -1630,9 +1630,29 &lt; at &gt;&lt; at &gt; my $scantime = sprintf( "%.1f", time - $start_time ); - info("spamd: $was_it_spam ($msg_score/$msg_threshold) for $current_user:$&gt; in" - . " $scantime seconds, $actual_length bytes." ); +########################################################################################## +## +## Hack added by to add relay server addresses to base report for fail2ban etc. +## 2012-05-18: First Draft +## + + my &lt; at &gt;from_addrs = $mail-&gt;get_pristine_header("Received"); + my $nums = &lt; at &gt;from_addrs; + my $line; + my &lt; at &gt;raddrs; + foreach $line (&lt; at &gt;from_addrs){ + if($line=~/(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/) { + if($1 == 127 &amp;&amp; $2 == 0 &amp;&amp; $3 == 0 &amp;&amp; $4 == 1) { + }else{ + push(&lt; at &gt;raddrs, "$1.$2.$3.$4"); + } </pre> Christopher Hunt 2012-05-18T23:02:09 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137345 <pre> The ones that say you won the lottery or had an inheritance or someone wants to hand you cash, so just fill out this form with your details (including bank routing numbers) and that cash will just pop into your bank! Or the ones that say you are out of disk space or we think you've been hacked or we just upgraded everything and we will make it all better if you just confirm your username and password (and credit card number....) </pre> Daniel McDonald 2012-05-18T14:56:17 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137344 <pre>Hi..... What sort of spams are block by the FILL_THIS_FORM_LONG rule Thank You </pre> dhanushka ranasinghe 2012-05-18T14:20:40 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137343 <pre> I use sendmail, and spamassassin/amavis as milter, and I run all sort of statistics from /var/log/mail, which is where sendmail logs everything. E.g. I identify messages flagged as spam via the string "Blocked SPAM" in the log) and extract the score/hits from there. For other statistics on rules I use the quarantine folder (we store all quarantined spam in a single daily mail folder for all users). Of course this has to be highly customized for local usage. </pre> Lucio Chiappetti 2012-05-18T12:49:21 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137342 <pre> On 18.05.12 07:26, Jason Haar wrote: sa would need to switch to correct locale before processing of the e-mail to avoid this error. Setting the correct locale could be different for different users and even for different mails. I'm not sure if this is a way to go, although there may be single cases where it helps. I'm more in favor of advanced processing, watching different languages and/or comparing matching strings for words in different languages, e.g. FRT_SOMA misfiring for word "somar" (donkey), FRT_PENIS1 for "penize" (money), FUZZY_CREDIT for "kredit" (credit) etc. </pre> Matus UHLAR - fantomas 2012-05-18T11:45:17 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137341 <pre> I know this doesn't directly answer the question you're asking, but how about looking up the mid (msgid) in the Postfix log lines to get the source IP? That should be fairly simple to do in a perl logfile parser. </pre> John Hardin 2012-05-17T23:59:37 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137340 <pre>Can you get what you need from Postfix logs? Using Qmail here, and for each message Qmail is logging a line that contains the score, subject, sender IP &amp; email addresses, recipient address. Brent Gardner </pre> Brent Gardner 2012-05-17T23:51:41 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137339 <pre>I'm hoping to track scores by sender IP. Do any gurus know how I can get the original sender's IP address into this log line? May 17 04:08:19 mail01 spamd[20409]: spamd: result: . 2 - AWL,BAYES_50,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,SPF_HELO_PASS,URIBL_WS_SURBL scantime=0.9,size=9109,user=happydog&lt; at &gt;willapabay.org,uid=105,required_score=5.0,rhost=mail01-01.reachone.com,raddr=127.0.0.1,rport=36534,mid=&lt;16780360.84780&lt; at &gt;patriotupdate.com&gt;,bayes=0.500889,autolearn=no Please note that since it's a Postfix milter, the spamd daemon sees [remoteaddr] as 127.0.0.1: May 17 16:27:38 mail1spamd[2187]: spamd: [...] [127.0.0.1] for drsmooth&lt; at &gt;olynet.com:104 in 2.2 seconds, 2373 bytes. I'm hoping custom spamassassin plugin is not the answer :) TIA, Chris </pre> Chris Hunt 2012-05-17T23:35:02 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137338 <pre> I believe so. It was weeks ago that I did that (then comment it out, intending to get back to it). I won't be able to focus on this for a while. I forgot we are having a social gathering tonight. Sigh. Sometimes that sort of thing has to happen. joe a. </pre> Joseph Acquisto 2012-05-17T23:05:35 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137337 <pre> heh. Yeah, that won't work. "[]" means a character class, one character that matches anything within the square brackets. What the above RE says is: blah blah blah // (not-period OR period) (r OR u) / ...so it would match, for example: https://.r/ https://.u/ but never: https://{anything}.ru/ And you actually had success testing that from the command line? </pre> John Hardin 2012-05-17T22:16:59 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137336 <pre> I attempted to adapt something from a similar regex provided by a vendor of a commercial product. It was to detect country codes we do not want to accept mail from. No doubt my ignorance of SA and regex in general will be on display for the amusement of many. rawbody URI_RU m,^https?://[^.\.][ru]/,i joe a. </pre> Joseph Acquisto 2012-05-17T22:03:34 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137335 <pre>On Fri, 18 May 2012 08:37:07 +1200 Jason Haar &lt;Jason_Haar&lt; at &gt;trimble.com&gt; wrote: The only sane solution is to re-encode everything in UTF-8. (You can remember the original character set for the purpose of "ok_locales", but because UTF-8 is becoming more common, ok_locales is becoming less useful.) Of course, the re-encoding could lose some valuable information that might be useful for rules :( so you may want a separate class of rules that operate on the original pristine message. No, I don't think so. In our commercial software, we actually went to the trouble of converting everything to UTF-8. It helps a lot, especially for Bayes. Regards, David. </pre> David F. Skoll 2012-05-17T20:58:49 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137334 <pre> bug opened in 2004 :-( I'm no linguist but this is probably an extremely hard problem to solve. An email can have mixtures of languages, so in a perfect world we should be able to change locale per word (or per char? - eeek!). This also bleeds into the issues surrounding how "ok_locales" doesn't work (as desired) in the modern UTF world too. ie SA would need to "know" what locales an email contains (which helps ok_locales) so that it can then dynamic change word boundary definitions/etc for rules. Yuck Perhaps this should be just classified as a bug in perl and forgotten about ;-) [does python,etc handle this any better?] </pre> Jason Haar 2012-05-17T20:37:07 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137333 <pre>On Fri, 18 May 2012 07:26:56 +1200 Jason Haar &lt;Jason_Haar&lt; at &gt;trimble.com&gt; wrote: Ah... could be. Hmm, ok. Maybe I'll suggest to the customer to run under the "se" locale. On Thu, 17 May 2012 15:54:43 -0400 darxus&lt; at &gt;chaosreigns.com wrote: Ugh. I agree with forcing everything to UTF-8, but that's a lot of work. Definitely worth doing, though. Regards, David. </pre> David F. Skoll 2012-05-17T20:35:31 http://permalink.gmane.org/gmane.mail.spam.spamassassin.general/137332 <pre> Locale handling is a known problem is SA: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=3062 </pre> darxus< at >chaosreigns.com 2012-05-17T19:54:43 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.spam.spamassassin.general