SA experts needed here - SPAM examples - SpamAssassin

This is a discussion on SA experts needed here - SPAM examples - SpamAssassin ; > Hi, > I tried to do a sa-compile the first time after successfully downloaded > the ruleset recommended. But I got this error. > > .... > re2c -i -b -o scanner1.c scanner1.re > Can't exec "re2c": No such ...

+ Reply to Thread
Page 2 of 2 FirstFirst 1 2
Results 21 to 31 of 31

Thread: SA experts needed here - SPAM examples

  1. Re: Can't find re2c

    > Hi,
    > I tried to do a sa-compile the first time after successfully downloaded
    > the ruleset recommended. But I got this error.
    >
    > ....
    > re2c -i -b -o scanner1.c scanner1.re
    > Can't exec "re2c": No such file or directory at /usr/bin/sa-compile line
    > 287, <$fh> line 974.
    >
    >
    > It seemed that it cannot find re2c . I tried to installed the latest
    > spamassassin + tools rpm but still no success (in getting this file).
    > Anyone knows where I can get this file ? is it suppose to come with the
    > package?
    >
    >


    if you use Linux then
    if you use Debian or Ubuntu
    aptitude install re2c
    else if you use RedHat based
    yum install re2c
    else
    use whatever tool there is to install re2c
    else
    use whatever tool there is to install re2c

    You can also download and install it from source. It is not part of
    SpamAssassin package.


  2. RE: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, NGSS wrote:

    > I quite sure that the script is running and the variable in $DOMAIN and
    > $SPAM are correct ( I defined it early in the script, which are not shown
    > here) because the I got a copy for each them in $DIRCOLLECTSPAM and nothing
    > in the learning folder, /home/vpopmail/domains/$DOMAIN/$SPAM/Maildir/cur/*


    Ok, good.

    > I did the The dump from your command and which had given me this
    >
    > 0.000 0 3 0 non-token data: bayes db version
    > 0.000 0 1337 0 non-token data: nspam
    > 0.000 0 6 0 non-token data: nham


    There is your problem right there. Bayes will not start classifying
    messages until you have taught at least 100 each of ham and spam. Teach it
    a few hundred ham messages and you'll be good.

    If you've been trying to do that, it's not working. The spams are being
    learned, the hams are not. Take a look at the hams part of your script.

    --
    John Hardin KA7OHZ http://www.impsec.org/~jhardin/
    jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
    key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
    -----------------------------------------------------------------------
    Warning Labels we'd like to see #1: "If you are a stupid idiot while
    using this product you may hurt yourself. And it won't be our fault."
    -----------------------------------------------------------------------
    Tomorrow: SWMBO's Birthday


  3. RE: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, NGSS wrote:

    > I afraid I had move the ling "-r zen.spamhaus.org" from the
    > /var/qmail/control/blacklists .
    > Because with this line is in, I can't perform send/receive from most of
    > the external network using my Outlook. Is that what you talking about?


    DNSBL tests should not be applied to locally-originated messages. Your
    local network probably uses an address range that appears on the zen
    DNSBL.

    Ask on the qmail list how to apply a DNSBL to external mail but not to
    internal-network mail clients.

    Either that, or I am misunderstanding your question. Are you saying you're
    using roaming outlook mail clients from the internet at large to send
    email via your MTA? If you are using authentication, then the DNSRBL
    should not be used (again, that's a question for the qmail list). If you
    are _not_ using authentication, and are accepting and relaying mail from
    the internet at large, and zen is interfering with that, then you have
    bigger problems than your SA scores being low. It sounds like you're
    what's called an "open relay"...

    > -----Original Message-----
    > From: John Hardin [mailto:jhardin@impsec.org]
    >
    >>> http://www.keac.com/id3303/spam-egs.txt

    >>
    >> 3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
    >> [68.243.81.116 listed in zen.spamhaus.org]

    >
    > Indeed.
    >
    > Suggestion: put zen.spamhaus.org in your MTA's DNSBL list. That's a
    > reliable BL and should be part of your up-front filtering.


    --
    John Hardin KA7OHZ http://www.impsec.org/~jhardin/
    jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
    key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
    -----------------------------------------------------------------------
    Warning Labels we'd like to see #1: "If you are a stupid idiot while
    using this product you may hurt yourself. And it won't be our fault."
    -----------------------------------------------------------------------
    Tomorrow: SWMBO's Birthday


  4. RE: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, John Hardin wrote:

    > There is your problem right there. Bayes will not start classifying
    > messages until you have taught at least 100 each of ham and spam.


    Make that 200. D'oh!

    --
    John Hardin KA7OHZ http://www.impsec.org/~jhardin/
    jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
    key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
    -----------------------------------------------------------------------
    Warning Labels we'd like to see #1: "If you are a stupid idiot while
    using this product you may hurt yourself. And it won't be our fault."
    -----------------------------------------------------------------------
    Tomorrow: SWMBO's Birthday


  5. RE: SA experts needed here - SPAM examples

    Hi John,
    It required authentication for external connections so it is not an
    open-relay.
    So you meant I am doing the right thing by removing the line from
    /var/qmail/control/blacklists ?


    -----Original Message-----
    From: John Hardin [mailto:jhardin@impsec.org]
    Sent: Tuesday, June 17, 2008 11:22 PM
    To: NGSS
    Cc: 'SpamAssassin Users List'; out@netgraphy.com
    Subject: RE: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, NGSS wrote:

    > I afraid I had move the ling "-r zen.spamhaus.org" from the
    > /var/qmail/control/blacklists .
    > Because with this line is in, I can't perform send/receive from most of
    > the external network using my Outlook. Is that what you talking about?


    DNSBL tests should not be applied to locally-originated messages. Your
    local network probably uses an address range that appears on the zen
    DNSBL.

    Ask on the qmail list how to apply a DNSBL to external mail but not to
    internal-network mail clients.

    Either that, or I am misunderstanding your question. Are you saying you're
    using roaming outlook mail clients from the internet at large to send
    email via your MTA? If you are using authentication, then the DNSRBL
    should not be used (again, that's a question for the qmail list). If you
    are _not_ using authentication, and are accepting and relaying mail from
    the internet at large, and zen is interfering with that, then you have
    bigger problems than your SA scores being low. It sounds like you're
    what's called an "open relay"...

    > -----Original Message-----
    > From: John Hardin [mailto:jhardin@impsec.org]
    >
    >>> http://www.keac.com/id3303/spam-egs.txt

    >>
    >> 3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
    >> [68.243.81.116 listed in zen.spamhaus.org]

    >
    > Indeed.
    >
    > Suggestion: put zen.spamhaus.org in your MTA's DNSBL list. That's a
    > reliable BL and should be part of your up-front filtering.


    --
    John Hardin KA7OHZ http://www.impsec.org/~jhardin/
    jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
    key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
    -----------------------------------------------------------------------
    Warning Labels we'd like to see #1: "If you are a stupid idiot while
    using this product you may hurt yourself. And it won't be our fault."
    -----------------------------------------------------------------------
    Tomorrow: SWMBO's Birthday


  6. RE: Can't find re2c

    Yap. I got the rpm and installed. Thanks.

    -----Original Message-----
    From: Jari Fredriksson [mailto:jarif@iki.fi]
    Sent: Tuesday, June 17, 2008 8:43 PM
    To: NGSS
    Cc: users@spamassassin.apache.org; out@netgraphy.com
    Subject: Re: Can't find re2c

    > Hi,
    > I tried to do a sa-compile the first time after successfully downloaded
    > the ruleset recommended. But I got this error.
    >
    > ....
    > re2c -i -b -o scanner1.c scanner1.re
    > Can't exec "re2c": No such file or directory at /usr/bin/sa-compile line
    > 287, <$fh> line 974.
    >
    >
    > It seemed that it cannot find re2c . I tried to installed the latest
    > spamassassin + tools rpm but still no success (in getting this file).
    > Anyone knows where I can get this file ? is it suppose to come with the
    > package?
    >
    >


    if you use Linux then
    if you use Debian or Ubuntu
    aptitude install re2c
    else if you use RedHat based
    yum install re2c
    else
    use whatever tool there is to install re2c
    else
    use whatever tool there is to install re2c

    You can also download and install it from source. It is not part of
    SpamAssassin package.


  7. RE: SA experts needed here - SPAM examples

    Hi Ralf,
    Thanks for the response.
    May I know how I can allow pop3/smtp authenticated connections from internet at large while keeping this line "-r zen.spamhaus.org" in the /var/qmail/control/blacklists ?

    -----Original Message-----
    From: Ralf Hildebrandt [mailto:Ralf.Hildebrandt@charite.de]
    Sent: Tuesday, June 17, 2008 4:20 PM
    To: users@spamassassin.apache.org
    Subject: Re: SA experts needed here - SPAM examples

    * NGSS :
    > Hi John
    > I afraid I had move the ling "-r zen.spamhaus.org" from the
    > /var/qmail/control/blacklists .
    > Because with this line is in, I can't perform send/receive from most of the
    > external network using my Outlook. Is that what you talking about?


    That's a clear case of a misconfiguration. The host in that RBL may
    not send mail to you, but YOU as AUTHORIZED client may of course send.

    Make sure that the RBL is only applied to non-authorized clients.

    --
    Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@charite.de
    Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
    Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
    IT-Zentrum Standort CBF send no mail to snickebo@charite.de


  8. Re: SA experts needed here - SPAM examples

    * NGSS :
    > Hi Ralf,
    > Thanks for the response.


    > May I know how I can allow pop3/smtp authenticated connections from


    What does POP3 have to do with SMTP?

    > internet at large while keeping this line "-r zen.spamhaus.org" in the
    > /var/qmail/control/blacklists ?


    I have no idea, I stopped using qmail 10 years ago. I use Postfix and
    with it I'm able to order my restrictions accordingly:

    smtpd_recipient_restrictions =
    permit_mynetworks
    # permit stuff from my network ranges
    permit_sasl_authenticated
    # permit authenticated connections
    reject_unauth_destination
    # prevent relaying
    reject_rbl_client zen.spamhaus.org
    # reject blacklisted clients

    --
    Ralf Hildebrandt (i.A. des IT-Zentrums) Ralf.Hildebrandt@charite.de
    Charite - Universitätsmedizin Berlin Tel. +49 (0)30-450 570-155
    Gemeinsame Einrichtung von FU- und HU-Berlin Fax. +49 (0)30-450 570-962
    IT-Zentrum Standort CBF send no mail to snickebo@charite.de


  9. Re: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, Ralf Hildebrandt wrote:

    > * NGSS :
    > > Hi Ralf,
    > > Thanks for the response.

    >
    > > May I know how I can allow pop3/smtp authenticated connections from

    >
    > What does POP3 have to do with SMTP?


    At a guess, he's using the old POP before SMTP kluge rather than
    real SMTP-AUTH, so no auth tokens in the "Received" headers and
    thus all kinds of additional pain.

    To NGSS: either set up a SMTP server with real SMTP-AUTH or
    set up a seperate SMTP server to act just as a MSA and configure
    it to skip SA mail filtering.

    As it sounds like you're using qmail you will have better luck
    getting these questions answered on a qmail specific list.


    --
    Dave Funk University of Iowa
    College of Engineering
    319/335-5751 FAX: 319/384-0549 1256 Seamans Center
    Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
    #include
    Better is not better, 'standard' is better. B{


  10. RE: SA experts needed here - SPAM examples

    HI David,
    The server is running on latest qmail-toaster's bundle. It is a smtp-auth.

    -----Original Message-----
    From: David B Funk [mailto:dbfunk@engineering.uiowa.edu]
    Sent: Wednesday, June 18, 2008 5:55 AM
    To: users@spamassassin.apache.org
    Cc: NGSS
    Subject: Re: SA experts needed here - SPAM examples

    On Tue, 17 Jun 2008, Ralf Hildebrandt wrote:

    > * NGSS :
    > > Hi Ralf,
    > > Thanks for the response.

    >
    > > May I know how I can allow pop3/smtp authenticated connections from

    >
    > What does POP3 have to do with SMTP?


    At a guess, he's using the old POP before SMTP kluge rather than
    real SMTP-AUTH, so no auth tokens in the "Received" headers and
    thus all kinds of additional pain.

    To NGSS: either set up a SMTP server with real SMTP-AUTH or
    set up a seperate SMTP server to act just as a MSA and configure
    it to skip SA mail filtering.

    As it sounds like you're using qmail you will have better luck
    getting these questions answered on a qmail specific list.


    --
    Dave Funk University of Iowa
    College of Engineering
    319/335-5751 FAX: 319/384-0549 1256 Seamans Center
    Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
    #include
    Better is not better, 'standard' is better. B{


  11. Re: SA experts needed here - SPAM examples


    On Tue, June 17, 2008 19:30, Ralf Hildebrandt wrote:

    >> May I know how I can allow pop3/smtp authenticated connections from

    > What does POP3 have to do with SMTP?


    might be pop before smtp (problem in its own, in that it does not handle NAT
    very well) ?

    >> internet at large while keeping this line "-r zen.spamhaus.org" in the
    >> /var/qmail/control/blacklists ?

    > I have no idea, I stopped using qmail 10 years ago. I use Postfix and
    > with it I'm able to order my restrictions accordingly:


    lets now not have that mta wars one more time, but i bet sendmail can do this
    to :-)


    Benny Pedersen
    Need more webspace ? http://www.servage.net/?coupon=cust37098


+ Reply to Thread
Page 2 of 2 FirstFirst 1 2