We have been using ASSP with Imail for over 3 years now and I have been very
happy with it. From the beginning, I never trusted the Bayesian filtering
of ASSP. I merely used it to suggest the email was spam. It was fairly
accurate though with exception being newsletters and the like, which were
almost always regarded as spam by ASSP.
As stated in earlier posts here, the current version of ASSP is much more
than Bayesian testing. The delaying feature and HELO connection testing,
has resulted in almost total cessation of virus laden emails getting to my
SMTP AV gateway. We went from hundreds a day to maybe one a week. The only
ones I see now are bounces from legitimate email servers that bounce virus
laden emails to the spoofed sender. Most of those are rejected by ASSP's
file blocking feature. Occasionally one does get by and our SMTP AV gateway
does its job. ASSP's file blocking ability is a nice add-on to reject, not
bounce, emails with illegal attachments, but since ASSP can't decode
compressed files or Uuencoded emails, it can not be relied on. You will
still need some sort of SMTP AV after ASSP to protect your network.
ASSP has the ability to reject at the connection level; emails to invalid
users using LDAP and/or flat file checking, emails that HELO with your
server name or IP, emails that HELO with "friend" or "localhost", emails to
specific addresses, emails from specific addresses or domains, emails
containing specific text or headers, and emails with banned extensions.
ASSP also has the ability to block on SPF fail, and RBL fail from multiple
RBLs. ASSP keeps temporary penalty points for connecting IP's and will
block emails when an IP accumulates too many. If an IP continues to
misbehave the amount of penalty points can rise to a level that will get
that IP extreme blocked at the connection level. ASSP also has various ways
to be spam friendly if particular users wish to receive all their spam
email.
The Bayesian testing will stay in test mode for now, merely marking an email
as spam. The users who receive these can set up rules to move the spam to a
spam folder or delete them on receipt.
I think ASSP is a great 1st line of defense and greatly reduces the amount
of email reaching our SMTP AV program before Imail and runs on the same
machine with no problem.
10k SMTP connections a day resulting in 2k emails passed to the users.
ASSP/AV/Imail all running on a 6 year old dual 733mhz Dell with 2gb ram.
Doug Traylor
----- Original Message -----
From: "Matt Robertson" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Thursday, June 22, 2006 11:52 AM
Subject: Re: [IMail Forum] ASSP
On 6/21/06, Dave Beckstrom <[EMAIL PROTECTED]> wrote:
Sorry....I meant "Mark" :)
No its 'Matt' :-)
I understand Bayesian filtering won't work for everybody. perhaps I
am lucky, with a fairly diverse if not particularly large bunch of
users (about 250) spanning a variety of commercial and public sectors,
and even a few continents. I just wanted to point out that the
*latest* ASSP -- which is essentially a revival of a once-dead project
with all new developers -- is quite a different animal than its
predecessors. The Bayesian capability used to be the primary
functionality of the system and now its just a sideshow. I am
rebuilding my mail server at a new host and I find that so few
connections make it thru to it now that I can run some other stuff on
that server without fear of running out of resources.
Back when I was using Declude I tried out Message Sniffer also and I
found it to be a very worthy addition. However at that time I was
looking for something that would cut my maintenance down and while I
found it to be very powerful it wasn't enough to get me to keep
Declude.
--
[EMAIL PROTECTED]
Janitor, MSB Web Systems
mysecretbase.com
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
