RE: [qmailtoaster] Spamassassin has problem in scanning
Hi Erik,, Can you pls help me in Fine Tuning openprotect [ MailScanner.conf ] , Bcoz I feel openprotect is not using Spamassassin properly. I have integrated FuzzyOCR - reffered below https://www.maiamailguard.com/maia/wiki/FuzzyOCR23 Then performed tests ... Received a SPAM Mail which i viewed full hearders :- From my Webmail :- X-llocom-MailScanner-OpenProtect-SpamCheck: spam, SpamAssassin (score=9.772, required 6, MY_CID_AND_ARIAL2 0.65, MY_CID_AND_CLOSING 0.90, MY_CID_AND_STYLE 0.71, MY_CID_ARIAL2_CLOSING 1.25, MY_CID_ARIAL_STYLE 1.05, SARE_GIF_ATTACH 0.75, TW_AQ 0.08, TW_PR 0.08, TW_QR 0.08, TW_XU 0.08, TW_XX 0.08, TW_YP 0.08, URIBL_AB_SURBL 2.00, URIBL_SC_SURBL 2.00) The same mail i manually scanned in server :- spamassassin -t /home/vpopmail/domains/llo.com/ashok/Maildir/cur/1170237232.M9196P22383V 0902I001DFE2E.mail.ek.com\,S\=12554\:2\, Content analysis details: (15.1 points, 5.0 required) pts rule name description -- -- 0.6 NO_REAL_NAME From: does not include a real name -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -1.4 ALL_TRUSTEDPassed through trusted hosts only via SMTP 1.0 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words 0.0 HTML_MESSAGE BODY: HTML included in message 0.8 SARE_GIF_ATTACHFULL: Email has a inline gif 1.1 URIBL_SBL Contains an URL listed in the SBL blocklist [URIs: qaqap.hk] 3.3 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist [URIs: qaqap.hk] 3.6 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist [URIs: qaqap.hk] 1.2 MY_CID_ARIAL2_CLOSING SARE cid arial2 closing 1.1 MY_CID_ARIAL_STYLE SARE cid arial2 style 0.9 MY_CID_AND_CLOSING SARE cid and closing 0.7 MY_CID_AND_STYLE SARE cid and style 0.7 MY_CID_AND_ARIAL2 SARE CID and Arial2 1.7 SARE_GIF_STOX Inline Gif with little HTML I See the same SPAM mail scores are different [ 9.772 15.1 ], Is this kind okay ?? or do we need to tweak some thing ?? Pls suggest ... -Original Message- From: Erik Espinoza [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 31, 2007 2:41 AM To: qmailtoaster-list@qmailtoaster.com Subject: Re: [qmailtoaster] Spamassassin has problem in scanning I'm using OpenProtect on my QmailToaster. Works beautifully. Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] -- -- - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
On Tue, 30 Jan 2007 13:31:43 -0800, Erik Espinoza wrote: Updated rules, catches more of the stock spam and what not. It's nice. Read up at http://saupdates.openprotect.com/ I think ashok means he installed OpenProtect's software package (a collection of programs that replaces simscan/spamassassin/clamav): http://www.openprotect.com/doc.html#download This is different than OpenProtect's SpamAssassin sa-update channel, which I too use and is very nice, and is very compatible with all of QT's architecture (although I agree it shouldn't be configured by default in the QT). Quinn - Strangecode :: Internet Consultancy http://www.strangecode.com/ +1 530 624 4410 - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: [qmailtoaster] Spamassassin has problem in scanning
Yeah exactly my frnd... QT can make it as an Add-on package improve it and publish further. Bcoz as of now with this package I have reduces 90% of SPAM mails. Also I implemented FuzzyOCR for blocking IMAGE SPAM. http://www200.pair.com/mecham/spam/image_spam_fc5.html hope it helps someone who need to implement it.:) Regards ashok -Original Message- From: Quinn Comendant [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 31, 2007 4:16 PM To: qmailtoaster-list@qmailtoaster.com Subject: Re: [qmailtoaster] Spamassassin has problem in scanning On Tue, 30 Jan 2007 13:31:43 -0800, Erik Espinoza wrote: Updated rules, catches more of the stock spam and what not. It's nice. Read up at http://saupdates.openprotect.com/ I think ashok means he installed OpenProtect's software package (a collection of programs that replaces simscan/spamassassin/clamav): http://www.openprotect.com/doc.html#download This is different than OpenProtect's SpamAssassin sa-update channel, which I too use and is very nice, and is very compatible with all of QT's architecture (although I agree it shouldn't be configured by default in the QT). Quinn - Strangecode :: Internet Consultancy http://www.strangecode.com/ +1 530 624 4410 - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] -- -- - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
RE: [qmailtoaster] Spamassassin has problem in scanning
_ From: ashok [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 30, 2007 3:40 PM To: qmailtoaster-list@qmailtoaster.com Subject: RE: [qmailtoaster] Spamassassin has problem in scanning -Original Message- From: Alexey Loukianov [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 30, 2007 5:09 AM To: qmailtoaster-list@qmailtoaster.com Subject: Re: [qmailtoaster] Spamassassin has problem in scanning ashok wrote: My qmail server allow all IMAGE SPAM to users mail box. [ without even marking as SPAM*] I manually scanned one of the IMAGE SPAM message in my mail server using below . It scans and gives the 14.7 points --- BUT this message never marks as spam in user box. #spamassassin -d -t 1170113064.M652531P11894V0902I001DF638.mail.ek.com\,S\=15349\:2\ , Content analysis details: (14.7 points, 5.0 required) pts rule name description -- -- 0.3 MAILTO_TO_SPAM_ADDRURI: Includes a link to a likely spammer email 0.0 HTML_MESSAGE BODY: HTML included in message 0.9 SPAMPIC_SUSPECTBODY: Suspect image found image/gif (GIF) 12 SPAMPIC_WORDS_5BODY: Contains inline spam picture (5+) 1.0 SPAMPIC_ALPHA_2BODY: Image contains many alphanumeric chars 0.7 MY_CID_AND_STYLE SARE cid and style -0.1 AWLAWL: From: address is in the auto white-list # cat local.cf required_hits 5 Pls Suggest how do I make my qmail server 2 mark these messages as SPAM Do you have simscan-toaster installed? What are the contents of /etc/tcprules.d/tcp.smtp? Did you check the /var/log/qmail/spamd/current logfile for log entries telling about any incoming mesasge being scanned? Does your incoming mails that drop to your QT-hosted mailbox contain any X-Spam-Checked: header lines? What are the contents of /var/qmail/control/simcontrol file? -- Best regards, Alexey Loukianov mailto:[EMAIL PROTECTED] System Engineer, IT Department, Lavtech Corp. Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/[ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. Every thing was working fine -- these days my users has started getting IMAGE SPAM so I tought I will control it ... so I referred the below site and integrated OCR Plugin. http://www.nabble.com/GIF-SpamSetting-up-the-'OCR-scanner-and-image-vali dator-SA-plugin'-t2042373.html [EMAIL PROTECTED] spamassassin]# cat /var/log/qmail/spamd/current @400045bec34b31c11174 [22423] info: config: failed to parse line, skipping: gocr_path /usr/bin/gocr @400045bec34b31c6b2dc [22423] info: config: failed to parse line, skipping: pnmtools_path /usr/bin @400045bec34b31cad95c [22423] info: config: failed to parse line, skipping: ocrtext_dscore 15 @400045bec34b31d0b174 [22423] info: config: failed to parse line, skipping: ocrtext_words realtime;alert;actquick;announce;headline;charts;increase;below;rating;takeo ff;resource;ready::0.1;profit;news::0.1;wallstreet;free::0;pick::0.1;breakin g;explosive;strong;spotlight;watch;symbol;stock;investor;offer;international ;company;money::0;million;thousand;loose;buy;price::0.1;trade;worldtrade;tar get::0.1;higher;banking;service;recommendation;viagra;soma::0.1;cialis::0.1; xanax;valium;meridia::0.1;zanaflex;levitra;herbal::0.1;medicine;doctor;pills ;legal;penis::0;erection::0.1;supplement;medication;weightloss;growth;drugs; pharmacy;prescription;click::0.1;here::0;software;kunde;volksbank;sparkasse; master;degree;bachelor;diploma;removal;visit;browser;readmore;type::0.1;chea p;shipping;quality;sideeffects;size::0.1;focused;replica::0.1;sale::0.1;bags ::0.1;development;technology;expect;long-term;quick::0.1;afford;tradeout;com pensate @400045bec34b31d587bc [22423] info: config: failed to parse line, skipping: ocrtext_pwords information @400045bec34c10cfc3ac [22423] warn: rules: failed to run SPAMPIC_BROKEN test, skipping: @400045bec34c10d1c74c [22423] warn: (Can't locate object method ocrtext_eval via package Mail::SpamAssassin::PerMsgStatus at /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 2626. @400045bec34c10d2d0ec [22423] warn: ) @400045bec34c10ee7324 [22423] warn: rules: failed to run SPAMPIC_SUSPECT test, skipping: @400045bec34c10f0345c [22423] warn: (Can't locate object method ocrtext_eval via package Mail::SpamAssassin::PerMsgStatus at /usr/lib/perl5/vendor_perl/5.8.5/Mail/SpamAssassin/PerMsgStatus.pm line 2626. @400045bec34c10f18064 [22423] warn: ) @400045bec34c10fc0b9c [22423] warn: rules: failed to run SPAMPIC_ALPHA_1 test, skipping
Re: [qmailtoaster] Spamassassin has problem in scanning
ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
I'm using OpenProtect on my QmailToaster. Works beautifully. Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
Cool. What does it do that the stock toaster doesn't? Erik Espinoza wrote: I'm using OpenProtect on my QmailToaster. Works beautifully. Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
Updated rules, catches more of the stock spam and what not. It's nice. Read up at http://saupdates.openprotect.com/ Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: Cool. What does it do that the stock toaster doesn't? Erik Espinoza wrote: I'm using OpenProtect on my QmailToaster. Works beautifully. Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
I haven't used rdj. Not planning on including in the stock toaster. I think any customization to SpamAssassin should be done by the admin. On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: Looks good. I think I'll add it to qtp, unless you're planning on including it in the stock toaster. Any thoughts on rules_du_jour vs openprotect? Erik Espinoza wrote: Updated rules, catches more of the stock spam and what not. It's nice. Read up at http://saupdates.openprotect.com/ Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: Cool. What does it do that the stock toaster doesn't? Erik Espinoza wrote: I'm using OpenProtect on my QmailToaster. Works beautifully. Erik On 1/30/07, Eric Shubes [EMAIL PROTECTED] wrote: ashok wrote: Dear Alexey,, I did not install simscan-toaster bcoz it gave me some problems ,, So I have used openprotect with my qmail toaster. www.openprotect.com http://www.openprotect.com/ [ include SPAM + Virus filtering ] which can be easily integrated to qmail toaster. I'd be leery of straying this far from the stock toaster. What problem(s) did you have with simscan? I wouldn't expect much help with openprotect from this list. Does openprotect have a community for support? -- -Eric 'shubes' -- -Eric 'shubes' -- -Eric 'shubes' - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
Re: [qmailtoaster] Spamassassin has problem in scanning
ashok wrote: My qmail server allow all IMAGE SPAM to users mail box. [ without even marking as SPAM*] I manually scanned one of the IMAGE SPAM message in my mail server using below … It scans and gives the 14.7 points --- BUT this message never marks as spam in user box. #spamassassin -d -t 1170113064.M652531P11894V0902I001DF638.mail.ek.com\,S\=15349\:2\, Content analysis details: (14.7 points, 5.0 required) pts rule name description -- -- 0.3 MAILTO_TO_SPAM_ADDRURI: Includes a link to a likely spammer email 0.0 HTML_MESSAGE BODY: HTML included in message 0.9 SPAMPIC_SUSPECTBODY: Suspect image found image/gif (GIF) 12 SPAMPIC_WORDS_5BODY: Contains inline spam picture (5+) 1.0 SPAMPIC_ALPHA_2BODY: Image contains many alphanumeric chars 0.7 MY_CID_AND_STYLE SARE cid and style -0.1 AWLAWL: From: address is in the auto white-list # cat local.cf required_hits 5 Pls Suggest how do I make my qmail server 2 mark these messages as SPAM Do you have simscan-toaster installed? What are the contents of /etc/tcprules.d/tcp.smtp? Did you check the /var/log/qmail/spamd/current logfile for log entries telling about any incoming mesasge being scanned? Does your incoming mails that drop to your QT-hosted mailbox contain any X-Spam-Checked: header lines? What are the contents of /var/qmail/control/simcontrol file? -- Best regards, Alexey Loukianov mailto:[EMAIL PROTECTED] System Engineer, IT Department, Lavtech Corp. - QmailToaster hosted by: VR Hosted http://www.vr.org - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
