Re: SpamAssassin score
Thanks Reindl, David, Martin & Joe for replying! Reindl: > 100 each at minimum - you only trained 23 spam samples but 1729 ham > which is a bad balance and you would not want bayes kick in with such > a bad database - how do you imagine a statistic analyse based on 23 > samples with a magnitude more non-spam-tokens? It seems to actually require even more. David: > If you don't see any BAYES_* rule hits make sure the plugin is enabled: > > v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes > > Run a debug lint and check for bayes output: > > spamassassin -D --lint 2>&1 | grep -i bayes > > You should see a BAYES_ in the test= line near the end. Got it: dbg: plugin: loading Mail::SpamAssassin::Plugin::Bayes from @INC > Another common problem is the Bayes training is done as one user > while spamassassin is being called by a different user. This depends on > how/what is launching SA -- amavis-new, spamd, MailScanner, etc. That is normally taken care of properly. My setup is : * postfix -> spamd (through spamc) -> dovecot on reception * dovecot's antispam plugin -> spamd (through spamc) on mail directory change * sa-learn for training All components ar invoked with the same debian-spamd user (which own /var/lib/spamassassin -sub-directory and files). Martin & Joe: > There is also a strong a clue that this is designed behavior when you > consider that Bayes has no effect on spam scoring until its has learnt > 200 ham AND spam messages. > > You need to train more than 23 messages as ham first. Read the > documentation in the SA manpages and on the wiki to make sure you meet > every criteria for running bayes. > Bingo! The spamassassin -D invocation as filtered before also popped up something related: dbg: bayes: not available for scanning, only 23 spam(s) in bayes DB < 200 I got no-one to blacklist, I was merely testing a custom-made 'Spam test' message which seems to be useless (and maybe harmful in the end?). I'll wait to be an advanced user w/ SA before attempting to black/whitelist senders or write rules, unless events push me into doing it ofc. So far, all received messages have SpamAssassin headers, meaning the delivery works and a small debug session on the antispam plugin seems to show it reacts properly and sends commands to spamc correctly (hoping the SA client + daemon handle/receive everything correctly). All in all, I require more spam to trigger the bayesian filter. Only then I will be able to assert it being running properly or not it seems. At least it is loaded. I thought the database (updated daily if it works) would provide it with a kickstarted. I was probably mixing-up separate components. Thus I sit hanging tight, hoping for the best... Thanks for your help. --- Bernard
Re: SpamAssassin score
>From: Reindl Harald >Sent: Monday, March 20, 2017 6:08 AM >To: David Jones; SpamAssassin Users ML >Subject: Re: SpamAssassin score >Am 20.03.2017 um 11:52 schrieb David Jones: >>> From: Bernard >>> Sent: Monday, March 20, 2017 5:37 AM >>> To: SpamAssassin Users ML >>> Subject: Re: SpamAssassin score >> >>> Thanks for that information. >>> After ~1750 messages having been digested, still no improvement: >>> 0.000 0 3 0 non-token data: bayes db version >>> 0.000 0 23 0 non-token data: nspam >>> 0.000 0 1729 0 non-token data: nham >>> 0.000 0 123471 0 non-token data: ntokens >>> 0.000 0 1358530476 0 non-token data: oldest atime >>> 0.000 0 1489938564 0 non-token data: newest atime >>> 0.000 0 0 0 non-token data: last journal sync >>> atime >>> 0.000 0 0 0 non-token data: last expiry atime >>> 0.000 0 0 0 non-token data: last expire atime >>> delta >>> 0.000 0 0 0 non-token data: last expire >>> reduction count >why don't you read what you quote before make assumptions? >what does the "23" tell you? > >> 0.000 0 23 0 non-token data: nspam > >> 0.000 0 1729 0 non-token data: nham >for me it tells too few sample messages Sorry. Honest mistake. I was looking at that on a small laptop screen. Even after the OP trains 200 ham, there could still be a problem that my suggestions below could help the OP or others. Don't be so critical. Just let some of this stuff go without responding. Others did and gave good, positive advice to check the SA wiki. > If you don't see any BAYES_* rule hits make sure the plugin is enabled: > > v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes > > Run a debug lint and check for bayes output: > > spamassassin -D --lint 2>&1 | grep -i bayes > > You should see a BAYES_ in the test= line near the end. > > Another common problem is the Bayes training is done as one user > while spamassassin is being called by a different user. This depends on > how/what is launching SA -- amavis-new, spamd, MailScanner, etc. > > You can force the bayes_path in the local.cf to make sure all users > use the same Bayes DB if you are using a global (not individual) Bayes
Re: SpamAssassin score
On 3/20/2017 6:37 AM, Bernard wrote: Thanks for that information. After ~1750 messages having been digested, still no improvement: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23 0 non-token data: nspam 0.000 0 1729 0 non-token data: nham 0.000 0 123471 0 non-token data: ntokens 0.000 0 1358530476 0 non-token data: oldest atime 0.000 0 1489938564 0 non-token data: newest atime 0.000 0 0 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count Have you got an idea of the required order of magnitude of the input volume for the bayesian filter to kick in? --- Bernard On 20/03/2017 11:15, Reindl Harald wrote: Am 20.03.2017 um 11:12 schrieb Bernard: 1. How come the same message being classified either as spam/ham returns the same score? I would expect a message learnt as 'spam' to get a score at least equal to the spam score threshold 2. Even though the message was correctly learnt as spam before and after the test, receiving this email message is still not tagged as spam: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on *** X-Spam-Level: ** X-Spam-Status: No, score=2.1 required=5.0 tests=MISSING_HEADERS,SPF_FAIL, SPF_HELO_FAIL autolearn=no autolearn_force=no version=3.4.0 Am I missing something? yes, tarin your bayers properly with enough spam *and* ham samples and train the bayes wihich is really in use - do you see any BAYES_ tag above? no! so bayes was not used at all You need to train more than 23 messages as ham first. Read the documentation in the SA manpages and on the wiki to make sure you meet every criteria for running bayes.
Re: SpamAssassin score
On Mon, 2017-03-20 at 11:12 +0100, Bernard wrote: > Am I missing something? > I think so. Bayes cannot have its spamminess score changed by a single message, since its results would be very unstable if this was possible. There is also a strong a clue that this is designed behavior when you consider that Bayes has no effect on spam scoring until its has learnt 200 ham AND spam messages. If you want an immediate change in spamminess scoring, you can: - whitelist or blacklist the sender if the message source is a reliable indicator, e.g. blacklist a domain that is employed by retailers to send targeted mail to previous customers. Use the authorised blacklist-* and whitelist-* statements to do this, not the plain 'whitelist' and 'blacklist' ones. - write a rule that explicitly specifies the recognition features in messages, e.g. there may be subtle misspellings of common business phrases in messages sent by spammers or botnets. For instance, if you write a meta rule that only fires if two other rules both fire (one detecting selling phrases and the other looking for product names) then, if carefully done, this will be quite specific for sales spam and, once both sub rules have a reasonable number of alternate targets it will reliable detect combinations that you haven't previously seen. Martin
Re: SpamAssassin score
>From: Bernard >Sent: Monday, March 20, 2017 5:37 AM >To: SpamAssassin Users ML >Subject: Re: SpamAssassin score >Thanks for that information. >After ~1750 messages having been digested, still no improvement: >0.000 0 3 0 non-token data: bayes db version >0.000 0 23 0 non-token data: nspam >0.000 0 1729 0 non-token data: nham >0.000 0 123471 0 non-token data: ntokens >0.000 0 1358530476 0 non-token data: oldest atime >0.000 0 1489938564 0 non-token data: newest atime >0.000 0 0 0 non-token data: last journal sync atime >0.000 0 0 0 non-token data: last expiry atime >0.000 0 0 0 non-token data: last expire atime delta >0.000 0 0 0 non-token data: last expire reduction >count > Have you got an idea of the required order of magnitude of the input volume > for the bayesian filter to kick in? >On 20/03/2017 11:15, Reindl Harald wrote: >Am 20.03.2017 um 11:12 schrieb Bernard: > 1. How come the same message being classified either as spam/ham > returns the same score? I would expect a message learnt as 'spam' to > get a score at least equal to the spam score threshold > 2. Even though the message was correctly learnt as spam before and > after the test, receiving this email message is still not tagged as > spam: > X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on *** > X-Spam-Level: ** > X-Spam-Status: No, score=2.1 required=5.0 tests=MISSING_HEADERS,SPF_FAIL, > SPF_HELO_FAIL autolearn=no autolearn_force=no version=3.4.0 >Am I missing something? >yes, tarin your bayers properly with enough spam *and* ham samples and train >the bayes wihich is really in use - >do you see any BAYES_ tag above? no! so >bayes was not used at all If you don't see any BAYES_* rule hits make sure the plugin is enabled: v320.pre:loadplugin Mail::SpamAssassin::Plugin::Bayes Run a debug lint and check for bayes output: spamassassin -D --lint 2>&1 | grep -i bayes You should see a BAYES_ in the test= line near the end. Another common problem is the Bayes training is done as one user while spamassassin is being called by a different user. This depends on how/what is launching SA -- amavis-new, spamd, MailScanner, etc. You can force the bayes_path in the local.cf to make sure all users use the same Bayes DB if you are using a global (not individual) Bayes DB. Dave
Re: SpamAssassin score
Thanks for that information. After ~1750 messages having been digested, still no improvement: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23 0 non-token data: nspam 0.000 0 1729 0 non-token data: nham 0.000 0 123471 0 non-token data: ntokens 0.000 0 1358530476 0 non-token data: oldest atime 0.000 0 1489938564 0 non-token data: newest atime 0.000 0 0 0 non-token data: last journal sync atime 0.000 0 0 0 non-token data: last expiry atime 0.000 0 0 0 non-token data: last expire atime delta 0.000 0 0 0 non-token data: last expire reduction count Have you got an idea of the required order of magnitude of the input volume for the bayesian filter to kick in? --- Bernard On 20/03/2017 11:15, Reindl Harald wrote: > > > Am 20.03.2017 um 11:12 schrieb Bernard: >> 1. How come the same message being classified either as spam/ham >> returns the same score? I would expect a message learnt as 'spam' to >> get a score at least equal to the spam score threshold >> 2. Even though the message was correctly learnt as spam before and >> after the test, receiving this email message is still not tagged as >> spam: >> >> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on *** >> X-Spam-Level: ** >> X-Spam-Status: No, score=2.1 required=5.0 >> tests=MISSING_HEADERS,SPF_FAIL, >> SPF_HELO_FAIL autolearn=no autolearn_force=no version=3.4.0 >> >> Am I missing something? > > yes, tarin your bayers properly with enough spam *and* ham samples and > train the bayes wihich is really in use - do you see any BAYES_ tag > above? no! so bayes was not used at all
SpamAssassin score
Hello, Using SpamAssassin, I am trying to make it learn 'bad' messages. Experimenting with the learning process, I do not seem to be able to reach a successful outcome: $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock --learntype=spam < spamassassin/junktestmail Message was already un/learned $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock -c < spamassassin/junktestmail &&hideme 3.7/5.0 $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock --learntype=ham < spamassassin/junktestmail Message successfully un/learned $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock --learntype=ham < spamassassin/junktestmail Message was already un/learned $ hideprev $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock -c < spamassassin/junktestmail &&hideme 3.7/5.0 $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock --learntype=spam < spamassassin/junktestmail Message successfully un/learned $ spamc --username=debian-spamd --socket=/run/spamd/spamd.sock --learntype=spam < spamassassin/junktestmail Message was already un/learned 1. How come the same message being classified either as spam/ham returns the same score? I would expect a message learnt as 'spam' to get a score at least equal to the spam score threshold 2. Even though the message was correctly learnt as spam before and after the test, receiving this email message is still not tagged as spam: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on *** X-Spam-Level: ** X-Spam-Status: No, score=2.1 required=5.0 tests=MISSING_HEADERS,SPF_FAIL, SPF_HELO_FAIL autolearn=no autolearn_force=no version=3.4.0 Am I missing something? --- Bernard
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 16.12.2014 09:21, Herbert Eppel wrote: > > > On 15.12.2014 20:09 UK Time, Jari Fredriksson wrote: >> On 15.12.2014 20:16, Herbert Eppel wrote: >>> >>> On 15.12.2014 18:03 UK Time, Joe Quinn wrote: >>>> On 12/15/2014 12:34 PM, Herbert Eppel wrote: >>>>> On 15.12.2014 17:27 UK Time, Joe Quinn wrote: >>>>>> On 12/15/2014 12:20 PM, Herbert Eppel wrote: >>>>>>> I use QiQ.co.uk for web hosting and associated e-mail services. >>>>>>> QiQ offer SpamAssassin as an integrated feature that is accessible >>>>>>> via cPanel – see screenshot below. >>>>>>> >>>>>>> In view of the fact that some of my domains are increasingly >>>>>>> inundated with spam, I would like to reduce the SpamAssassin score >>>>>>> from the default value of 5 to a lower value, in order to make >>>>>>> SpamAssassin more 'aggressive'. However, I don't really want to >>>>>>> enable Spam Auto-Delete because I want to be able to check the >>>>>>> spam folder for false positives, but apparently there is no way to >>>>>>> change the setting without simultaneously enabling the "Spam >>>>>>> Auto-Delete" function. >>>>>>> >>>>>>> Am I missing something? >>>>>>> >>>>>>> Thank you >>>>>>> >>>>>>> Herbert Eppel >>>>>>> www.HETranslation.co.uk >>>>>>> >>>>>> You'll need to ask QiQ. SA is only a classifier. It takes an email >>>>>> as input and outputs score results, plus a modified email with spam >>>>>> headers. >>>>>> >>>>>> I would also caution against lowering the score threshold more than >>>>>> 0.5 or so. There's a point where it goes from "catching more spam" >>>>>> to "catching more of everything". >>>>> >>>>> Thanks for your reply. >>>>> >>>>> I already asked QiQ support. They asked me to ask SA :-) >>>>> >>>>> Here is their reply: >>>>> /I will take a look at the filter but would imagine if that is how >>>>> Spam Assassin made the program that way, then there is nothing we >>>>> can do to change it, though contacting Spam Assassin for advice may >>>>> be the way forward, as we do not provide Spam Assassin, it is a part >>>>> of cPanel - both third party programs./ >>>>> >>>>> The question remains: How can I change the SA score without >>>>> simultaneously enabling the "Spam Auto-Delete" function? >>>>> >>>>> Perhaps I need to ask cPanel support? >>>>> >>>>> Herbert Eppel >>>>> www.HETranslation.co.uk >>>> (bringing this back on list) >>>> >>>> Quite likely. I am not familiar enough with cPanel to know the level >>>> of configuration it gives, but my educated guess would be that it's >>>> up to QiQ to configure their install of cPanel. It shouldn't hurt to >>>> ask cPanel people anyway, even if it's just for them to say exactly >>>> what options QiQ should set that opens the option to classify without >>>> discard. >>> >>> Ooops, I didn't realise I had replied privately. Thanks for your >>> further reply. >>> >>> Is there another way to access the SA score setting, outside cPanel? >>> >>> Herbert Eppel >>> www.HETranslation.co.uk >>> >> >> SpamAssassin has global settings in text files in the server, and also >> *possibly* user definable settings also in a text file(s) in the disk of >> the server. If you have a home directory the server (shell access) *and* >> QiQ has configured SpamAsassin to allow user configured settings, then >> yes. If neither of these options evaluate to "yes" then no. >> >> > > Thanks for your reply. I have access to /.spamassassin/user_prefs - is > that what you mean? > Yes. You can tweak spamassasin via that file -- jarif.bit signature.asc Description: OpenPGP digital signature
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On Tue, 2014-12-16 at 07:32 +, Herbert Eppel wrote: > The spam overload problem mainly arises at times when I read mail on my > smartphone, in which case I don't have the additional Thunderbird spam > filtering available, and my QiQ mailbox tends to be swamped with spam, > which is why I want to try and get a better grip on the spam situation > at the server level. > Understood. Is there any possibility of adding an equivalent to the Thunderbird junk filter to your phone's mailreader or of swapping it for a program that does provide junk filtering? Martin
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
Update: In the meantime a member of this group got in touch privately. Based on spam message header information I sent him he identified several apparent shortcomings (unrelated to SA) in the way spam messages are handled at the QiQ server end. I will get in touch with QiQ with a view to try and get these shortcomings rectified. Sorry about the apparent 'red herring', but it has been quite 'educational'. Thanks for all your input. Herbert Eppel www.HETranslation.co.uk On 15.12.2014 17:20 UK Time, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 21:04 UK Time, LuKreme wrote: On Dec 15, 2014, at 10:20 AM, Herbert Eppel wrote: In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive' This is not the way to go, though it seems to make sense. The rulesets are designed around the idea that pushing past a 5.0 indicates a strong possibility that the message is spam and that a sore of 4.5 is not. If you drop the score to 4.5, you are not making SA more aggressive, you are intentionally marking message that SA says are not spam as spam. A better way is to adjust scores. Carefully. The best way is to train babes, but train it well. If your host doesn’t allow this, maybe you can find a host that does? Also, what is your server doing BEFORE receiving the message to block spam? Most mail providers with cPanel seem to do either nothing or nearly nothing. Good filters and postscreen (or postscreen-like) before SMTP transaction will do *far* more to alleviate your spam problem. Thanks for your reply. I'm not sure what you mean by "adjust scores" and how to go about it. I don't really want to switch from QiQ as provider, because apart from the spam issue I'm very happy with their service. Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 20:51 UK Time, Martin Gregorie wrote: On Mon, 2014-12-15 at 18:20 +, Herbert Eppel wrote: Thanks for your reply, but I'm afraid as an ordinary SA user with limited knowledge of these matters I have, quite frankly, no idea what you are talking about. We may be able to offer more relevant help if we understood how your mail system is connected up. So far it looks as though your mail is: - received by your ISP's main mailserver - passed to SA which adds spam scoring headers - then passed through your ISP's spam filter, which deletes any message with a score high enough to be treated as spam. What happens after that? Are you simply pointing a mail reader at your ISP's system and using POP3 or IMAP to retrieve mail from their server? - if so, what mailreader are you using? Different Mailreaders have varying ways of handling spam. These range from quite elaborate and configuring to nothing at all. - if you are doing something different or more elaborate, tell us what you're using and how its connected. Hi Martin Thanks for your helpful reply. I mainly use Thunderbird in POP3 mode to retrieve mail from the server(s). As you are probably aware, Thunderbird has a junk training facility that quite adequately deals with spam that gets through at the server level. The spam overload problem mainly arises at times when I read mail on my smartphone, in which case I don't have the additional Thunderbird spam filtering available, and my QiQ mailbox tends to be swamped with spam, which is why I want to try and get a better grip on the spam situation at the server level. Regards Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 20:14 UK Time, Tom Hendrikx wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 15-12-14 19:16, Herbert Eppel wrote: On 15.12.2014 18:03 UK Time, Joe Quinn wrote: On 12/15/2014 12:34 PM, Herbert Eppel wrote: On 15.12.2014 17:27 UK Time, Joe Quinn wrote: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything". Thanks for your reply. I already asked QiQ support. They asked me to ask SA :-) Here is their reply: /I will take a look at the filter but would imagine if that is how Spam Assassin made the program that way, then there is nothing we can do to change it, though contacting Spam Assassin for advice may be the way forward, as we do not provide Spam Assassin, it is a part of cPanel - both third party programs./ The question remains: How can I change the SA score without simultaneously enabling the "Spam Auto-Delete" function? Perhaps I need to ask cPanel support? Herbert Eppel www.HETranslation.co.uk (bringing this back on list) Quite likely. I am not familiar enough with cPanel to know the level of configuration it gives, but my educated guess would be that it's up to QiQ to configure their install of cPanel. It shouldn't hurt to ask cPanel people anyway, even if it's just for them to say exactly what options QiQ should set that opens the option to classify without discard. Ooops, I didn't realise I had replied privately. Thanks for your further reply. Is there another way to access the SA score setting, outside cPanel? I think this is more a cPanel question than a spamassassin one. A very quick google pointed me towards https://documentation.cpanel.net/display/ALD/Apache+SpamAssassin After skimming that, it seems to me that your hosting provider (QIQ) needs to configure cPanel for you in order to have mail labeled as spam delivered (to your spam folder or otherwise). Also, in the default settings, mail labeled as spam by spamassassin is already dropped (auto-delete spam): you can only change the score threshold in the gui. So RTFM, try out some cPanel settings, and contact QIQ when you have a better understanding of what you can do yourself, and what cPanel should be able to provide given that QIQ does some tweaking for you. As far as the level of technical insights you've shown in your messages until now, I don't think it's useful (or fair) to get into the gory details of spamassassin config with you. I'm not being unfriendly but I'm guessing that you use cPanel for a reason: you're not the seasoned (e-mail) admin that is comfortable tinkering with command line and manual config file editing. Kind regards, Tom Thanks for your reply. FWIW, I regard myself as quite a seasoned computer and e-mail user, and I'm not afraid of editing the registry and Mozilla config files, for example, provided I have some guidance. It's just that the finer details of spam prevention are quite new to me. With my other mail accounts (Gmail and GMX), spam is automatically handled very adequately at the server level, but it seems manual tweaking is required with my QiQ accounts in order to get the spam situation under control. As for spam auto-delete, the screenshot I sent with my original message shows that this is in fact disabled. Regards Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 20:09 UK Time, Jari Fredriksson wrote: On 15.12.2014 20:16, Herbert Eppel wrote: On 15.12.2014 18:03 UK Time, Joe Quinn wrote: On 12/15/2014 12:34 PM, Herbert Eppel wrote: On 15.12.2014 17:27 UK Time, Joe Quinn wrote: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything". Thanks for your reply. I already asked QiQ support. They asked me to ask SA :-) Here is their reply: /I will take a look at the filter but would imagine if that is how Spam Assassin made the program that way, then there is nothing we can do to change it, though contacting Spam Assassin for advice may be the way forward, as we do not provide Spam Assassin, it is a part of cPanel - both third party programs./ The question remains: How can I change the SA score without simultaneously enabling the "Spam Auto-Delete" function? Perhaps I need to ask cPanel support? Herbert Eppel www.HETranslation.co.uk (bringing this back on list) Quite likely. I am not familiar enough with cPanel to know the level of configuration it gives, but my educated guess would be that it's up to QiQ to configure their install of cPanel. It shouldn't hurt to ask cPanel people anyway, even if it's just for them to say exactly what options QiQ should set that opens the option to classify without discard. Ooops, I didn't realise I had replied privately. Thanks for your further reply. Is there another way to access the SA score setting, outside cPanel? Herbert Eppel www.HETranslation.co.uk SpamAssassin has global settings in text files in the server, and also *possibly* user definable settings also in a text file(s) in the disk of the server. If you have a home directory the server (shell access) *and* QiQ has configured SpamAsassin to allow user configured settings, then yes. If neither of these options evaluate to "yes" then no. Thanks for your reply. I have access to /.spamassassin/user_prefs - is that what you mean? Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 18:38 UK Time, Reindl Harald wrote: Am 15.12.2014 um 19:20 schrieb Herbert Eppel: On 15.12.2014 18:02 UK Time, Reindl Harald wrote: besides that using RBL scoring and wise filters for dynamic PTRs and invalid HELO names *before* SA on the MTA level should reject most spam without false positives 3 months: * 25 delivered ham messages * 85 MTA level rejects * 32000 SA hits Thanks for your reply, but I'm afraid as an ordinary SA user with limited knowledge of these matters I have, quite frankly, no idea what you are talking about. Don't hesitate to tell me to RTFM, but if you feel like elaborating a little, ideally in an 'acronym-free environment', I would be grateful. for postfix just Google for the parameters below and read http://www.postfix.org/POSTSCREEN_README.html which will kill 90% of all junk before it ever touchs the expensive content filter since only the dialup-balcklists have the reject score of 8 and all others need at least confirmation based on trust-level of the RBL combined with some whitelists you achieve both: * large amount of catches * avoid false positives this like "127.0.0.[4..7]" are the RBL response codes of aggregated lists which has the benefit postscreen needs only do a single dns lookup and weight the results (RTFM of the RBL's itself) postscreen_dnsbl_ttl = 5m postscreen_dnsbl_threshold = 8 postscreen_dnsbl_action = enforce postscreen_greet_action = enforce postscreen_dnsbl_sites = dnsbl.sorbs.net=127.0.0.10*8 zen.spamhaus.org=127.0.0.[10;11]*8 b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 dnsbl.sorbs.net=127.0.0.5*7 zen.spamhaus.org=127.0.0.[4..7]*7 zen.spamhaus.org=127.0.0.3*5 bl.mailspike.net=127.0.0.2*5 bl.mailspike.net=127.0.0.[10;11;12]*4 bl.spamcop.net=127.0.0.2*4 bl.spameatingmonkey.net=127.0.0.[2;3]*4 dnsrbl.swinog.ch=127.0.0.3*4 zen.spamhaus.org=127.0.0.2*3 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 wl.mailspike.net=127.0.0.[18;19;20]*-2 list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].2*-4 list.dnswl.org=127.0.[0..255].3*-5 Thanks for your further reply, but all this stuff is quite new to me, and I'm quite mystified by it, to be honest. Grüße nach Wien Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 23:40, Axb wrote: > On 12/15/2014 10:04 PM, LuKreme wrote: >> The best way is to train babes > > now THAT is a challenge... > > What do you feed them during the process? > diamonds? an appt in the Burj Khalifa? a Veneno Roadster? > > > I know that this adds just the noise but it should be obvious that axb wrote from a cell phone with auto correct... -- jarif.bit signature.asc Description: OpenPGP digital signature
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 12/15/2014 10:04 PM, LuKreme wrote: The best way is to train babes now THAT is a challenge... What do you feed them during the process? diamonds? an appt in the Burj Khalifa? a Veneno Roadster?
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On Dec 15, 2014, at 10:20 AM, Herbert Eppel wrote: > In view of the fact that some of my domains are increasingly inundated with > spam, I would like to reduce the SpamAssassin score from the default value of > 5 to a lower value, in order to make SpamAssassin more 'aggressive' This is not the way to go, though it seems to make sense. The rulesets are designed around the idea that pushing past a 5.0 indicates a strong possibility that the message is spam and that a sore of 4.5 is not. If you drop the score to 4.5, you are not making SA more aggressive, you are intentionally marking message that SA says are not spam as spam. A better way is to adjust scores. Carefully. The best way is to train babes, but train it well. If your host doesn’t allow this, maybe you can find a host that does? Also, what is your server doing BEFORE receiving the message to block spam? Most mail providers with cPanel seem to do either nothing or nearly nothing. Good filters and postscreen (or postscreen-like) before SMTP transaction will do *far* more to alleviate your spam problem. -- you cannot code around infinite implementations of OCD -John C Welch
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On Mon, 2014-12-15 at 18:20 +, Herbert Eppel wrote: > Thanks for your reply, but I'm afraid as an ordinary SA user with > limited knowledge of these matters I have, quite frankly, no idea what > you are talking about. > We may be able to offer more relevant help if we understood how your mail system is connected up. So far it looks as though your mail is: - received by your ISP's main mailserver - passed to SA which adds spam scoring headers - then passed through your ISP's spam filter, which deletes any message with a score high enough to be treated as spam. What happens after that? Are you simply pointing a mail reader at your ISP's system and using POP3 or IMAP to retrieve mail from their server? - if so, what mailreader are you using? Different Mailreaders have varying ways of handling spam. These range from quite elaborate and configuring to nothing at all. - if you are doing something different or more elaborate, tell us what you're using and how its connected. Martin
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 15-12-14 19:16, Herbert Eppel wrote: > > On 15.12.2014 18:03 UK Time, Joe Quinn wrote: >> On 12/15/2014 12:34 PM, Herbert Eppel wrote: >>> On 15.12.2014 17:27 UK Time, Joe Quinn wrote: >>>> On 12/15/2014 12:20 PM, Herbert Eppel wrote: >>>>> I use QiQ.co.uk for web hosting and associated e-mail >>>>> services. QiQ offer SpamAssassin as an integrated feature >>>>> that is accessible via cPanel – see screenshot below. >>>>> >>>>> In view of the fact that some of my domains are >>>>> increasingly inundated with spam, I would like to reduce >>>>> the SpamAssassin score from the default value of 5 to a >>>>> lower value, in order to make SpamAssassin more >>>>> 'aggressive'. However, I don't really want to enable Spam >>>>> Auto-Delete because I want to be able to check the spam >>>>> folder for false positives, but apparently there is no way >>>>> to change the setting without simultaneously enabling the >>>>> "Spam Auto-Delete" function. >>>>> >>>>> Am I missing something? >>>>> >>>>> Thank you >>>>> >>>>> Herbert Eppel www.HETranslation.co.uk >>>>> >>>> You'll need to ask QiQ. SA is only a classifier. It takes an >>>> email as input and outputs score results, plus a modified >>>> email with spam headers. >>>> >>>> I would also caution against lowering the score threshold >>>> more than 0.5 or so. There's a point where it goes from >>>> "catching more spam" to "catching more of everything". >>> >>> Thanks for your reply. >>> >>> I already asked QiQ support. They asked me to ask SA :-) >>> >>> Here is their reply: /I will take a look at the filter but >>> would imagine if that is how Spam Assassin made the program >>> that way, then there is nothing we can do to change it, though >>> contacting Spam Assassin for advice may be the way forward, as >>> we do not provide Spam Assassin, it is a part of cPanel - both >>> third party programs./ >>> >>> The question remains: How can I change the SA score without >>> simultaneously enabling the "Spam Auto-Delete" function? >>> >>> Perhaps I need to ask cPanel support? >>> >>> Herbert Eppel www.HETranslation.co.uk >> (bringing this back on list) >> >> Quite likely. I am not familiar enough with cPanel to know the >> level of configuration it gives, but my educated guess would be >> that it's up to QiQ to configure their install of cPanel. It >> shouldn't hurt to ask cPanel people anyway, even if it's just for >> them to say exactly what options QiQ should set that opens the >> option to classify without discard. > > Ooops, I didn't realise I had replied privately. Thanks for your > further reply. > > Is there another way to access the SA score setting, outside > cPanel? > I think this is more a cPanel question than a spamassassin one. A very quick google pointed me towards https://documentation.cpanel.net/display/ALD/Apache+SpamAssassin After skimming that, it seems to me that your hosting provider (QIQ) needs to configure cPanel for you in order to have mail labeled as spam delivered (to your spam folder or otherwise). Also, in the default settings, mail labeled as spam by spamassassin is already dropped (auto-delete spam): you can only change the score threshold in the gui. So RTFM, try out some cPanel settings, and contact QIQ when you have a better understanding of what you can do yourself, and what cPanel should be able to provide given that QIQ does some tweaking for you. As far as the level of technical insights you've shown in your messages until now, I don't think it's useful (or fair) to get into the gory details of spamassassin config with you. I'm not being unfriendly but I'm guessing that you use cPanel for a reason: you're not the seasoned (e-mail) admin that is comfortable tinkering with command line and manual config file editing. Kind regards, Tom -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQIcBAEBCAAGBQJUj0ErAAoJEJPfMZ19VO/1UBkQAMH9iUJBMnoU30UmH142IrYQ Hdh/8CzS77kNHJ/P4vslFDumHca6vLVhEEc8tivLa0OlPl5gs7d0jOEmyDP5XWdq +B6OUZIiwhsDfmKzT2FiO8xxw2JK4qwC+CDae0K+ul+SLOz9mbhuDWg+GamvuqmK yoVu4tWkKQ4Kl+5iDczBnxjWJLDckt/ut97VsbJOK1giNGu1NLA+Mhswn+aKznYP dIAEIP0UacgKfQJj5+I744CPwJcTUz0eErPzqWsBvyo5CuVOjBpiTG/qhBBEsJ4P 94bHSX0R9WzrI33HTHqYR1WCQ1ZTY21ETUOzEjo/XypNqtTPkwiGLvFGtngwp1vk NOzNBPrA6/+bBCrmKgv7VKnBXEK1/1j3fXW5SpPHhNBusbStQ4Tr+83EMlPkNqc/ hNtztSDbRTBbsB4igTXwKXPx4sYnSvSOc1rwjAgjMJuYkENPv7TDGjHo8K7Wsyvq aF0v9ekxOYSYSD31P70hmJ1iqKFPYVjaxH3skE5EH+bHJRtht7x6IMeVjUhiUxeT wdUkpttgUH/TUjDGu6nsK1p+PC5N2JfvTC2nuk2qDB62UqcXmbh6XFCynodXe4cb hWsGfFY0tWsVBxZm+iMv9aqqpX0a+QuGl+mVd6UEGROfzM0l71KqPvBL5koI+hr6 qAx9HxCzuzZ79/uWEO8c =wVtz -END PGP SIGNATURE-
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 20:16, Herbert Eppel wrote: > > On 15.12.2014 18:03 UK Time, Joe Quinn wrote: >> On 12/15/2014 12:34 PM, Herbert Eppel wrote: >>> On 15.12.2014 17:27 UK Time, Joe Quinn wrote: >>>> On 12/15/2014 12:20 PM, Herbert Eppel wrote: >>>>> I use QiQ.co.uk for web hosting and associated e-mail services. >>>>> QiQ offer SpamAssassin as an integrated feature that is accessible >>>>> via cPanel – see screenshot below. >>>>> >>>>> In view of the fact that some of my domains are increasingly >>>>> inundated with spam, I would like to reduce the SpamAssassin score >>>>> from the default value of 5 to a lower value, in order to make >>>>> SpamAssassin more 'aggressive'. However, I don't really want to >>>>> enable Spam Auto-Delete because I want to be able to check the >>>>> spam folder for false positives, but apparently there is no way to >>>>> change the setting without simultaneously enabling the "Spam >>>>> Auto-Delete" function. >>>>> >>>>> Am I missing something? >>>>> >>>>> Thank you >>>>> >>>>> Herbert Eppel >>>>> www.HETranslation.co.uk >>>>> >>>> You'll need to ask QiQ. SA is only a classifier. It takes an email >>>> as input and outputs score results, plus a modified email with spam >>>> headers. >>>> >>>> I would also caution against lowering the score threshold more than >>>> 0.5 or so. There's a point where it goes from "catching more spam" >>>> to "catching more of everything". >>> >>> Thanks for your reply. >>> >>> I already asked QiQ support. They asked me to ask SA :-) >>> >>> Here is their reply: >>> /I will take a look at the filter but would imagine if that is how >>> Spam Assassin made the program that way, then there is nothing we >>> can do to change it, though contacting Spam Assassin for advice may >>> be the way forward, as we do not provide Spam Assassin, it is a part >>> of cPanel - both third party programs./ >>> >>> The question remains: How can I change the SA score without >>> simultaneously enabling the "Spam Auto-Delete" function? >>> >>> Perhaps I need to ask cPanel support? >>> >>> Herbert Eppel >>> www.HETranslation.co.uk >> (bringing this back on list) >> >> Quite likely. I am not familiar enough with cPanel to know the level >> of configuration it gives, but my educated guess would be that it's >> up to QiQ to configure their install of cPanel. It shouldn't hurt to >> ask cPanel people anyway, even if it's just for them to say exactly >> what options QiQ should set that opens the option to classify without >> discard. > > Ooops, I didn't realise I had replied privately. Thanks for your > further reply. > > Is there another way to access the SA score setting, outside cPanel? > > Herbert Eppel > www.HETranslation.co.uk > SpamAssassin has global settings in text files in the server, and also *possibly* user definable settings also in a text file(s) in the disk of the server. If you have a home directory the server (shell access) *and* QiQ has configured SpamAsassin to allow user configured settings, then yes. If neither of these options evaluate to "yes" then no. -- jarif.bit signature.asc Description: OpenPGP digital signature
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
Am 15.12.2014 um 19:20 schrieb Herbert Eppel: On 15.12.2014 18:02 UK Time, Reindl Harald wrote: besides that using RBL scoring and wise filters for dynamic PTRs and invalid HELO names *before* SA on the MTA level should reject most spam without false positives 3 months: * 25 delivered ham messages * 85 MTA level rejects * 32000 SA hits Thanks for your reply, but I'm afraid as an ordinary SA user with limited knowledge of these matters I have, quite frankly, no idea what you are talking about. Don't hesitate to tell me to RTFM, but if you feel like elaborating a little, ideally in an 'acronym-free environment', I would be grateful. for postfix just Google for the parameters below and read http://www.postfix.org/POSTSCREEN_README.html which will kill 90% of all junk before it ever touchs the expensive content filter since only the dialup-balcklists have the reject score of 8 and all others need at least confirmation based on trust-level of the RBL combined with some whitelists you achieve both: * large amount of catches * avoid false positives this like "127.0.0.[4..7]" are the RBL response codes of aggregated lists which has the benefit postscreen needs only do a single dns lookup and weight the results (RTFM of the RBL's itself) postscreen_dnsbl_ttl = 5m postscreen_dnsbl_threshold = 8 postscreen_dnsbl_action = enforce postscreen_greet_action = enforce postscreen_dnsbl_sites = dnsbl.sorbs.net=127.0.0.10*8 zen.spamhaus.org=127.0.0.[10;11]*8 b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 dnsbl.sorbs.net=127.0.0.5*7 zen.spamhaus.org=127.0.0.[4..7]*7 zen.spamhaus.org=127.0.0.3*5 bl.mailspike.net=127.0.0.2*5 bl.mailspike.net=127.0.0.[10;11;12]*4 bl.spamcop.net=127.0.0.2*4 bl.spameatingmonkey.net=127.0.0.[2;3]*4 dnsrbl.swinog.ch=127.0.0.3*4 zen.spamhaus.org=127.0.0.2*3 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 wl.mailspike.net=127.0.0.[18;19;20]*-2 list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].2*-4 list.dnswl.org=127.0.[0..255].3*-5 signature.asc Description: OpenPGP digital signature
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 18:02 UK Time, Reindl Harald wrote: Am 15.12.2014 um 18:27 schrieb Joe Quinn: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything" besides that using RBL scoring and wise filters for dynamic PTRs and invalid HELO names *before* SA on the MTA level should reject most spam without false positives 3 months: * 25 delivered ham messages * 85 MTA level rejects * 32000 SA hits Thanks for your reply, but I'm afraid as an ordinary SA user with limited knowledge of these matters I have, quite frankly, no idea what you are talking about. Don't hesitate to tell me to RTFM, but if you feel like elaborating a little, ideally in an 'acronym-free environment', I would be grateful. Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 15.12.2014 18:03 UK Time, Joe Quinn wrote: On 12/15/2014 12:34 PM, Herbert Eppel wrote: On 15.12.2014 17:27 UK Time, Joe Quinn wrote: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything". Thanks for your reply. I already asked QiQ support. They asked me to ask SA :-) Here is their reply: I will take a look at the filter but would imagine if that is how Spam Assassin made the program that way, then there is nothing we can do to change it, though contacting Spam Assassin for advice may be the way forward, as we do not provide Spam Assassin, it is a part of cPanel - both third party programs. The question remains: How can I change the SA score without simultaneously enabling the "Spam Auto-Delete" function? Perhaps I need to ask cPanel support? Herbert Eppel www.HETranslation.co.uk (bringing this back on list) Quite likely. I am not familiar enough with cPanel to know the level of configuration it gives, but my educated guess would be that it's up to QiQ to configure their install of cPanel. It shouldn't hurt to ask cPanel people anyway, even if it's just for them to say exactly what options QiQ should set that opens the option to classify without discard. Ooops, I didn't realise I had replied privately. Thanks for your further reply. Is there another way to access the SA score setting, outside cPanel? Herbert Eppel www.HETranslation.co.uk
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
Am 15.12.2014 um 18:27 schrieb Joe Quinn: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything" besides that using RBL scoring and wise filters for dynamic PTRs and invalid HELO names *before* SA on the MTA level should reject most spam without false positives 3 months: * 25 delivered ham messages * 85 MTA level rejects * 32000 SA hits signature.asc Description: OpenPGP digital signature
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 12/15/2014 12:34 PM, Herbert Eppel wrote: On 15.12.2014 17:27 UK Time, Joe Quinn wrote: On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel -- see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything". Thanks for your reply. I already asked QiQ support. They asked me to ask SA :-) Here is their reply: /I will take a look at the filter but would imagine if that is how Spam Assassin made the program that way, then there is nothing we can do to change it, though contacting Spam Assassin for advice may be the way forward, as we do not provide Spam Assassin, it is a part of cPanel - both third party programs./ The question remains: How can I change the SA score without simultaneously enabling the "Spam Auto-Delete" function? Perhaps I need to ask cPanel support? Herbert Eppel www.HETranslation.co.uk (bringing this back on list) Quite likely. I am not familiar enough with cPanel to know the level of configuration it gives, but my educated guess would be that it's up to QiQ to configure their install of cPanel. It shouldn't hurt to ask cPanel people anyway, even if it's just for them to say exactly what options QiQ should set that opens the option to classify without discard.
Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
On 12/15/2014 12:20 PM, Herbert Eppel wrote: I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel -- see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk You'll need to ask QiQ. SA is only a classifier. It takes an email as input and outputs score results, plus a modified email with spam headers. I would also caution against lowering the score threshold more than 0.5 or so. There's a point where it goes from "catching more spam" to "catching more of everything".
Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function
I use QiQ.co.uk for web hosting and associated e-mail services. QiQ offer SpamAssassin as an integrated feature that is accessible via cPanel – see screenshot below. In view of the fact that some of my domains are increasingly inundated with spam, I would like to reduce the SpamAssassin score from the default value of 5 to a lower value, in order to make SpamAssassin more 'aggressive'. However, I don't really want to enable Spam Auto-Delete because I want to be able to check the spam folder for false positives, but apparently there is no way to change the setting without simultaneously enabling the "Spam Auto-Delete" function. Am I missing something? Thank you Herbert Eppel www.HETranslation.co.uk
Re: Some SpamAssassin Score Translations Please ?
yOn Mon, 12 Sep 2011, John Hardin wrote: On Mon, 12 Sep 2011, Thomas Grossmann wrote: Came across these in one of my SpamAssassin reports... Can someone please help me with what they mean exactly so that I can try to pinpoint what is triggering this. Please do not reply to an existing thread and then completely change the topic like that. It breaks threading and may keep people from reading your question if they've decided the existing thread isn't interesting. ...dammit. Never mind, that subject was too close to the subject from the preceding message, rant withdrawn. Sorry. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- 5 days until the 224th anniversary of the signing of the U.S. Constitution
Re: Some SpamAssassin Score Translations Please ?
On Mon, 12 Sep 2011, Thomas Grossmann wrote: Came across these in one of my SpamAssassin reports... Can someone please help me with what they mean exactly so that I can try to pinpoint what is triggering this. Please do not reply to an existing thread and then completely change the topic like that. It breaks threading and may keep people from reading your question if they've decided the existing thread isn't interesting. Start a new thread with a subject that accurately describes the topic. Thanks. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- There is no doubt in my mind that millions of lives could have been saved if the people were not "brainwashed" about gun ownership and had been well armed. ... Gun haters always want to forget the Warsaw Ghetto uprising, which is a perfect example of how a ragtag, half-starved group of Jews took 10 handguns and made asses out of the Nazis.-- Theodore Haas, Dachau survivor --- 5 days until the 224th anniversary of the signing of the U.S. Constitution
Re: Some SpamAssassin Score Translations Please ?
On 9/12/2011 12:36 PM, Thomas Grossmann wrote: > Came across these in one of my SpamAssassin reports... Can someone > please help me with what they mean exactly so that I can try to > pinpoint what is triggering this. > > Thanks! > > 5.0 CT_MAILBOX_QUOTA Fake Mailbox Quota Phish > > 8.0 CT_QUOTA_PHISH Quota Phishing > > Those do not appear to be standard rules. Search your local rules directory for the rule name. If you find it, post the rule definition and we can tell you what it does. -- Bowie
Some SpamAssassin Score Translations Please ?
Came across these in one of my SpamAssassin reports... Can someone please help me with what they mean exactly so that I can try to pinpoint what is triggering this. Thanks! 5.0 CT_MAILBOX_QUOTA Fake Mailbox Quota Phish 8.0 CT_QUOTA_PHISH Quota Phishing Kind Regards, Tom
Re: rfc-ignorant spamassassin score
On Friday 17 October 2008, Chris wrote: >On Friday 17 October 2008 7:24 pm, Gene Heskett wrote: >> >Today, it indicates yahoo.com. >> >> Which equates to the same thing. I did have a few addresses of known spam >> emitters in my procmailrc, but found I had to remove one of those in spite >> of it being responsible for about 200 spams a day. Seems that machine was >> also the outbound sender for quite a few of the mailing lists yahoo >> maintains. >> >> Nastygrams to yahoo of course are attracted to a black hole they feed all >> mail addressed to 'postmaster' and 'admin', never to be seen by another >> human who might have a quarter to call somebody who gives a $hit. > >Odd, I have no problems at all sending abuse messages to yahoo and I > actually get replies, whether their honest ones or not I don't know but > they do come in. For instance: > >From: Yahoo! New Zealand <[EMAIL PROTECTED]> > To: Chris <[EMAIL PROTECTED]> > Reply to: Yahoo! New Zealand <[EMAIL PROTECTED]> > >Hello, > >Thank you for writing to Yahoo! New Zealand. > >In this particular case, we have taken appropriate action against the >Yahoo!Xtra account in question, as per our Terms of Service (TOS). > >From: Yahoo! Mail <[EMAIL PROTECTED]> > To: Chris <[EMAIL PROTECTED]> > Reply to: Yahoo! Mail <[EMAIL PROTECTED]> > >Hello, > >Thank you for writing to Yahoo! Mail. > >In this particular case, we have taken appropriate action against the >Yahoo! account in question, as per our Terms of Service (TOS). For >further details about the Yahoo! TOS, you can visit: > >Note - I send all yahoo abuse reports to [EMAIL PROTECTED], >[EMAIL PROTECTED] via a set of scripts I run that were written by >Karsten Self. Never ever got a reply from them, nor did the flood of spam go away till weeks later. YMMV I guess. :) -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Nothing ever becomes real till it is experienced -- even a proverb is no proverb to you till your life has illustrated it. -- John Keats
Re: rfc-ignorant spamassassin score
On Friday 17 October 2008 7:24 pm, Gene Heskett wrote: > >Today, it indicates yahoo.com. > > Which equates to the same thing. I did have a few addresses of known spam > emitters in my procmailrc, but found I had to remove one of those in spite > of it being responsible for about 200 spams a day. Seems that machine was > also the outbound sender for quite a few of the mailing lists yahoo > maintains. > > Nastygrams to yahoo of course are attracted to a black hole they feed all > mail addressed to 'postmaster' and 'admin', never to be seen by another > human who might have a quarter to call somebody who gives a $hit. Odd, I have no problems at all sending abuse messages to yahoo and I actually get replies, whether their honest ones or not I don't know but they do come in. For instance: From: Yahoo! New Zealand <[EMAIL PROTECTED]> To: Chris <[EMAIL PROTECTED]> Reply to: Yahoo! New Zealand <[EMAIL PROTECTED]> Hello, Thank you for writing to Yahoo! New Zealand. In this particular case, we have taken appropriate action against the Yahoo!Xtra account in question, as per our Terms of Service (TOS). From: Yahoo! Mail <[EMAIL PROTECTED]> To: Chris <[EMAIL PROTECTED]> Reply to: Yahoo! Mail <[EMAIL PROTECTED]> Hello, Thank you for writing to Yahoo! Mail. In this particular case, we have taken appropriate action against the Yahoo! account in question, as per our Terms of Service (TOS). For further details about the Yahoo! TOS, you can visit: Note - I send all yahoo abuse reports to [EMAIL PROTECTED], [EMAIL PROTECTED] via a set of scripts I run that were written by Karsten Self. -- Chris KeyID 0xE372A7DA98E6705C pgpHqCLLfl3mD.pgp Description: PGP signature
Re: rfc-ignorant spamassassin score
On Friday 17 October 2008, Benny Pedersen wrote: >On Fri, October 17, 2008 17:49, Randy wrote: >> Is this really necessary for yahoo.com generated e-mail? > >olso what i ask myself > >> 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org >> 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org >> 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org > >write to [EMAIL PROTECTED] and ask them Rotsa Ruck. That is a black hole, or /dev/null address. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Time as he grows old teaches all things. -- Aeschylus
Re: rfc-ignorant spamassassin score
On Friday 17 October 2008, Michael Scheidell wrote: >> Is this really necessary for yahoo.com generated e-mail? >> >> 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org >> 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org >> 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org > >Run sa-update on recent versions of SA and it will automatically drop those >scored. > >Long time ago, in a land far away, GOOD site admins actually had working >abuse@ and postmater@ addresses. > >Long ago, ICANN used to delist domains that had broken or unreachable whois >contact information. > >So, long ago, ignorant, stupid or lazy was a good indication of spam >sources. >Today, it indicates yahoo.com. Which equates to the same thing. I did have a few addresses of known spam emitters in my procmailrc, but found I had to remove one of those in spite of it being responsible for about 200 spams a day. Seems that machine was also the outbound sender for quite a few of the mailing lists yahoo maintains. Nastygrams to yahoo of course are attracted to a black hole they feed all mail addressed to 'postmaster' and 'admin', never to be seen by another human who might have a quarter to call somebody who gives a $hit. -- Cheers, Gene "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) "Morality is one thing. Ratings are everything." - A Network 23 executive on "Max Headroom"
Re: rfc-ignorant spamassassin score
On Fri, October 17, 2008 17:49, Randy wrote: > Is this really necessary for yahoo.com generated e-mail? olso what i ask myself > 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org > 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org > 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org write to [EMAIL PROTECTED] and ask them -- Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098
Re: rfc-ignorant spamassassin score
Michael Scheidell wrote: Is this really necessary for yahoo.com generated e-mail? 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org Run sa-update on recent versions of SA and it will automatically drop those scored. Long time ago, in a land far away, GOOD site admins actually had working abuse@ and postmater@ addresses. Long ago, ICANN used to delist domains that had broken or unreachable whois contact information. So, long ago, ignorant, stupid or lazy was a good indication of spam sources. Today, it indicates yahoo.com. Thanks! And so true. Nice way to put it too. RCR
Re: rfc-ignorant spamassassin score
> Is this really necessary for yahoo.com generated e-mail? > > 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org > 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org > 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org > Run sa-update on recent versions of SA and it will automatically drop those scored. Long time ago, in a land far away, GOOD site admins actually had working abuse@ and postmater@ addresses. Long ago, ICANN used to delist domains that had broken or unreachable whois contact information. So, long ago, ignorant, stupid or lazy was a good indication of spam sources. Today, it indicates yahoo.com. -- Michael Scheidell, CTO >|SECNAP Network Security Winner 2008 Network Products Guide Hot Companies FreeBSD SpamAssassin Ports maintainer _ This email has been scanned and certified safe by SpammerTrap(r). For Information please see http://www.spammertrap.com _
rfc-ignorant spamassassin score
Is this really necessary for yahoo.com generated e-mail? 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org 1.4 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org 1.7 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org RCR
Re: Moving to folder based upon spamassassin score
for the record now tested !!
i kicked out te and the coouting is working
sorry to have you spamed :)
VERBOSE=ON
# setting the level
#trash
TLVL="-20"
#quarantine
QLVL="-4"
#maybe spam
MLVL="-2"
SL="0"
# counting stars
:0
* H ?? ()^X-Spam-Level: \/[*]+
{ SPAMLEVEL=$MATCH }
:0
* 1^1 SPAMLEVEL ?? ()\*
{ } SL = "$="
# with this you sort the mail in MBOX files
:0
* $ $SL^0
* $ $TLVL^0
/dev/null
:0:
* $ $SL^0
* $ $QLVL^0
/var/mail/quarantine
:0:
* $ $SL^0
* $ $MLVL^0
/var/mail/maybespam
#the rest let pass
Re: Moving to folder based upon spamassassin score
öh , ja
I shoudnt try to be so quick sorry forget a : and have a false $
#
u can use with procmail $VAR a treshhold
VERBOSE=ON
# setting the level
#trash
TLVL="-10"
#quarantine
QLVL="-4"
#maybe spam
MLVL="-2"
SL="0"
# counting stars
:0
* H ?? ()^X-Spam-Level: \/[*]+
{ SPAMLEVEL=$MATCH }
:0
* 1^1 SPAMLEVEL ?? ()\*
{ } SL = "$="
# with this you sort the mail in MBOX files
:0
* $ $SL^0
* $ $TLVL^0
/dev/null
:0:
* $ $SL^0
* $ $QLVL^0
/var/mail/quarantine
:0:
* $ $SL^0
* $ $MLVL^0
/var/mail/maybespam
#the rest let pass
Matthias
Re: Moving to folder based upon spamassassin score
# third try :)
u can use with procmail $VAR a treshhold
VERBOSE=ON
# setting the level
#trash
TLVL="-10"
#quarantine
QLVL="-4"
#maybe spam
MLVL="-2"
SL="0"
# counting stars
:0
* $ H ?? ()^X-Spam-Level: \/[*]+
{ SPAMLEVEL=$MATCH }
:0
* 1^1 SPAMLEVEL ?? ()\*
{ } SL = "$="
# with this you sort the mail in MBOX files
:0
* $ $SL^0
* $ $TLVL^0
/dev/null
:0
* $ $SL^0
* $ QLVL^0
/var/mail/quarantine
:0
* $ $SL^0
* $ MLVL^0
/var/mail/maybespam
#the rest let pass
Matthias
Re: Moving to folder based upon spamassassin score
UUPS
i have some syntax errors / fast copy / misssing $
John W Mickevich schrieb:
Hi all,
I have what is probably a simple question. I know I have seen
instructions on this before, but cannot locate them and was hoping
someone could point me in the right direction.
I am using spamassassin with sendmail and am using .procmailrc to
direct my incoming email to be sent to spamassassin for scoring.
What I want to do is move email tagged as spam to a specific linux
folder, but I want it to be based upon the spamassassin score – not
just the fact that spamassassin tagged it as spam.
I am sure I need a .procmailrc entry, but I don’t know what it would be.
Any assistance would be greatly appreciated.
Thanks!
John W Mickevich
Computer Management Technologies
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
Hi , to the List
u can use with procmail $VAR a treshhold
VERBOSE=ON
# setting the level
#trash
TLVL="-10"
#quarantine
QLVL="-4"
#maybe spam
MLVL="-2"
SL="0"
# counting stars
:0
* 1^1 ()^X-Spam-Level:[$WS]\/[*]
{ } SL = "$="
# with this you sort the mail in MBOX files
:0
* $ $SL^0
* $ $TLVL^0
/dev/null
:0
* $ $SL^0
* $ $QLVL^0
/var/mail/quarantine
:0
* $ $SL^0
* $ $MLVL^0
/var/mail/maybespam
#the rest let pass
Matthias
Re: Moving to folder based upon spamassassin score
John W Mickevich schrieb:
Hi all,
I have what is probably a simple question. I know I have seen
instructions on this before, but cannot locate them and was hoping
someone could point me in the right direction.
I am using spamassassin with sendmail and am using .procmailrc to
direct my incoming email to be sent to spamassassin for scoring.
What I want to do is move email tagged as spam to a specific linux
folder, but I want it to be based upon the spamassassin score – not
just the fact that spamassassin tagged it as spam.
I am sure I need a .procmailrc entry, but I don’t know what it would be.
Any assistance would be greatly appreciated.
Thanks!
John W Mickevich
Computer Management Technologies
[EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]>
Hi , to the List
u can use with procmail $VAR a treshhold
VERBOSE=ON
# setting the level
#trash
TLVL="-10"
#quarantine
QLVL="-4"
#maybe spam
MLVL="-2"
SL="0"
# counting stars
:0
* 1^1 ()^X-Spam-Level:[$WS]\/[*]
{ } SL = "$="
# with this you sort the mail in MBOX files
:0
* $ $SL^0
* $ $TLVL^0
/dev/null
:0
* $ $SL^0
* $ QLVL^0
/var/mail/quarantine
:0
* $ $SL^0
* $ MLVL^0
/var/mail/maybespam
#the rest let pass
Matthias
Moving to folder based upon spamassassin score
Hi all, I have what is probably a simple question. I know I have seen instructions on this before, but cannot locate them and was hoping someone could point me in the right direction. I am using spamassassin with sendmail and am using .procmailrc to direct my incoming email to be sent to spamassassin for scoring. What I want to do is move email tagged as spam to a specific linux folder, but I want it to be based upon the spamassassin score - not just the fact that spamassassin tagged it as spam. I am sure I need a .procmailrc entry, but I don't know what it would be. Any assistance would be greatly appreciated. Thanks! John W Mickevich Computer Management Technologies [EMAIL PROTECTED]
Re: Spamassassin Score
On 6-nov-2006, at 21:30, Rob Anderson wrote: Leander Koornneef <[EMAIL PROTECTED]> 11/06/06 02:26PM >>> As far as I know, there is no configuration option for this. > Try this from the docs under "Template Tags": _SCORE(PAD)_ message score, if PAD is included and is either spaces or zeroes, then pad scores with that many spaces or zeroes (default, none) ie: _SCORE(0)_ makes 2.4 become 02.4, _SCORE(00)_ is 002.4. 12.3 would be 12.3 and 012.3 respectively. I stand corrected :-) Leander
Re: Spamassassin Score
>>> Leander Koornneef <[EMAIL PROTECTED]> 11/06/06 02:26PM >>>
On 6-nov-2006, at 19:59, Claus Westerkamp wrote:
> Hello list,
>
> Id like to modify the Score output of spamassassin. I want 3digits
> display permanently (e.g. ***(Score002.3)*** or ***(Score102.3)*** )
>
> Is this possible? I want it to be able to sort the spam-messages by
> Score.
Of course this is possible, but you will probably have to
hack some code to get the result you want. As far as I
know, there is no configuration option for this.
If you are using amavis for instance, you could change
the part where $full_spam_status is put together from:
sprintf("%3.1f",$spam_level)
to something like:
sprintf("%05.1f",$spam_level)
In spamd this would be from:
my $msg_score = sprintf( "%.1f", $status->get_score );
to:
my $msg_score = sprintf( "%05.1f", $status->get_score );
Also beware that this will be overwritten when you update/upgrade
your software...
Leander
>
Try this from the docs under "Template Tags":
_SCORE(PAD)_ message score, if PAD is included and is either spaces or
zeroes, then pad scores with that many spaces or zeroes
(default, none) ie: _SCORE(0)_ makes 2.4 become 02.4,
_SCORE(00)_ is 002.4. 12.3 would be 12.3 and 012.3
respectively.
Rob
Re: Spamassassin Score
On 6-nov-2006, at 19:59, Claus Westerkamp wrote:
Hello list,
Id like to modify the Score output of spamassassin. I want 3digits
display permanently (e.g. ***(Score002.3)*** or ***(Score102.3)*** )
Is this possible? I want it to be able to sort the spam-messages by
Score.
Of course this is possible, but you will probably have to
hack some code to get the result you want. As far as I
know, there is no configuration option for this.
If you are using amavis for instance, you could change
the part where $full_spam_status is put together from:
sprintf("%3.1f",$spam_level)
to something like:
sprintf("%05.1f",$spam_level)
In spamd this would be from:
my $msg_score = sprintf( "%.1f", $status->get_score );
to:
my $msg_score = sprintf( "%05.1f", $status->get_score );
Also beware that this will be overwritten when you update/upgrade
your software...
Leander
Spamassassin Score
Hello list, Id like to modify the Score output of spamassassin. I want 3digits display permanently (e.g. ***(Score002.3)*** or ***(Score102.3)*** ) Is this possible? I want it to be able to sort the spam-messages by Score. thanx claus
Re: Using 1st server Spamassassin score as starting value for 2nd server.
> > Again thanks so much Loren! Quite welcome. It was a fun hack to think through. There is one fix required in that file - change the word 'hits' to 'score' in the rules. I wrote those based off a 2.64 example, and the word changed in 3.0. Loren
Re: Using 1st server Spamassassin score as starting value for 2nd server.
Loren Wilton wrote: Any hints are graciously accepted and greatly appreciated. You can't, so far as I know, do exactly what you want. However, you may be able to come close. Oh heck. I started the ruleset above, I just finished the thing. File attached. Note these rules are UNTESTED, and may not work as expected. They may not even lint for that matter. But they might be useful if they do work. Gees I wanted some ideas but didn't expect anyone to do it for me! :) As I said I would graciously accept and greatly appreciate some hints. Thanks so much for getting me going on this ... it was way beyond my expectations. I will try these out as time allows and if I find problems I will repost them. From the information given in your post I see I was not thinking in the spamassassin way. I am new to the rule writing part so I learned something. Your idea will do pretty much exactly what I want just not in the arithmetic way I was thinking. Again thanks so much Loren! -- Paul ([EMAIL PROTECTED])
Re: Using 1st server Spamassassin score as starting value for 2nd server.
> It wasn't clear from the documentation or google searches that I could
> do this. It seemed that I could create a header and then give a score
> based upon its presence. But it wasn't obvious to me that I could
> actually read the headers value and set the initial spam score from the
> value. Any hints are graciously accepted and greatly appreciated.
You can't, so far as I know, do exactly what you want. However, you may be
able to come close.
SA uses text pattern matching for rules, rather than any concept of
arithmetic numbers. You can make multiple rules with various scores and use
them to look at the score lines in the header, at least if you are on 3.0 or
later. (In 2.6x these lines will be stripped before you can look at them).
I think you will have to use 'full' rules to look at this data (or write a
plugin, which might be the better idea) since it will probably be removed
from 'header' rule data before you can look at it.
I would suggest a simple collection of rules that look at the number of
stars in the report line, and score each one at 1 point. This will give you
the score rounded to the nearest point, which might be "good enough". You
could actually make a whole series of rules (it would take 40 rules) to look
at the actual score value and provide a decimal result. For instance,
grabbing part of the summary line from your message, I see
X-Spam-Status: No, hits=-94.4
(This is on 2.64, check the format for 3.0 in case it changed.)
Now I could write a bunch of rules like
fullSA_SCORE_100/^X-Spam-Status:.{0,20}hits=1\d\d/s
scoreSA_SCORE_100100
fullSA_SCORE_10/^X-Spam-Status:.{0,20}hits=\d*1\d[^\d]/s
scoreSA_SCORE_1010
fullSA_SCORE_20/^X-Spam-Status:.{0,20}hits=\d*2\d[^\d]/s
scoreSA_SCORE_2020
fullSA_SCORE_30/^X-Spam-Status:.{0,20}hits=\d*3\d[^\d]/s
scoreSA_SCORE_3030
fullSA_SCORE_40/^X-Spam-Status:.{0,20}hits=\d*4\d[^\d]/s
scoreSA_SCORE_4040
fullSA_SCORE_1/^X-Spam-Status:.{0,20}hits=\d*1[^\d]/s
scoreSA_SCORE_11
fullSA_SCORE_2/^X-Spam-Status:.{0,20}hits=\d*2[^\d]/s
scoreSA_SCORE_22
fullSA_SCORE_3/^X-Spam-Status:.{0,20}hits=\d*3[^\d]/s
scoreSA_SCORE_33
fullSA_SCORE_4/^X-Spam-Status:.{0,20}hits=\d*4[^\d]/s
scoreSA_SCORE_44
fullSA_SCORE_point1/^X-Spam-Status:.{0,20}hits=\d*\.1/s
scoreSA_SCORE_point10.1
fullSA_SCORE_point2/^X-Spam-Status:.{0,20}hits=\d*\.2/s
scoreSA_SCORE_point20.2
fullSA_SCORE_point3/^X-Spam-Status:.{0,20}hits=\d*\.3/s
scoreSA_SCORE_point30.3
fullSA_SCORE_point4/^X-Spam-Status:.{0,20}hits=\d*\.4/s
scoreSA_SCORE_point40.4
Obviously you need 0-9 in each case.
That will handle positive scores and ignore negative scores. (If you can't
have 3 digit scores, you can simplify the regex in the first casea above to
something like "=1\d/s" on the end). If you want to deal with negative
scores also, you will need a bunch more rules to deal with them.
Oh heck. I started the ruleset above, I just finished the thing. File
attached.
Note these rules are UNTESTED, and may not work as expected. They may not
even lint for that matter. But they might be useful if they do work.
Loren
scorerules.cf
Description: Binary data
Using 1st server Spamassassin score as starting value for 2nd server.
I run the Email servers for a small, rural mountain WISP and have a situation where all Email 1st comes into a "scrubber" server (RaQ 550) and once it passes an initial set of virus/spam tests is sent on to a 2nd server (alsa a RaQ 550) where the actual user accounts reside. On the first server Spam/Virii are stopped in 3 steps: 1.) Custom blocklists 2.) Greylister 3.) MailScanner/Spamassassin 3.0.3 - Network checks/General rules. These stop spam with as little work as possible and as soon as possible. Anything flagged with a high score at this point is quarantined just in case, but not sent to the user. Messages with scores lower than the high score threshold are sent on to the 2nd server. On the 2nd server only MailScanner (virus checks bypassed since they were done already)/Spamassassin 3.02.(Spamd/Spamc) are run. Since Spamc runs as the Email recipient I can use each user's custom settings and bayes databases to do a final check on spam so that they may do what they want with such messages. These tests tend to be more expensive than those done on the 1st server and vary from user to user, but nonetheless I don't want to repeat the tests from the 1st server. Can I set up a header with the spam score from the 1st server and then set up the 2nd server's spamassassin to use that header as the initial score for any subsequent tests? My idea is to turn off as many body checks on the 1st server and to wait until the last possible moment without duplicating 1st server tests before doing the bayes stuff on the 2nd server. The final Spam score would be the accumulated sum from both servers. It wasn't clear from the documentation or google searches that I could do this. It seemed that I could create a header and then give a score based upon its presence. But it wasn't obvious to me that I could actually read the headers value and set the initial spam score from the value. Any hints are graciously accepted and greatly appreciated. -- Paul ([EMAIL PROTECTED])
Re: SpamAssassin score factors?
Lisheng Sun wrote: Could anyone here tell me how many different factors that will involve with SA? Say, IP is belong to blacklist, URL is belong to blacklist, etc. What else? Not include user-defined one. Thanks. You should probably visit http://spamassassin.apache.org/tests_3_0_x.html
SpamAssassin score factors?
Could anyone here tell me how many different factors that will involve with SA? Say, IP is belong to blacklist, URL is belong to blacklist, etc. What else? Not include user-defined one. Thanks.
