Hi all, I've done some searching on this, but I don't find anything that I can get working. I have fetchmail --> sendmail --> evolution. I want to stick spamassassin inbetween fetcmail and sendmail (or where ever it should go. Most of what I've found works with spamassassin and postfix, and the one document that looked thorough enough was in Russian. I've run spamd and spamc in every possible order/combination, but, going by my e-mail headers, it doesn't seem to do anything. I've also seen many references to procmail, and changes to be made to .procmailrc. But there's no such file in my ~ dir and I don't know what else should be in it or how to activate procmail So how do I do this? Thanks?
On Mon, 2003-07-28 at 23:22, H du Plooy wrote:
Hi all,
I've done some searching on this, but I don't find anything that I can get working. I have
fetchmail --> sendmail --> evolution.
If you have the above working, then you just need a .procmailrc file in you home directory that contains the following: --<snip>-- :0fw | spamc :0: * ^X-Spam-Status: Yes .spam_mail/caughtspam --<snip>-- NOTE: I drop my spam in a mbox file in /home/andre/.spam_mail/caughtspam Then I have set up a second account in Evolution that reads that to make sure I pick up mail that has been marked as spam by mistake. You need to have spamd running, as you use spamc here. And you need a .forward file that contains this: --<snip>-- "|IFS=' ' && p=/usr/bin/procmail && test -f $p && exec $p -Yf- || exit 75" --<snip>-- NOTE: the stuff in .forward is all on one line. HTH -- Andre Truter Software Engineer Registered Linux user #185282 ICQ #40935899 AIM: trusoftzaf http://www.trusoft.za.net ~ A dinosaur is a salamander designed to Mil Spec ~
On Tue, 2003-07-29 at 00:04, Andre Truter wrote:
If you have the above working, then you just need a .procmailrc file in you home directory that contains the following:
--<snip>-- :0fw | spamc
:0: * ^X-Spam-Status: Yes .spam_mail/caughtspam --<snip>--
[snip]
And you need a .forward file that contains this:
Thanks Andre! This works. I made the .spam_mail/caughtspam dirs but nothing ends up in there - everything still goes to my inbox. This is fine, however, I just set up my evolution filters to pick them out and dump them in a spam dir. Currently scores of 5 or higher are accepted as spam, while most of the stuff I tested were quite lowerwer (as low as 2) and were definitely spam. What do you oaks use for a limit? Where do I set this? Thanks Hans
On Tue, 2003-07-29 at 01:39, H du Plooy wrote: --<snip>--
:0: * ^X-Spam-Status: Yes .spam_mail/caughtspam --<snip>--
--<snip>-- Thanks Andre! This works. I made the .spam_mail/caughtspam dirs but nothing ends up in there - everything still goes to my inbox. This is fine, however, I just set up my evolution filters to pick them out and dump them in a spam dir.
If you want it to be dropped in the caughtspam dir, just check the recipy in .procmailrc for correct syntax. Spaces, etc or the line: * ^X-Spam-Status: Yes Look at the raw format of a mail that has been marked as spam. It should contain a line: X-Spam-Status: Yes Make sure this line is exactly as it is in .procmailrc (preceded by '* ^') If you want to use Evolution to do the filtering, you can remove the second recipy in .procmailrc.
Currently scores of 5 or higher are accepted as spam, while most of the stuff I tested were quite lowerwer (as low as 2) and were definitely spam. What do you oaks use for a limit?
Where do I set this?
I'm not sure where to set this, maybe have a look at the man pages of spamassassin and spamd. I 'teach' spamassassin about spam that it missed. I use sa-learn. It seems to work good. See the man page for sa-learn. Very easy to use: Just drop the missed spam in a mbox and run sa-learn on it. E.g.: sa-learn --spam --mbox /home/andre/spam_mail/missedspam -- Andre Truter Software Engineer Registered Linux user #185282 ICQ #40935899 AIM: trusoftzaf http://www.trusoft.za.net <-------------------------------------------------> < The box said: Requires Windows 95 or better... > < So I installed Linux > <-------------------------------------------------> Disclaimer and Confidentiality Warning This message is intended for the addressee only. If you are not the intended recipient of this message, you are notified that any distribution, use of or copying of this communication is strictly prohibited. If you have received the communication in error, please notify the sender immediately. The views and opinions expressed in this message are those of the individual sender of this message and do not necessarily represent the views and opinions of ATIO. Consequently, ATIO does not accept responsibility for such views and opinions and this message should not be read as representing the views and opinions of ATIO without subsequent written confirmation. Each page attached hereto must also be read in conjunction with this disclaimer.
On Tue, 2003-07-29 at 10:44, Andre Truter wrote:
I'm not sure where to set this, maybe have a look at the man pages of spamassassin and spamd.
I 'teach' spamassassin about spam that it missed. I use sa-learn. It seems to work good. See the man page for sa-learn. Very easy to use: Just drop the missed spam in a mbox and run sa-learn on it. E.g.: sa-learn --spam --mbox /home/andre/spam_mail/missedspam
Thanks, I think this just about covers what I need to know Hans
On Tue, 2003-07-29 at 01:39, H du Plooy wrote:
Currently scores of 5 or higher are accepted as spam, while most of the stuff I tested were quite lowerwer (as low as 2) and were definitely spam. What do you oaks use for a limit?
Where do I set this?
Thanks for all who helped out on this folks. Ignore the above question. I figured out why 5 didn't work. I tested it by forwarding a bunch of the spam I had received to myself, which seems to have decreased the scores quite a bit, and only the mails with most tell tale signs were caught. All the spam I have received since have been caught out faultlessly. This is really awesome! Thank you! Hans
I have a question.... Does a higher score reduce spam or label it as not spam? My web host uses spamassassin. I've been getting a lot of spam lately, so I changed the value from 3 to 2.5 in an attempt to reduce it. It didn't seem to help. My question is, am I allowing more spam thru???? Thanks, Tom On Thu, 2003-07-31 at 13:48, H du Plooy wrote:
On Tue, 2003-07-29 at 01:39, H du Plooy wrote:
Currently scores of 5 or higher are accepted as spam, while most of the stuff I tested were quite lowerwer (as low as 2) and were definitely spam. What do you oaks use for a limit?
Where do I set this?
Thanks for all who helped out on this folks. Ignore the above question. I figured out why 5 didn't work. I tested it by forwarding a bunch of the spam I had received to myself, which seems to have decreased the scores quite a bit, and only the mails with most tell tale signs were caught.
All the spam I have received since have been caught out faultlessly. This is really awesome!
Thank you! Hans
-- Tom Nielsen Neuro Logic Systems 805.389.5435 x18 www.neuro-logic.com
Tom Nielsen wrote, On 08/01/2003 05:17 AM:
I have a question....
Does a higher score reduce spam or label it as not spam?
The score is the spam threshhold, meaning that is the minimum score to be marked spam.
My web host uses spamassassin. I've been getting a lot of spam lately, so I changed the value from 3 to 2.5 in an attempt to reduce it. It didn't seem to help. My question is, am I allowing more spam thru????
No, more mail would be marked as the lower score would be easier to reach on an email. -- Joe Morris New Tribes Mission Email Address: Joe_Morris@ntm.org Web Address: http://www.mydestiny.net/~joe_morris Registered Linux user 231871 God said, I AM that I AM. I say, by the grace of God, I am what I am.
The 03.07.31 at 14:17, Tom Nielsen wrote:
Does a higher score reduce spam or label it as not spam?
It's easy to see. This is a spam report headers from one email:
X-Spam-Flag: YES X-Spam-Status: Yes, hits=14.6 required=5.0 tests=DEAR_SOMETHING,MIME_BOUND_MANY_HEX,NIGERIAN_BODY,RISK_FREE, SUBJ_ALL_CAPS,URGENT_BIZ,US_DOLLARS,US_DOLLARS_3 version=2.50 X-Spam-Level: **************
The 'hits' level is 14.6, quite high, undoubtedly spam. The 'X-Spam-Flag' is set to trigger at '5', so it is yes. If I lowered the level, from, say, 5 to 4, more mails would be marked as spam. -- Cheers, Carlos Robinson
On Friday 01 August 2003 8:59 am, Carlos E. R. wrote:
The 03.07.31 at 14:17, Tom Nielsen wrote:
Does a higher score reduce spam or label it as not spam?
It's easy to see. This is a spam report headers from one email:
X-Spam-Flag: YES X-Spam-Status: Yes, hits=14.6 required=5.0
tests=DEAR_SOMETHING,MIME_BOUND_MANY_HEX,NIGERIAN_BODY,RISK_FREE, SUBJ_ALL_CAPS,URGENT_BIZ,US_DOLLARS,US_DOLLARS_3 version=2.50 X-Spam-Level: **************
The 'hits' level is 14.6, quite high, undoubtedly spam. The 'X-Spam-Flag' is set to trigger at '5', so it is yes.
If I lowered the level, from, say, 5 to 4, more mails would be marked as spam.
I do the following: 1) Set the hit level to 4. 2) Count the number of emails that get /dev/null'd (just curious) 3) Do a test in procmailrc to see if the hit level is 10 or higher. If so: /dev/null/ 4) Put those in the 4 to 9 range into a special folder where they can be looked at. (I might get about 8 of these a day, and about 25% might be false positives including some from the list.) 5) Below 4, they get normal processing.
-- Cheers, Carlos Robinson
-- +----------------------------------------------------------------------------+ + Bruce S. Marshall bmarsh@bmarsh.com Bellaire, MI 08/01/03 17:04 + +----------------------------------------------------------------------------+ "Inform all the troops that communications have completely broken down." - Ashleigh Brilliant
The 03.07.28 at 23:22, H du Plooy wrote:
I've also seen many references to procmail, and changes to be made to .procmailrc. But there's no such file in my ~ dir and I don't know what else should be in it or how to activate procmail
No, you ceate it. It doesn't exist by default. Assuming you have the default suse configuration of sendmail, procmail will work as soon as you create it - obviously, the package must exist on your system. -- Cheers, Carlos Robinson
participants (7)
-
Andre Truter -
Bruce Marshall -
Carlos E. R. -
H du Plooy -
H du Plooy -
Joe Morris (NTM) -
Tom Nielsen