Hello David, i dont want to give wrong info to you :-( I use SpamAssassin 2.55 and my rbl_check's are stored in "20_head_tests.cf" gate:/usr/share/spamassassin # grep check_rbl * 20_head_tests.cf:#header RCVD_IN_OSIRUSOFT_COM rbleval:check_rbl('osirusoft', 'relays.osirusoft.com.') 20_head_tests.cf:#header X_OSIRU_OPEN_RELAY rbleval:check_rbl_results_for('osirusoft', '127.0.0.2') 20_head_tests.cf:#header X_OSIRU_DUL rbleval:check_rbl_results_for('osirusoft', '127.0.0.3') 20_head_tests.cf:#header X_OSIRU_SPAM_SRC rbleval:check_rbl_results_for('osirusoft', '127.0.0.4') 20_head_tests.cf:#header X_OSIRU_SPAMWARE_SITE rbleval:check_rbl_results_for('osirusoft', '127.0.0.6') 20_head_tests.cf:#header X_OSIRU_DUL_FH rbleval:check_rbl('osirusoft-dul-firsthop', 'relays.osirusoft.com.') 20_head_tests.cf:# the new first arg for check_rbl() indicates what type of check it is; 20_head_tests.cf:header RCVD_IN_RELAYS_ORDB_ORG rbleval:check_rbl('relay', 'relays.ordb.org.') 20_head_tests.cf:header RCVD_IN_SBL rbleval:check_rbl('relay', 'sbl.spamhaus.org.') 20_head_tests.cf:#header RCVD_IN_ORBS rbleval:check_rbl('relay', 'orbs.dorkslayers.com.') 20_head_tests.cf:header RCVD_IN_OPM rbleval:check_rbl('relay', 'opm.blitzed.org.') 20_head_tests.cf:#header RCVD_IN_DSBL rbleval:check_rbl('relay', 'list.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_MULTIHOP_DSBL rbleval:check_rbl('multihop', 'multihop.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_UNCONFIRMED_DSBL rbleval:check_rbl('relay', 'unconfirmed.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_RFCI rbleval:check_rbl('rfci', 'ipwhois.rfc-ignorant.org.') 20_head_tests.cf:header HABEAS_HIL rbleval:check_rbl('hil', 'hil.habeas.com.') 20_head_tests.cf:header RCVD_IN_BONDEDSENDER rbleval:check_rbl('relay', 'query.bondedsender.org.') 20_head_tests.cf:#header RCVD_IN_BL_SPAMCOP_NET rbleval:check_rbl('spamcop', 'bl.spamcop.net.') 20_head_tests.cf:#header RCVD_IN_RBL rbleval:check_rbl('rbl', 'blackholes.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_RSS rbleval:check_rbl('relay', 'relays.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL rbleval:check_rbl('dialup', 'dialups.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL_FH rbleval:check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.') 20_head_tests.cf:header RCVD_IN_NJABL rbleval:check_rbl('njabl', 'dnsbl.njabl.org.') 20_head_tests.cf:header X_NJABL_OPEN_PROXY rbleval:check_rbl_results_for('njabl', '127.0.0.2') 20_head_tests.cf:header X_NJABL_DIALUP rbleval:check_rbl_results_for('njabl', '127.0.0.3') CU Robert -----Ursprüngliche Nachricht----- Von: David Huecking [mailto:d.huecking@gmx.net] Gesendet: Sonntag, 28. März 2004 01:04 An: suse-security@suse.com Betreff: Re: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd Hi Robert, first thanks for your hint, but I think that SpamAssassin when run from amavisd-new doesn't get its configuration out of the local.cf file, but from the $sa_* entries in the amavisd.conf. There I found an entry: $sa_local_tests_only = 1; No I set this to 0, so non-local test will be performed(?) and I will see what will happen with realtime blacklisting which I think are non-local tests. BTW I found the check_rbl string in 20_dnsbl_tests.cf and not in 20_head_tests.cf. 8-) Anyway I'm looking for a possibility of Bayes filtering if possible with white- and black-listing per user with my setup. Maybe I will try to integrate dspam (Homepage: http://www.nuclearelephant.com/projects/dspam/ ;German article: http://www.pro-linux.de/news/2004/6620.html) into postfix. But as I'm no postfix configuration hero I will need some time (for reading the Postfix book I ordered...). ;-> On Samstag, 27. März 2004 16:17, Rasp, Robert wrote:

i use spamassassin with qmail and i dont use a per-user-config. The first few weeks it worked very good but then the spamlevel begun to increase. Now i enabled RBL-Check. By default RBL is disabled in local.cf. This works very good but you have to look for servers that are offline or very slow. I simple tested all the servers in "/usr/share/spamassassin/20_head_tests.cf" (grep "check_rbl" 20_head_tests.cf). You can use nslookup for that. I disabled every slow server with '#'.....

-- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here