-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Philippe Vogel schrieb:

Hi!

First of all spamassassin has to learn what you consider as spam and what you consider as ham (no spam). If you don't teach both you may get false positives.

I use cyrus + postfix + cyrus + amavisd-new + serverbased imap-filter-rules for my users - but this setup may be a littlebit too complex ;). In short: One rules sorts spam into spam-folder of the user's imap-folder (it will be deleted manually in case the spam-filter recognises too much as spam). I made a spamassassin imap-folder for each user and a cron-script learnes the bayes for each user every day from this folder.

Here is my script for postfix/cyrus/spamassassin:

[Begin Script]

#!/bin/bash # # Spamassassin Cron-Script # # Target: Learn spam and add to spam-db for all users with their own spam. # # learn spam and clear spamassassin-folder ... # /usr/bin/sa-learn --spam /var/spool/imap/user/*/Spamassassin/*. su - cyrus -c '/usr/lib/cyrus/bin/ipurge -i -b 1 user.*.Spamassassin' # # find users ... # LOCUSERS=`find /home -group users -maxdepth 1` for LOCALUSERS in $LOCUSERS; do LUSERS=$LUSERS" "${LOCALUSERS:6} done # # Copy global config for all users # for namen in $LUSERS; do test -d "/home/$namen/.spamassassin" || { mkdir /home/$namen/.spamassassin; } cp -R /root/.spamassassin/bayes* /home/$namen/.spamassassin chown -R $namen:users /home/$namen/.spamassassin done #echo 'Starte Postfix neu:' #/etc/init.d/postfix restart echo 'User-Spamdb updated!'

[End Script]

If you don't use imap you can use a pop3-account and move your spam as admin to another users mailbox (maybe user = spam) and execute the following (you have to change the folder at the end to your settings!!!):

#learn spam:

/usr/bin/sa-learn --spam /var/spool/mail/spam

#learn ham:

/usr/bin/sa-learn --ham /var/spool/mail/mailbox-with-ham-and-no-spam

This mailbox should not include ham otherwise you get false positives!

If you want to create a config-file with most options for spamassassin you may use this form:

http://www.yrex.com/spam/spamconfig.php

Otherwise you should examine the manpages and search a lot with google.

Spamfiltering in general based on postifx:

Make acl's to filter mails (postfix will reject this mails):

- use amavisd-new to scan for viruses (f-prot is free for use for private users under linux) - disable notification of virus in amavis and disable any other notifications in spamassassin (postfix should ony rejet this and don't give any answers) - reject executable extensions (I do this via amavid-new) -> good bye virus - use a rbl-server for blocking announced spam-providing servers - non-existing url's (dns-check) - Implement spamassassin or any other spam-filter.

In general: Don't answer to any spam of any kind.

With this policy I get about max. 3 spam-mails per day (before a lot more). After learning ham I don't get much lase positives (now exactly 0%).

Bet way to learn ham is to learn all your mails from your mailbox containing no spam!

Reguards

Philippe

I forgot to mention that this db can only work for your server, so don't ask for a spam-db, this is always unique for one server. If your server learned about a month you will notice a lower spam level (if you get a lot 'o' spam). Your server must permanently learnspam and ham! A too low level will filter too much. Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQnzNK0Ng1DRVIGjBAQLeWQb/RUtpBdtoSY3aOsGgX6gEa6ttaYFxx2qS jhYuQjEsG4h9lv3BOcxodHKgs/Z3f+JyfYy7Zxqlf5lHZrxyoHiqEJkbq3mn9byV lP8ymRRWbsWXepG+/2zDCdyYq+5zX4wDusYd+9qN39mxcSlNquXKNnsbR2k/YRrj PEe9UVslIxv1jFBsEE0B4HbdAxIpXeVbvNgV3wXCvYuNmCPXVOS1BlZZA9KUZz1T hdSnJJcM01uvWK0p1Cy6BiTI8H9ODXr6jPI38yVO3TaLonP0Q6b6q87k6IV0qfCH 9oZSEJj0Ico= =DpyF -----END PGP SIGNATURE-----

Carlos, El Dom 08 May 2005 07:05, Carlos E. R. escribió:

Ummm! I still have to figure out why scores of bayes_99 do not trigger an email being spam. Either I modify my rules in procmail, or I modify the scoring of Bayesian tests.

You see, even without the ALL_TRUSTED thing, it still is not flagged as spam:

X-Spam-Status: No, score=4.9 required=5.0 tests=AWL,BAYES_99,HTML_20_30, HTML_IMAGE_ONLY_24,HTML_MESSAGE autolearn=no version=3.0.2

A bayes_99 test result contributes in my standard setup of SA 3.0.3 exactly 4.1 points to the final score; see this example report: X-Spam-Report: * 0.5 TO_MALFORMED To: has a malformed address * -2.9 ALL_TRUSTED Did not pass through any untrusted hosts * 2.5 DATE_IN_FUTURE_48_96 Date: is 48 to 96 hours after Received: date * 2.5 DOMAIN_RATIO BODY: Message body mentions many internet domains * 0.5 HTML_COMMENT_SAVED_URL BODY: HTML message is a saved web page * 1.1 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_90_100 BODY: Message is 90% to 100% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 2.7 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words * 4.1 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.2 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME headers * 1.8 PRIORITY_NO_NAME Message has priority, but no X-Mailer/User-Agent Your setup requires a final score >= 5.0 to trigger the message being marked as Spam, but the final score on your message is only 4.9. The Bayes testing score alone will never trigger a message to be marked as Spam, unless you increment its contributing score or lower the threshold for a message to be marked as Spam. In your current setup, this message, even with a positive BAYES_99 test result, isn't 'spammy' enough to reach 5.0 points. Saludos, -- Andreas Philipp Noema Ltda. Bogotá, D.C. - Colombia http://www.noemasol.com

On Sunday 08 May 2005 10:37 am, Carlos E. R. wrote:

The Sunday 2005-05-08 at 10:37 -0500, Andreas Philipp wrote:

...

...

X-Spam-Status: No, score=4.9 required=5.0 tests=AWL,BAYES_99,HTML_20_30, HTML_IMAGE_ONLY_24,HTML_MESSAGE autolearn=no version=3.0.2

A bayes_99 test result contributes in my standard setup of SA 3.0.3 exactly 4.1 points to the final score; see this example report:

True.

...

X-Spam-Report: * 0.5 TO_MALFORMED To: has a malformed address * -2.9 ALL_TRUSTED Did not pass through any untrusted hosts * 2.5 DATE_IN_FUTURE_48_96 Date: is 48 to 96 hours after Received: date * 2.5 DOMAIN_RATIO BODY: Message body mentions many internet domains * 0.5 HTML_COMMENT_SAVED_URL BODY: HTML message is a saved web page * 1.1 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area * 0.0 HTML_90_100 BODY: Message is 90% to 100% HTML * 0.0 HTML_MESSAGE BODY: HTML included in message * 2.7 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words * 4.1 BAYES_99 BODY: Bayesian spam probability is 99 to 100% * [score: 1.0000] * 1.2 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME headers * 1.8 PRIORITY_NO_NAME Message has priority, but no X-Mailer/User-Agent

Your setup requires a final score >= 5.0 to trigger the message being marked as Spam, but the final score on your message is only 4.9. The Bayes testing score alone will never trigger a message to be marked as Spam, unless you increment its contributing score or lower the threshold for a message to be marked as Spam. In your current setup, this message, even with a positive BAYES_99 test result, isn't 'spammy' enough to reach 5.0 points.

I know... it is unfortunate. Either SA needs updating for new kind of spams with new rules, or I change the scoring. I'm inclined to do that, but I'm unsure of what score to give it. Probably just increase all of the bayes scores proportionately till BAYES_99 is 4.9 or 5.

Seems like a problem of addition to me. It should have scored around 10 by just adding up all the scores, even with the negative one. -- _____________________________________ John Andersen