[opensuse] Kmail & Spamassassin
I've recently installed the Spamassassin filter for Kmail. It sure removes some spam, but not nearly enough. Typycally it will remove approximately 75 out of 175 spam messages, leaving 100 left for me to sift through. I've let it learn what is spam for a week or so now, with absolutely no impact on the ratio. Obviously, I wonder if I register spam in vain, did I forget something, do I have to few messages (don't know how to see the numbers, but I guess I have 1-2.000 spam messages registered), or is it not that efficient to have identified spam as I thought? -- Med venlig hilsen Kaare Rasmussen, Jasonic Jasonic Telefon: +45 3816 2582 Nordre Fasanvej 12 2000 Frederiksberg Email: kaare@jasonic.dk -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 31 March 2008 18:30, Kaare Rasmussen wrote:
Not a good average..
How high is your required_score in spamassassin? Mine is set at 3.5, and it gets most everything. Mike -- Powered by SuSE 10.0 Kernel 2.6.13 X86_64 KDE 3.4 Kmail 1.8 6:40pm up 228 days 22:12, 5 users, load average: 2.43, 2.28, 2.20 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Hi
How high is your required_score in spamassassin? Mine is set at 3.5, and it gets most everything.
Yeah, OK. Maybe lowering the limit is the way to go. Thanks. -- Med venlig hilsen Kaare Rasmussen, Jasonic Jasonic Telefon: +45 3816 2582 Nordre Fasanvej 12 2000 Frederiksberg Email: kaare@jasonic.dk -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 12:23 PM, Kaare Rasmussen <kaare@jasonic.dk> wrote:
Rather than reducing your required_score, consider increasing the scoring of certain tests. For instance , Razor is extremely reliable, because it is driven by user reports. If Razor says its spam it its. I score Razor very high: score RAZOR2_CF_RANGE_E8_51_100 9.9 score RAZOR2_CF_RANGE_51_100 9.9 Next is URIBL_BLACK, another well checked list of massive spammers: score URIBL_BLACK 9.999 These two take a LOT of spam directly over the recommended required score. That being said, most people do reduce their Required_score but only after they have trained bayes as recommended by the spamassassin docs. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 9:30 AM, Kaare Rasmussen <kaare@jasonic.dk> wrote:
Let it learn? Or teach it? The keys to SA is get razor working. All the network tests are useful, but if razor says its spam it is, period. Then make sure you understand how bayes databases have to be set up. Since SA does not block spam, merely tags it, you have to add kmail filters to move the probably spam to a folder that you inspect occasionally. Set SA to record tests that it hit upon, and not to mess with the subject. Then look at stuff it says is not spam (but which really is) and see which rules are fireing. If bayes_99 is not hitting then you have your bayes set up wrong, or its still not trained properly. You have to explicitly tell it which is spam and which is ham for a while. The easiest way to do this is to create a folder called MissedSpam and one called FalseSpam (or some such) and move/copy miss-categorized messages into those folders. Then use sa-learn to pass those mailboxes to the learning process to train bayes, and (if you register) report them to Razor. Without this, SA won't be anywhere near as effective as it can be. I get less than 1 spam per day using SA, and never the same spam twice. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Kaare Rasmussen wrote:
spamassassin can do a good job as part of a multi layered spam defense. If you're only running on a pop3 client then most of the measures will be beyond your control. Greylisting and sanity checks at the smtp gateway are the most important supporting factor. Also important is the use of network tests: razor, RBLs, Finally, spamassassin itself should be kept up to date, and supplemented with the basic rules pack from rules emporium. If at all possible, spamassasin and friends should be server side. Joe -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 10:03 AM, Joe Sloan <joe@tmsusa.com> wrote:
Spamassassin can do an EXCELLENT job as the ONLY layer in a spam defense EVEN on a pop-3 client such as Kmail. Sanity check and grey listing at an smtp gateway (beyond the control of the pop-3 user) are largely redundant, as virtually none of this traffic passes a well tuned Spamassassin setup. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
John Andersen wrote:
On Mon, Mar 31, 2008 at 10:03 AM, Joe Sloan <joe@tmsusa.com> wrote:
It can, if the users mail account is not being targeted. But that assumption does not hold true everywhere.
I'm responsible for a mail system which attempts to protect 15,000 users from spam, and you'd be surprised how devious the spammers have gotten lately. They're not all stupid, and they do have resources behind them. pm me if you want to hear some horror stories. Joe -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 10:28 AM, Joe Sloan <joe@tmsusa.com> wrote:
Interesting, but not the topic at hand. Your original message more or less poo-pooed spamassassin as a end user defense, instead suggesting all sorts of options that are totally unavailable to a end (pop-3) user. A well set up and trained SA is the single most effective anti-spam tool available to a pop-3 user. Especially with network tests turned on and weighted appropriately. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
John Andersen wrote:
On Mon, Mar 31, 2008 at 10:28 AM, Joe Sloan <joe@tmsusa.com> wrote:
Perhaps you should go back and re-read what I wrote. I provided some tips for making sa more effective. (custom rulesets from the emporium, keeping sa up to date) I also stated that spamassassin is most effective as part of a multi-layered defense, at the MTA. Joe -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 31 March 2008 01:20:23 pm John Andersen wrote:
Also. when you run across an occasional spam, doesn't "clicking" on the little round icon with the curved arrow that is in the Kmail toolbar also train spamassassin by inputting into the bayes filter? If so, it should not require anymore bayesian training. Corrrect? or not? Bob S -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 8:37 PM, Bob S <911@sanctum.com> wrote:
I believe you are correct, but only if you first click on the anti-spam wizard on the tools menu... -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 31 March 2008 18:30, Kaare Rasmussen wrote:
Not a good average..
How high is your required_score in spamassassin? Mine is set at 3.5, and it gets most everything. Mike -- Powered by SuSE 10.0 Kernel 2.6.13 X86_64 KDE 3.4 Kmail 1.8 6:40pm up 228 days 22:12, 5 users, load average: 2.43, 2.28, 2.20 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Hi
How high is your required_score in spamassassin? Mine is set at 3.5, and it gets most everything.
Yeah, OK. Maybe lowering the limit is the way to go. Thanks. -- Med venlig hilsen Kaare Rasmussen, Jasonic Jasonic Telefon: +45 3816 2582 Nordre Fasanvej 12 2000 Frederiksberg Email: kaare@jasonic.dk -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 12:23 PM, Kaare Rasmussen <kaare@jasonic.dk> wrote:
Rather than reducing your required_score, consider increasing the scoring of certain tests. For instance , Razor is extremely reliable, because it is driven by user reports. If Razor says its spam it its. I score Razor very high: score RAZOR2_CF_RANGE_E8_51_100 9.9 score RAZOR2_CF_RANGE_51_100 9.9 Next is URIBL_BLACK, another well checked list of massive spammers: score URIBL_BLACK 9.999 These two take a LOT of spam directly over the recommended required score. That being said, most people do reduce their Required_score but only after they have trained bayes as recommended by the spamassassin docs. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 9:30 AM, Kaare Rasmussen <kaare@jasonic.dk> wrote:
Let it learn? Or teach it? The keys to SA is get razor working. All the network tests are useful, but if razor says its spam it is, period. Then make sure you understand how bayes databases have to be set up. Since SA does not block spam, merely tags it, you have to add kmail filters to move the probably spam to a folder that you inspect occasionally. Set SA to record tests that it hit upon, and not to mess with the subject. Then look at stuff it says is not spam (but which really is) and see which rules are fireing. If bayes_99 is not hitting then you have your bayes set up wrong, or its still not trained properly. You have to explicitly tell it which is spam and which is ham for a while. The easiest way to do this is to create a folder called MissedSpam and one called FalseSpam (or some such) and move/copy miss-categorized messages into those folders. Then use sa-learn to pass those mailboxes to the learning process to train bayes, and (if you register) report them to Razor. Without this, SA won't be anywhere near as effective as it can be. I get less than 1 spam per day using SA, and never the same spam twice. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Kaare Rasmussen wrote:
spamassassin can do a good job as part of a multi layered spam defense. If you're only running on a pop3 client then most of the measures will be beyond your control. Greylisting and sanity checks at the smtp gateway are the most important supporting factor. Also important is the use of network tests: razor, RBLs, Finally, spamassassin itself should be kept up to date, and supplemented with the basic rules pack from rules emporium. If at all possible, spamassasin and friends should be server side. Joe -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Mar 31, 2008 at 10:03 AM, Joe Sloan <joe@tmsusa.com> wrote:
Spamassassin can do an EXCELLENT job as the ONLY layer in a spam defense EVEN on a pop-3 client such as Kmail. Sanity check and grey listing at an smtp gateway (beyond the control of the pop-3 user) are largely redundant, as virtually none of this traffic passes a well tuned Spamassassin setup. -- ----------JSA--------- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (5)
-
Bob S -
Joe Sloan -
John Andersen -
Kaare Rasmussen -
Mike