You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Benjamin Copeland <be...@linaro.org> on 2015/04/28 12:52:19 UTC
Unmanageable spam levels
Hi All,
I run mailman on Ubuntu 14.04 with Postfix.
It has been setup from the Ubuntu packages.
The problem I have is there is there are a large amount of spam coming
through, which spamassassin does not seem to be giving a high enough
score and discarding.
I run the mmlearn script
(http://www.jamesh.id.au/articles/mailman-spamassassin/mmlearn), which
processes a very heavily spammed list.
............................................................................
Learned tokens from 289 message(s) (1028 message(s) examined)
The problem is, "teaching" spamd, seems to have no results.
Here are some example spam messages, where spamd just seems to setting
the score too low.
X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,
HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,HTML_TAG_BALANCE_HEAD,RDNS_NONE,
T_REMOTE_IMAGE,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0
Received: from tetro117.arcsfatburner.ninja (unknown [104.148.31.117])
by example.com (Postfix) with ESMTP id 9319A61C9F
for <ex...@example.com>; Thu, 23 Apr 2015 12:30:37 +0000 (UTC)
Date: Thu, 23 Apr 2015 05:30:31 -0700
Qc-Ns: 42bd7606c3b57f7fdfd2fda41c3e0681o-22879961s-o22879961
From: End Belly Flab <En...@tetro117.arcsfatburner.ninja>
Mime-Version: 1.0
Ufito-Wj: 3225319z-3225319vv_k22879961
Fp-Sicnt: 22879961h-22879961pc22879961
Message-ID: <22...@tetro117.arcsfatburner.ninja>
To: <ex...@example.com>
En-Ym: 3225319d3225319xs-h22879961
Subject: Live Testimonial- "I'm down 4 sizes in 4 weeks"- Free Trial
Your Free Trial
Content-Type: multipart/alternative; boundary="22879961"
Any suggestions on how I can improve this?
Thanks
Ben
Re: Unmanageable spam levels
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 28.04.15 11:52, Benjamin Copeland wrote:
>I run mailman on Ubuntu 14.04 with Postfix.
>
>It has been setup from the Ubuntu packages.
>
>The problem I have is there is there are a large amount of spam coming
>through, which spamassassin does not seem to be giving a high enough
>score and discarding.
spamassassin has some dependencies you could install, e.g. razor, pyzor and
others. Some of features have to be turned on to be active.
And some, especially blacklists, require own (not shared) DNS server to
work.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
There's a long-standing bug relating to the x86 architecture that
allows you to install Windows. -- Matthew D. Fuller
Re: Unmanageable spam levels
Posted by RW <rw...@googlemail.com>.
On Tue, 28 Apr 2015 13:01:04 +0200
Christian Laußat wrote:
> Am 28.04.2015 12:52, schrieb Benjamin Copeland:
> > Any suggestions on how I can improve this?
>
> Which user are you running the script as? Is it the same user as your
> mailserver is invoking spamassassin?
>
> You should use the -u option for sa-learn to set the right user.
-u is for the virtual mail user in the database. It's normally the unix
user running sa-learn that's incorrect.
Re: Unmanageable spam levels
Posted by Reindl Harald <h....@thelounge.net>.
Am 28.04.2015 um 13:10 schrieb Benjamin Copeland:
> On 28 April 2015 at 12:01, Christian Laußat
> <sp...@list.laussat.de> wrote:
>> Am 28.04.2015 12:52, schrieb Benjamin Copeland:
>>>
>>> Any suggestions on how I can improve this?
>>
>> Which user are you running the script as? Is it the same user as your mailserver is invoking spamassassin?
>
> I manually run it, I run it as sudo root.
>
> The script chown's the mbox, that being said I have now added the -u option in.
>
>> You should use the -u option for sa-learn to set the right user
su -c "command params" - user
*never* start commands as root which don#t need that privileges, hence a
good shellscript does chown/chmod and then fires sa-learn as the target user
Re: Unmanageable spam levels
Posted by Reindl Harald <h....@thelounge.net>.
Am 28.04.2015 um 13:31 schrieb Benjamin Copeland:
>>> The script chown's the mbox, that being said I have now added the -u
>>> option in.
>>
>> Don't do that unless you have multiple virtual users configured and
>> genuinely need it.
>
> Indeed, I read man page.
>
> I had to add debian-spamd to lists user (mailman user).
>
> sudo su -c "sh /home/ubuntu/mmlearn list-name" - debian-spamd
get rid of sudo everywhere and all the time :-)
su -c "command" - user *is* the user switch and the - before the
username makes sure that the whole environment of the user is properly
initalized
man su
Re: Unmanageable spam levels
Posted by Benjamin Copeland <be...@linaro.org>.
On 28 April 2015 at 12:18, RW <rw...@googlemail.com> wrote:
> On Tue, 28 Apr 2015 12:10:15 +0100
> Benjamin Copeland wrote:
>
>> On 28 April 2015 at 12:01, Christian Laußat
>> <sp...@list.laussat.de> wrote:
>> > Am 28.04.2015 12:52, schrieb Benjamin Copeland:
>> >>
>> >> Any suggestions on how I can improve this?
>> >
>> >
>> > Which user are you running the script as? Is it the same user as
>> > your mailserver is invoking spamassassin?
>>
>> I manually run it, I run it as sudo root.
>
> It should be whatever spamd is running as, or drops to. It shouldn't
> be root.
True.
>
>> The script chown's the mbox, that being said I have now added the -u
>> option in.
>
> Don't do that unless you have multiple virtual users configured and
> genuinely need it.
Indeed, I read man page.
I had to add debian-spamd to lists user (mailman user).
sudo su -c "sh /home/ubuntu/mmlearn list-name" - debian-spamd
Now works
Re: Unmanageable spam levels
Posted by John Hardin <jh...@impsec.org>.
On Tue, 28 Apr 2015, RW wrote:
> On Tue, 28 Apr 2015 13:13:11 +0100 Benjamin Copeland wrote:
>
>> This got X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00
>> autolearn=ham autolearn_force=no version=3.4.0
>
> I'd turn-off auto-learning. You definitely need to clear the existing
> database.
Seconded. Turn off autolearn, wipe and retrain from scratch with
known-clean ham and spam corpora. Once things are stable you can consider
reenabling autolearn.
Also:
> X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,
> HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,HTML_TAG_BALANCE_HEAD,RDNS_NONE,
> T_REMOTE_IMAGE,URIBL_BLOCKED autolearn=no autolearn_force=no
> version=3.4.0
URIBL_BLOCKED is a clear indication that you need to set up a local
recursing DNS server for your mail services, rather than relying on
forwarding to an upstream DNS provider (e.g. your ISP). The DNSBL queries
have been aggregated with others' requests to the point they are exceeding
the free-usage limit.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
If you have to brand justice in some way to distinguish it from
just "justice", then that's a real clue that it is in fact
distinct from actual "justice". -- GWA.45, on "social justice"
-----------------------------------------------------------------------
10 days until the 70th anniversary of VE day
Re: Unmanageable spam levels
Posted by RW <rw...@googlemail.com>.
On Tue, 28 Apr 2015 13:13:11 +0100
Benjamin Copeland wrote:
> On 28 April 2015 at 12:25, Martin Hepworth <ma...@gmail.com> wrote:
> > that score does look very low, especially for those rules that
> > fired, even with the BAYES_00.
>
> Yup, that is what I thought, all the spam levels seem very low in my
> messages.
>
> *** Final Notice ***
>
>
> This notice is to inform you your factory warranty has expired, you
> are now responsible for paying any repairs. Please respond by 23Apr15
> and mention this notice for a 60% discount.
It's probably worth writing some custom rules and rescoring some of the
stock rules based on what's in the list[s].
> This got X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00
> autolearn=ham autolearn_force=no version=3.4.0
If this is just for mailing list, it should be very easy to train it
manually. IIWY I'd turn-off auto-learning. You definitely need to
clear the existing database.
Re: Unmanageable spam levels
Posted by Benjamin Copeland <be...@linaro.org>.
On 28 April 2015 at 12:25, Martin Hepworth <ma...@gmail.com> wrote:
> that score does look very low, especially for those rules that fired, even
> with the BAYES_00.
Yup, that is what I thought, all the spam levels seem very low in my messages.
*** Final Notice ***
This notice is to inform you your factory warranty has expired, you
are now responsible for paying any repairs. Please respond by 23Apr15
and mention this notice for a 60% discount.
This got X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
autolearn_force=no version=3.4.0
>
> I'd look to make sure you're adding the scores for the rules in the headers
> as well as the rules that fired so you see if you've got another rule score
> with a big negative number
>
>
> --
> Martin Hepworth, CISSP
> Oxford, UK
>
> On 28 April 2015 at 12:18, RW <rw...@googlemail.com> wrote:
>>
>> On Tue, 28 Apr 2015 12:10:15 +0100
>> Benjamin Copeland wrote:
>>
>> > On 28 April 2015 at 12:01, Christian Laußat
>> > <sp...@list.laussat.de> wrote:
>> > > Am 28.04.2015 12:52, schrieb Benjamin Copeland:
>> > >>
>> > >> Any suggestions on how I can improve this?
>> > >
>> > >
>> > > Which user are you running the script as? Is it the same user as
>> > > your mailserver is invoking spamassassin?
>> >
>> > I manually run it, I run it as sudo root.
>>
>> It should be whatever spamd is running as, or drops to. It shouldn't
>> be root.
>>
>> > The script chown's the mbox, that being said I have now added the -u
>> > option in.
>>
>> Don't do that unless you have multiple virtual users configured and
>> genuinely need it.
>
>
Re: Unmanageable spam levels
Posted by Martin Hepworth <ma...@gmail.com>.
that score does look very low, especially for those rules that fired, even
with the BAYES_00.
I'd look to make sure you're adding the scores for the rules in the headers
as well as the rules that fired so you see if you've got another rule score
with a big negative number
--
Martin Hepworth, CISSP
Oxford, UK
On 28 April 2015 at 12:18, RW <rw...@googlemail.com> wrote:
> On Tue, 28 Apr 2015 12:10:15 +0100
> Benjamin Copeland wrote:
>
> > On 28 April 2015 at 12:01, Christian Laußat
> > <sp...@list.laussat.de> wrote:
> > > Am 28.04.2015 12:52, schrieb Benjamin Copeland:
> > >>
> > >> Any suggestions on how I can improve this?
> > >
> > >
> > > Which user are you running the script as? Is it the same user as
> > > your mailserver is invoking spamassassin?
> >
> > I manually run it, I run it as sudo root.
>
> It should be whatever spamd is running as, or drops to. It shouldn't
> be root.
>
> > The script chown's the mbox, that being said I have now added the -u
> > option in.
>
> Don't do that unless you have multiple virtual users configured and
> genuinely need it.
>
Re: Unmanageable spam levels
Posted by RW <rw...@googlemail.com>.
On Tue, 28 Apr 2015 12:10:15 +0100
Benjamin Copeland wrote:
> On 28 April 2015 at 12:01, Christian Laußat
> <sp...@list.laussat.de> wrote:
> > Am 28.04.2015 12:52, schrieb Benjamin Copeland:
> >>
> >> Any suggestions on how I can improve this?
> >
> >
> > Which user are you running the script as? Is it the same user as
> > your mailserver is invoking spamassassin?
>
> I manually run it, I run it as sudo root.
It should be whatever spamd is running as, or drops to. It shouldn't
be root.
> The script chown's the mbox, that being said I have now added the -u
> option in.
Don't do that unless you have multiple virtual users configured and
genuinely need it.
Re: Unmanageable spam levels
Posted by Benjamin Copeland <be...@linaro.org>.
On 28 April 2015 at 12:01, Christian Laußat
<sp...@list.laussat.de> wrote:
> Am 28.04.2015 12:52, schrieb Benjamin Copeland:
>>
>> Any suggestions on how I can improve this?
>
>
> Which user are you running the script as? Is it the same user as your mailserver is invoking spamassassin?
I manually run it, I run it as sudo root.
The script chown's the mbox, that being said I have now added the -u option in.
Ben
>
> You should use the -u option for sa-learn to set the right user.
>
> --
> Christian Laußat
> https://blog.laussat.de
Re: Unmanageable spam levels
Posted by Christian Laußat <sp...@list.laussat.de>.
Am 28.04.2015 12:52, schrieb Benjamin Copeland:
> Any suggestions on how I can improve this?
Which user are you running the script as? Is it the same user as your
mailserver is invoking spamassassin?
You should use the -u option for sa-learn to set the right user.
--
Christian Laußat
https://blog.laussat.de