You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jerry Malcolm <te...@malcolms.com> on 2017/11/21 21:01:35 UTC
Scoring Philosophy?
I have been using SpamAssassin in my hosting environment for several
years. It catches thousands of spam messages (thank you...). But my
concern is that it doesn't catch a couple of hundred messages per day.
I have the Bayesian filter working, with a simple way to train it. I
have sent over 5000 training messages to it over the past 6-8 months. I
have set up a non-forwarding caching DNS, and the black list tests are
working.
My question is with the scoring. I understand the general theory of
adding up 'votes' by all of the spam tests to determine if it's indeed
spam. But it appears that no one test, no matter how certain it is, has
enough power to qualify the message as spam. The Bayesian filter can say
it's 80-100% certain it's spam. But some other test decides it's not
and even sometimes has a negative number that subtracts the Bayesian
score from the total. But my biggest problem is that even if it's
scored as coming from a BL URL, but if Bayesian doesn't also say it's
spam, then it's apparently still not spam. I spend a couple of hours
every day trying to tell the Bayesian filter about today's new strains
of spam that it hasn't yet seen.
Am I missing something obvious? Is this just the way it works, and I
should expect to have to run a couple of hundred missed spams through
the Bayesian filter each day? My threshold score was originally set to
5.0. I don't even remember where that came from. I dropped it to 4.0 a
couple of years ago, and that's where it is now. But (see example
output below) when BL says it's spam and adds 2.5, then Bayesian says
it's 40-60% spam and adds 0.8, and it's got a small font and gets
another 0.5, and all other tests are neutral... it's now 3.8 and STILL
not spam with a threshold of 4.0.
Can someone tell me if this is by design and/or if my configuration
should be adjusted? I realize I can easily drop the threshold to 1.0 or
2.0. But that would probably just shift the problem to tons of
false-positives which obviously is not a good solution.
Thx.
Jerry
X-SpamAssassin_121: Content analysis details: (3.8 points, 4.0 required)
X-SpamAssassin_122:
X-SpamAssassin_123: pts rule name description
X-SpamAssassin_124: ---- ----------------------
--------------------------------------------------
X-SpamAssassin_125: 2.5 URIBL_DBL_SPAM Contains a spam URL
listed in the DBL blocklist
X-SpamAssassin_126: [URIs: lspdiscover.com]
X-SpamAssassin_127: 0.0 TVD_RCVD_IP4 Message was received
from an IPv4 address
X-SpamAssassin_128: 0.0 TVD_RCVD_IP Message was received
from an IP address
X-SpamAssassin_129: -0.0 SPF_HELO_PASS SPF: HELO matches SPF
record
X-SpamAssassin_130: 0.8 BAYES_50 BODY: Bayes spam
probability is 40 to 60%
X-SpamAssassin_131: [score: 0.5013]
X-SpamAssassin_132: 0.0 HTML_MESSAGE BODY: HTML included in
message
X-SpamAssassin_133: 0.5 JAM_SMALL_FONT_SIZE RAW: Body of mail
contains parts with very small
X-SpamAssassin_134: font
X-SpamAssassin_135: 0.0 T_REMOTE_IMAGE Message contains an
external image
X-SpamAssassin_136:
X-SpamAssassin_999: --
X-Spam-Flag: NO
X-Spam-Status: No, hits=3.8 required=4.0
X-MessageIsSpamProbability: 0.0022784550478299674
Re: Scoring Philosophy?
Posted by David Jones <dj...@ena.com>.
On 11/21/2017 05:11 PM, Jerry Malcolm wrote:
> On 11/21/2017 3:52 PM, Bowie Bailey wrote:
>> On 11/21/2017 4:01 PM, Jerry Malcolm wrote:
>>> I have been using SpamAssassin in my hosting environment for several
>>> years. It catches thousands of spam messages (thank you...). But my
>>> concern is that it doesn't catch a couple of hundred messages per
>>> day. I have the Bayesian filter working, with a simple way to train
>>> it. I have sent over 5000 training messages to it over the past 6-8
>>> months. I have set up a non-forwarding caching DNS, and the black
>>> list tests are working.
>>>
>>> My question is with the scoring. I understand the general theory of
>>> adding up 'votes' by all of the spam tests to determine if it's
>>> indeed spam. But it appears that no one test, no matter how certain
>>> it is, has enough power to qualify the message as spam. The Bayesian
>>> filter can say it's 80-100% certain it's spam. But some other test
>>> decides it's not and even sometimes has a negative number that
>>> subtracts the Bayesian score from the total. But my biggest problem
>>> is that even if it's scored as coming from a BL URL, but if Bayesian
>>> doesn't also say it's spam, then it's apparently still not spam. I
>>> spend a couple of hours every day trying to tell the Bayesian filter
>>> about today's new strains of spam that it hasn't yet seen.
>>>
>>> Am I missing something obvious? Is this just the way it works, and I
>>> should expect to have to run a couple of hundred missed spams through
>>> the Bayesian filter each day? My threshold score was originally set
>>> to 5.0. I don't even remember where that came from. I dropped it to
>>> 4.0 a couple of years ago, and that's where it is now. But (see
>>> example output below) when BL says it's spam and adds 2.5, then
>>> Bayesian says it's 40-60% spam and adds 0.8, and it's got a small
>>> font and gets another 0.5, and all other tests are neutral... it's
>>> now 3.8 and STILL not spam with a threshold of 4.0.
>>>
>>> Can someone tell me if this is by design and/or if my configuration
>>> should be adjusted? I realize I can easily drop the threshold to 1.0
>>> or 2.0. But that would probably just shift the problem to tons of
>>> false-positives which obviously is not a good solution.
>>
>> The general philosophy is that no one rule should be able to mark a
>> message as spam on its own. However, quite a few of us have bumped
>> the scores beyond that point for rules that we trust. Most commonly
>> the Bayes_99 or Bayes_99+Bayes_999 can be made to score 5+ points if
>> your database is well trained. You can also keep an eye on negative
>> scoring rules that seem to hit too frequently on spams and bump the
>> scores for those.
>>
>> You can also add third-party rules. I believe the only
>> actively-maintained set at the moment is from KAM.
>>
>> http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
>> http://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf
>>
>> I have both of these in use on my server with good results.
>>
>> You can use trusted blacklists to block spam at the MTA before it even
>> gets to SA. I use zen.spamhaus.org for this on my server.
>>
>> You didn't specify the version of SA you are running, but you should
>> make sure you are upgraded to the newest version (3.4.1) for best
>> results.
>>
>> The amount of spam that gets through will be dependent on your
>> mailflow. I usually see 1 or 2 missed spams in my inbox per day.
>> Today, the zen blacklist blocked 33 messages to my inbox and SA marked
>> another 20 as spam while delivering 95 clean messages. I think there
>> might have been one spam that made it to my inbox. I have the
>> threshold set at 4.0 for my mailbox.
>>
> Hi Bowie,
> Thanks for the quick response. I'm a bit concerned about going in and
> playing around with scores, etc considering my minimal knowledge of the
> overall process at this point. I'll download and install the KAM
> rules. And I'll need to start logging my percentages of
> clean/spam/total per account and determine if my results are typical.
> But I'm just curious what others are using for their installation. Is
> running SA out-of-the-box simply not done? is it expected that all
> serious users will add 3rd party rule plugins and adjust scores?
Mail filtering is very dependent on your location, expected languages,
and recipients. SpamAssassin is pretty generic/conservative out of the
box to fit in most environments safely. You need to tune it a bit for
your mail flow.
> I'm currently being inundated with solar, skin tag removal, 3D organ
> printing, Shark Tank, and Russian brides spam messages. Seems like some
> of these could be pretty obvious rules. No matter what I do with
> Bayesian training, they are still getting through. Just out of
> curiosity, what rule(s), if any, should be expected to catch spam emails
> with subjects such as these? Or, said differently.... are these specific
> subject lines being caught by other users, and if so, what rules are
> catching them? Is there some way I can quickly add a rule that says if
> the subject contains 'Skin Tags', score it to 5 (without getting into
> coding rule plugins, etc)? Or is there some place that is creating
> these rules for 'pretty obvious' subject lines as the new strains of
> spam appear?
>
Absolutely. Start with downloading the KAM.cf into your
/etc/mail/spamassassin once a day. Then look at the KAM.cf to find
examples on how to make custom rules. It's pretty easy:
https://wiki.apache.org/spamassassin/WritingRules
For example. This can be put in /etc/mail/spamassassin/99_my_rules.cf
header SUBJ_INVOICE Subject =~ /Invoice/i
describe SUBJ_INVOICE Subject contains invoice
score SUBJ_INVOICE 0.2
The you restart or reload whatever is launching SA (spamd, Amavis,
Mimedefang, MailScanner, etc.) to load the new rule. If you are simply
using it in a mail client like Thunderbird or Apple Mail, I don't think
you have to restart anything since it launches SpamAssassin probably for
each email. I am not that familiar with using SA in a mail client.
> I still feel like I'm missing something obvious....
>
> Thanks again.
>
> Jerry
>
> On 11/21/2017 3:52 PM, Bowie Bailey wrote:
>> On 11/21/2017 4:01 PM, Jerry Malcolm wrote:
>>> I have been using SpamAssassin in my hosting environment for several
>>> years. It catches thousands of spam messages (thank you...). But my
>>> concern is that it doesn't catch a couple of hundred messages per
>>> day. I have the Bayesian filter working, with a simple way to train
>>> it. I have sent over 5000 training messages to it over the past 6-8
>>> months. I have set up a non-forwarding caching DNS, and the black
>>> list tests are working.
>>>
>>> My question is with the scoring. I understand the general theory of
>>> adding up 'votes' by all of the spam tests to determine if it's
>>> indeed spam. But it appears that no one test, no matter how certain
>>> it is, has enough power to qualify the message as spam. The Bayesian
>>> filter can say it's 80-100% certain it's spam. But some other test
>>> decides it's not and even sometimes has a negative number that
>>> subtracts the Bayesian score from the total. But my biggest problem
>>> is that even if it's scored as coming from a BL URL, but if Bayesian
>>> doesn't also say it's spam, then it's apparently still not spam. I
>>> spend a couple of hours every day trying to tell the Bayesian filter
>>> about today's new strains of spam that it hasn't yet seen.
>>>
>>> Am I missing something obvious? Is this just the way it works, and I
>>> should expect to have to run a couple of hundred missed spams through
>>> the Bayesian filter each day? My threshold score was originally set
>>> to 5.0. I don't even remember where that came from. I dropped it to
>>> 4.0 a couple of years ago, and that's where it is now. But (see
>>> example output below) when BL says it's spam and adds 2.5, then
>>> Bayesian says it's 40-60% spam and adds 0.8, and it's got a small
>>> font and gets another 0.5, and all other tests are neutral... it's
>>> now 3.8 and STILL not spam with a threshold of 4.0.
>>>
>>> Can someone tell me if this is by design and/or if my configuration
>>> should be adjusted? I realize I can easily drop the threshold to 1.0
>>> or 2.0. But that would probably just shift the problem to tons of
>>> false-positives which obviously is not a good solution.
>>
>> The general philosophy is that no one rule should be able to mark a
>> message as spam on its own. However, quite a few of us have bumped
>> the scores beyond that point for rules that we trust. Most commonly
>> the Bayes_99 or Bayes_99+Bayes_999 can be made to score 5+ points if
>> your database is well trained. You can also keep an eye on negative
>> scoring rules that seem to hit too frequently on spams and bump the
>> scores for those.
>>
>> You can also add third-party rules. I believe the only
>> actively-maintained set at the moment is from KAM.
>>
>> http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
>> http://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf
>>
>> I have both of these in use on my server with good results.
>>
>> You can use trusted blacklists to block spam at the MTA before it even
>> gets to SA. I use zen.spamhaus.org for this on my server.
>>
Yes. If you are running a mail filtering server with an MTA like
Postfix, you should put as much filtering as possible in the MTA. For
example, Postfix has postscreen that is very easy to enable and does
wonders without any tuning. Postscreen also has the ability to do
weighted RBLs so you can combine the score of multiple RBLs into a
threshold. Normally any single RBL hit will block an email but this is
too risky. With weighted RBLs, you can setup 20+ RBLs to work together
for better overall accuracy.
Greylisting is very effective too if your users can handle the delay on
new senders. I rolled out greylisting slowly where most users didn't
even know it and now it's helping a lot. You have to exclude Google's
mail servers from greylisting.
>> You didn't specify the version of SA you are running, but you should
>> make sure you are upgraded to the newest version (3.4.1) for best
>> results.
>>
>> The amount of spam that gets through will be dependent on your
>> mailflow. I usually see 1 or 2 missed spams in my inbox per day.
>> Today, the zen blacklist blocked 33 messages to my inbox and SA marked
>> another 20 as spam while delivering 95 clean messages. I think there
>> might have been one spam that made it to my inbox. I have the
>> threshold set at 4.0 for my mailbox.
>>
--
David Jones
Re: Scoring Philosophy?
Posted by Jerry Malcolm <te...@malcolms.com>.
On 11/21/2017 3:52 PM, Bowie Bailey wrote:
> On 11/21/2017 4:01 PM, Jerry Malcolm wrote:
>> I have been using SpamAssassin in my hosting environment for several
>> years. It catches thousands of spam messages (thank you...). But my
>> concern is that it doesn't catch a couple of hundred messages per
>> day. I have the Bayesian filter working, with a simple way to train
>> it. I have sent over 5000 training messages to it over the past 6-8
>> months. I have set up a non-forwarding caching DNS, and the black
>> list tests are working.
>>
>> My question is with the scoring. I understand the general theory of
>> adding up 'votes' by all of the spam tests to determine if it's
>> indeed spam. But it appears that no one test, no matter how certain
>> it is, has enough power to qualify the message as spam. The Bayesian
>> filter can say it's 80-100% certain it's spam. But some other test
>> decides it's not and even sometimes has a negative number that
>> subtracts the Bayesian score from the total. But my biggest problem
>> is that even if it's scored as coming from a BL URL, but if Bayesian
>> doesn't also say it's spam, then it's apparently still not spam. I
>> spend a couple of hours every day trying to tell the Bayesian filter
>> about today's new strains of spam that it hasn't yet seen.
>>
>> Am I missing something obvious? Is this just the way it works, and I
>> should expect to have to run a couple of hundred missed spams through
>> the Bayesian filter each day? My threshold score was originally set
>> to 5.0. I don't even remember where that came from. I dropped it to
>> 4.0 a couple of years ago, and that's where it is now. But (see
>> example output below) when BL says it's spam and adds 2.5, then
>> Bayesian says it's 40-60% spam and adds 0.8, and it's got a small
>> font and gets another 0.5, and all other tests are neutral... it's
>> now 3.8 and STILL not spam with a threshold of 4.0.
>>
>> Can someone tell me if this is by design and/or if my configuration
>> should be adjusted? I realize I can easily drop the threshold to 1.0
>> or 2.0. But that would probably just shift the problem to tons of
>> false-positives which obviously is not a good solution.
>
> The general philosophy is that no one rule should be able to mark a
> message as spam on its own. However, quite a few of us have bumped
> the scores beyond that point for rules that we trust. Most commonly
> the Bayes_99 or Bayes_99+Bayes_999 can be made to score 5+ points if
> your database is well trained. You can also keep an eye on negative
> scoring rules that seem to hit too frequently on spams and bump the
> scores for those.
>
> You can also add third-party rules. I believe the only
> actively-maintained set at the moment is from KAM.
>
> http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
> http://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf
>
> I have both of these in use on my server with good results.
>
> You can use trusted blacklists to block spam at the MTA before it even
> gets to SA. I use zen.spamhaus.org for this on my server.
>
> You didn't specify the version of SA you are running, but you should
> make sure you are upgraded to the newest version (3.4.1) for best
> results.
>
> The amount of spam that gets through will be dependent on your
> mailflow. I usually see 1 or 2 missed spams in my inbox per day.
> Today, the zen blacklist blocked 33 messages to my inbox and SA marked
> another 20 as spam while delivering 95 clean messages. I think there
> might have been one spam that made it to my inbox. I have the
> threshold set at 4.0 for my mailbox.
>
Hi Bowie,
Thanks for the quick response. I'm a bit concerned about going in and
playing around with scores, etc considering my minimal knowledge of the
overall process at this point. I'll download and install the KAM
rules. And I'll need to start logging my percentages of
clean/spam/total per account and determine if my results are typical.
But I'm just curious what others are using for their installation. Is
running SA out-of-the-box simply not done? is it expected that all
serious users will add 3rd party rule plugins and adjust scores? I'm
currently being inundated with solar, skin tag removal, 3D organ
printing, Shark Tank, and Russian brides spam messages. Seems like some
of these could be pretty obvious rules. No matter what I do with
Bayesian training, they are still getting through. Just out of
curiosity, what rule(s), if any, should be expected to catch spam emails
with subjects such as these? Or, said differently.... are these specific
subject lines being caught by other users, and if so, what rules are
catching them? Is there some way I can quickly add a rule that says if
the subject contains 'Skin Tags', score it to 5 (without getting into
coding rule plugins, etc)? Or is there some place that is creating
these rules for 'pretty obvious' subject lines as the new strains of
spam appear?
I still feel like I'm missing something obvious....
Thanks again.
Jerry
On 11/21/2017 3:52 PM, Bowie Bailey wrote:
> On 11/21/2017 4:01 PM, Jerry Malcolm wrote:
>> I have been using SpamAssassin in my hosting environment for several
>> years. It catches thousands of spam messages (thank you...). But my
>> concern is that it doesn't catch a couple of hundred messages per
>> day. I have the Bayesian filter working, with a simple way to train
>> it. I have sent over 5000 training messages to it over the past 6-8
>> months. I have set up a non-forwarding caching DNS, and the black
>> list tests are working.
>>
>> My question is with the scoring. I understand the general theory of
>> adding up 'votes' by all of the spam tests to determine if it's
>> indeed spam. But it appears that no one test, no matter how certain
>> it is, has enough power to qualify the message as spam. The Bayesian
>> filter can say it's 80-100% certain it's spam. But some other test
>> decides it's not and even sometimes has a negative number that
>> subtracts the Bayesian score from the total. But my biggest problem
>> is that even if it's scored as coming from a BL URL, but if Bayesian
>> doesn't also say it's spam, then it's apparently still not spam. I
>> spend a couple of hours every day trying to tell the Bayesian filter
>> about today's new strains of spam that it hasn't yet seen.
>>
>> Am I missing something obvious? Is this just the way it works, and I
>> should expect to have to run a couple of hundred missed spams through
>> the Bayesian filter each day? My threshold score was originally set
>> to 5.0. I don't even remember where that came from. I dropped it to
>> 4.0 a couple of years ago, and that's where it is now. But (see
>> example output below) when BL says it's spam and adds 2.5, then
>> Bayesian says it's 40-60% spam and adds 0.8, and it's got a small
>> font and gets another 0.5, and all other tests are neutral... it's
>> now 3.8 and STILL not spam with a threshold of 4.0.
>>
>> Can someone tell me if this is by design and/or if my configuration
>> should be adjusted? I realize I can easily drop the threshold to 1.0
>> or 2.0. But that would probably just shift the problem to tons of
>> false-positives which obviously is not a good solution.
>
> The general philosophy is that no one rule should be able to mark a
> message as spam on its own. However, quite a few of us have bumped
> the scores beyond that point for rules that we trust. Most commonly
> the Bayes_99 or Bayes_99+Bayes_999 can be made to score 5+ points if
> your database is well trained. You can also keep an eye on negative
> scoring rules that seem to hit too frequently on spams and bump the
> scores for those.
>
> You can also add third-party rules. I believe the only
> actively-maintained set at the moment is from KAM.
>
> http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
> http://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf
>
> I have both of these in use on my server with good results.
>
> You can use trusted blacklists to block spam at the MTA before it even
> gets to SA. I use zen.spamhaus.org for this on my server.
>
> You didn't specify the version of SA you are running, but you should
> make sure you are upgraded to the newest version (3.4.1) for best
> results.
>
> The amount of spam that gets through will be dependent on your
> mailflow. I usually see 1 or 2 missed spams in my inbox per day.
> Today, the zen blacklist blocked 33 messages to my inbox and SA marked
> another 20 as spam while delivering 95 clean messages. I think there
> might have been one spam that made it to my inbox. I have the
> threshold set at 4.0 for my mailbox.
>
Re: Scoring Philosophy?
Posted by Bowie Bailey <Bo...@BUC.com>.
On 11/21/2017 4:01 PM, Jerry Malcolm wrote:
> I have been using SpamAssassin in my hosting environment for several
> years. It catches thousands of spam messages (thank you...). But my
> concern is that it doesn't catch a couple of hundred messages per
> day. I have the Bayesian filter working, with a simple way to train
> it. I have sent over 5000 training messages to it over the past 6-8
> months. I have set up a non-forwarding caching DNS, and the black list
> tests are working.
>
> My question is with the scoring. I understand the general theory of
> adding up 'votes' by all of the spam tests to determine if it's indeed
> spam. But it appears that no one test, no matter how certain it is,
> has enough power to qualify the message as spam. The Bayesian filter
> can say it's 80-100% certain it's spam. But some other test decides
> it's not and even sometimes has a negative number that subtracts the
> Bayesian score from the total. But my biggest problem is that even if
> it's scored as coming from a BL URL, but if Bayesian doesn't also say
> it's spam, then it's apparently still not spam. I spend a couple of
> hours every day trying to tell the Bayesian filter about today's new
> strains of spam that it hasn't yet seen.
>
> Am I missing something obvious? Is this just the way it works, and I
> should expect to have to run a couple of hundred missed spams through
> the Bayesian filter each day? My threshold score was originally set
> to 5.0. I don't even remember where that came from. I dropped it to
> 4.0 a couple of years ago, and that's where it is now. But (see
> example output below) when BL says it's spam and adds 2.5, then
> Bayesian says it's 40-60% spam and adds 0.8, and it's got a small font
> and gets another 0.5, and all other tests are neutral... it's now 3.8
> and STILL not spam with a threshold of 4.0.
>
> Can someone tell me if this is by design and/or if my configuration
> should be adjusted? I realize I can easily drop the threshold to 1.0
> or 2.0. But that would probably just shift the problem to tons of
> false-positives which obviously is not a good solution.
The general philosophy is that no one rule should be able to mark a
message as spam on its own. However, quite a few of us have bumped the
scores beyond that point for rules that we trust. Most commonly the
Bayes_99 or Bayes_99+Bayes_999 can be made to score 5+ points if your
database is well trained. You can also keep an eye on negative scoring
rules that seem to hit too frequently on spams and bump the scores for
those.
You can also add third-party rules. I believe the only
actively-maintained set at the moment is from KAM.
http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf
http://www.pccc.com/downloads/SpamAssassin/contrib/nonKAMrules.cf
I have both of these in use on my server with good results.
You can use trusted blacklists to block spam at the MTA before it even
gets to SA. I use zen.spamhaus.org for this on my server.
You didn't specify the version of SA you are running, but you should
make sure you are upgraded to the newest version (3.4.1) for best results.
The amount of spam that gets through will be dependent on your
mailflow. I usually see 1 or 2 missed spams in my inbox per day. Today,
the zen blacklist blocked 33 messages to my inbox and SA marked another
20 as spam while delivering 95 clean messages. I think there might have
been one spam that made it to my inbox. I have the threshold set at 4.0
for my mailbox.
--
Bowie
Re: Scoring Philosophy?
Posted by RW <rw...@googlemail.com>.
On Wed, 22 Nov 2017 12:36:17 +0000
Martin Gregorie wrote:
> On Wed, 2017-11-22 at 00:39 -0500, Bill Cole wrote:
> > A related and increasingly common (dunno why) source of never
> > hitting DNSBL rules is a form of firewall/router NAT sometimes
> > called "Secure NAT" where inbound connections have their source IP's
> > replaced with the IP of the device handling the NAT.
> >
> Thanks for the heads-up on this 'Secure NAT' facility: this the first
> I've heard of it, but I don't buy ADSL routers very often.
I don't think it's used on ordinary ADSL routers. It seems to be for
server pools.
Re: Scoring Philosophy?
Posted by Jerry Malcolm <te...@malcolms.com>.
On 11/25/2017 12:02 PM, David Jones wrote:
> On 11/25/2017 11:41 AM, Jerry Malcolm wrote:
>> Thanks so much for all the info. I have installed KAM rules, and
>> I've started becoming a ninja writing my own (simple) rules. MUCH
>> improved results (amazing when you finally learn what your doing....)
>>
>> I figure before this is all over with, I'm going to have to become
>> very knowledgeable about regex. But I'm not there yet. Just out of
>> curiosity, has anybody written a rule that checks if the 'from name'
>> contains "Amazon" but the 'from domain' name does not contain
>> "Amazon" (or variations for Kohls, Target, etc)? That's definitely
>> for the sophomore class in regex, and I'm struggling with the
>> freshman class.... Any regex experts that can whip this out?
>>
>> Thanks in advance.
>>
>> Jerry
>
> This has been discussed recently on the list and here's how I have
> handled it:
>
> header BAD_FROM_NAME From:name =~
> /(^chase$|chase.com|Internal Revenue Service|banking|Apple|Bank of
> America|American Express)/i
> describe BAD_FROM_NAME Displayed From contains bad
> information to trick the recipients
> score BAD_FROM_NAME 8.2
>
> The "header" line has a simple regex that is basically a bunch of OR's.
>
> Then you setup "whitelist_auth" entries for the real domains
> preferably using the envelope-from domain which is a little more
> difficult to spoof with the adoption of SPF the past few years.
>
> So for amazon.com, I have these two entries:
>
> whitelist_auth *@amazon.com
> whitelist_auth *@*.amazon.com
>
> and then you put "Amazon" in the "header" line above.
>
> We really need to do something like this in the default SA rules which
> should be safe for all mail flow. I will open a bug issue if anyone
> else thinks this would be a good idea.
>
> This could be implemented with a new 60_whitelist_auth.cf to slowly
> and carefully expand the whitelist_auth entries of those know good
> senders that properly filter their outbound mail and handle abuse
> reports. For example:
>
> whitelist_auth *@alertsp.chase.com
> whitelist_auth *@e.chase.com
>
> to go along with the BAD_FROM_NAME header check above. We would add
> safe subdomain entries from Apple and Bank of America as well. This
> should safely catch a lot of spoofed display names trying to trick
> recipients.
>
> Thoughts?
Thanks, Dave. Now I'm REALLY glad I didn't try to figure this one out
on my own.... What you are recommending makes sense. But doubt I'd have
stumbled onto this solution on my own....
Jerry
Re: Scoring Philosophy?
Posted by David Jones <dj...@ena.com>.
On 11/25/2017 12:20 PM, Jerry Malcolm wrote:
> Thanks, Dave. Now I'm REALLY glad I didn't try to figure this one out
> on my own.... What you are recommending makes sense. But doubt I'd have
> stumbled onto this solution on my own.... :-)
>
> Jerry
>
Sure. I totally understand. It takes a bit of experience with mail
filtering tactics that aren't specific to SA. In this case, you need to
understand SPF and DKIM a bit (SPF_PASS and DKIM_VALID_AU rule hits)
which tell approved sources and authentic emails respectively.
I have a huge list (thousands) of whitelist_auth entries for
_envelope-domain_ senders that I consider trusted. I use the word
"trusted" intentionally so each SA admin can define it themselves.
For those senders that don't have a valid/accurate SPF record, I have a
whitelist_from_rcvd entry instead of a whitelist_auth that won't work
unless there is an SPF_PASS or DKIM_VALID_AU rule hit.
Once you have a good number of whitelist_auth/whitelist_from_rcvd of
_envelope-domain_ entries to cover trusted senders, then you can bump up
scores like BAYES_*, DCC_CHECK, FREEMAIL*, etc. Then the seemingly high
scores in KAM.cf don't cause false positives.
Local rules are used to increase scores to help fight new spam campaigns
from compromised accounts. Compromised accounts are the hardest spam to
block. These definitely require some local custom rules to block zero
hour/day spam that have been specially crafted to get past the stock SA
rules.
Dave
>
> On 11/25/2017 12:02 PM, David Jones wrote:
>> On 11/25/2017 11:41 AM, Jerry Malcolm wrote:
>>> Thanks so much for all the info. I have installed KAM rules, and
>>> I've started becoming a ninja writing my own (simple) rules. MUCH
>>> improved results (amazing when you finally learn what your doing....)
>>>
>>> I figure before this is all over with, I'm going to have to become
>>> very knowledgeable about regex. But I'm not there yet. Just out of
>>> curiosity, has anybody written a rule that checks if the 'from name'
>>> contains "Amazon" but the 'from domain' name does not contain
>>> "Amazon" (or variations for Kohls, Target, etc)? That's definitely
>>> for the sophomore class in regex, and I'm struggling with the
>>> freshman class.... Any regex experts that can whip this out?
>>>
>>> Thanks in advance.
>>>
>>> Jerry
>>
>> This has been discussed recently on the list and here's how I have
>> handled it:
>>
>> header BAD_FROM_NAME From:name =~
>> /(^chase$|chase.com|Internal Revenue Service|banking|Apple|Bank of
>> America|American Express)/i
>> describe BAD_FROM_NAME Displayed From contains bad
>> information to trick the recipients
>> score BAD_FROM_NAME 8.2
>>
>> The "header" line has a simple regex that is basically a bunch of OR's.
>>
>> Then you setup "whitelist_auth" entries for the real domains
>> preferably using the envelope-from domain which is a little more
>> difficult to spoof with the adoption of SPF the past few years.
>>
>> So for amazon.com, I have these two entries:
>>
>> whitelist_auth *@amazon.com
>> whitelist_auth *@*.amazon.com
>>
>> and then you put "Amazon" in the "header" line above.
>>
>> We really need to do something like this in the default SA rules which
>> should be safe for all mail flow. I will open a bug issue if anyone
>> else thinks this would be a good idea.
>>
>> This could be implemented with a new 60_whitelist_auth.cf to slowly
>> and carefully expand the whitelist_auth entries of those know good
>> senders that properly filter their outbound mail and handle abuse
>> reports. For example:
>>
>> whitelist_auth *@alertsp.chase.com
>> whitelist_auth *@e.chase.com
>>
>> to go along with the BAD_FROM_NAME header check above. We would add
>> safe subdomain entries from Apple and Bank of America as well. This
>> should safely catch a lot of spoofed display names trying to trick
>> recipients.
>>
>> Thoughts?
>>
>
--
David Jones
Re: Scoring Philosophy?
Posted by David Jones <dj...@ena.com>.
On 11/25/2017 11:41 AM, Jerry Malcolm wrote:
> Thanks so much for all the info. I have installed KAM rules, and I've
> started becoming a ninja writing my own (simple) rules. MUCH improved
> results (amazing when you finally learn what your doing....)
>
> I figure before this is all over with, I'm going to have to become very
> knowledgeable about regex. But I'm not there yet. Just out of
> curiosity, has anybody written a rule that checks if the 'from name'
> contains "Amazon" but the 'from domain' name does not contain "Amazon"
> (or variations for Kohls, Target, etc)? That's definitely for the
> sophomore class in regex, and I'm struggling with the freshman
> class.... Any regex experts that can whip this out?
>
> Thanks in advance.
>
> Jerry
This has been discussed recently on the list and here's how I have
handled it:
header BAD_FROM_NAME From:name =~
/(^chase$|chase.com|Internal Revenue Service|banking|Apple|Bank of
America|American Express)/i
describe BAD_FROM_NAME Displayed From contains bad
information to trick the recipients
score BAD_FROM_NAME 8.2
The "header" line has a simple regex that is basically a bunch of OR's.
Then you setup "whitelist_auth" entries for the real domains preferably
using the envelope-from domain which is a little more difficult to spoof
with the adoption of SPF the past few years.
So for amazon.com, I have these two entries:
whitelist_auth *@amazon.com
whitelist_auth *@*.amazon.com
and then you put "Amazon" in the "header" line above.
We really need to do something like this in the default SA rules which
should be safe for all mail flow. I will open a bug issue if anyone
else thinks this would be a good idea.
This could be implemented with a new 60_whitelist_auth.cf to slowly and
carefully expand the whitelist_auth entries of those know good senders
that properly filter their outbound mail and handle abuse reports. For
example:
whitelist_auth *@alertsp.chase.com
whitelist_auth *@e.chase.com
to go along with the BAD_FROM_NAME header check above. We would add
safe subdomain entries from Apple and Bank of America as well. This
should safely catch a lot of spoofed display names trying to trick
recipients.
Thoughts?
--
David Jones
Re: Scoring Philosophy?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Sat, 2017-11-25 at 14:37 -0600, David Jones wrote:
> With that rule as it stands, an easily spoofed "Amazon
> <or...@myamazon.com>" would not hit FAKE_AMAZON_FROM. Even if the
> rule specified "@amazon.com," then native DMARC support would be
> needed to block spoofed From: headers for the next amazon.com
> spoof. Since SA doesn't have native DMARC support, every SA instance
> would have to locally manage hundreds of these high-profile targets
> for phishing.
>
Yes, agreed, and I wouldn't normally use anything like that as a
serious rule recognising bad senders: if, as I have, you've got a mail
archive it's better to use that to see whether you've ever sent mail to
the sender of the message being checked. Theres no BL posting delay
either.
I was trying to pass on the principle of combining two or more simple
rules (often one or more would contain an alternates list) that aren't
much use by themselves, but by combining them can become a rather
specific spamtrap and, possibly rather stupidly, thought I'd use this
as an example of how to use metsa rules.
I originally started using the technique when OI was a member of a
software-specific mailing list that carried huge amounts od sales spam
bevcause (a) its mailing list had no spam detectors and very poor
moderation and (b) also shared messages with an equally poorly defended
web forum. I rapidly found that if I used two alternates-based rules,
one for sales terms/phrases commonly used in spam and the other for
product names and generic terms, then the meta-combo was remarkably
spam-specific and FP-free to thre point that it woulkd even reliably
recognise spam using new combinations of sales phrase and product.
Martin
Re: Scoring Philosophy?
Posted by David Jones <dj...@ena.com>.
On 11/25/2017 04:40 PM, RW wrote:
> On Sat, 25 Nov 2017 14:37:12 -0600
> David Jones wrote:
>
>
>> The default SA rules handle Paypal spoofing pretty well with
>> def_whitelist_from_spf in 60_whitelist_spf.cf.
>
> There are def_whitelist entries for amazon domains too. But these
> entries don't handle spoofing.
>
Maybe I wasn't very clear with my previous wording. What I meant is
there are two different rule concepts that go well together to block
spoofing. First a
whitelist_auth/whitelist_spf/whitelist_dkim/whitelist_from_rcvd entry to
allow the high-profile spoofed domain through then the local custom rule
based on the from:name header that adds a few points. This custom rule
won't add enough points to block on it's own so it shouldn't cause any
FPs by itself.
>> Adding "Paypal" and
>> various misspellings to a from:name rule handles spoofing very well.
>> I am only proposing that we extend this to other high-profile domains
>> like Amazon.com.
>
> It wouldn't be extending because (AFAIK) there isn't a stock rule like
> that for paypal.
>
I meant the def_whitelist_from_spf entry in 60_whitelist_spf.cf.
> I think amazon needs a lot more caution than paypal. Paypal is a made-up
> word, its use by a third-party implies fraud. Amazon is a dictionary
> word that could be used legitimately by other organizations.
>
>
I was referring to common spoofing seen recently with the from:name
claiming to be from Amazon/Chase/Bank of America/Internal Revenue
Service/Apple/etc. These are fine to add a few points to if there are
corresponding whitelist_* entries to allow legit email from those
senders through.
--
--
David Jones
Re: Scoring Philosophy?
Posted by RW <rw...@googlemail.com>.
On Sat, 25 Nov 2017 14:37:12 -0600
David Jones wrote:
> The default SA rules handle Paypal spoofing pretty well with
> def_whitelist_from_spf in 60_whitelist_spf.cf.
There are def_whitelist entries for amazon domains too. But these
entries don't handle spoofing.
> Adding "Paypal" and
> various misspellings to a from:name rule handles spoofing very well.
> I am only proposing that we extend this to other high-profile domains
> like Amazon.com.
It wouldn't be extending because (AFAIK) there isn't a stock rule like
that for paypal.
I think amazon needs a lot more caution than paypal. Paypal is a made-up
word, its use by a third-party implies fraud. Amazon is a dictionary
word that could be used legitimately by other organizations.
Re: Scoring Philosophy?
Posted by David Jones <dj...@ena.com>.
On 11/25/2017 01:09 PM, Martin Gregorie wrote:
> On Sat, 2017-11-25 at 11:41 -0600, Jerry Malcolm wrote:
>> Thanks so much for all the info. I have installed KAM rules, and
>> I've
>> started becoming a ninja writing my own (simple) rules. MUCH
>> improved
>> results (amazing when you finally learn what your doing....)
>>
>> I figure before this is all over with, I'm going to have to become
>> very
>> knowledgeable about regex. But I'm not there yet. Just out of
>> curiosity, has anybody written a rule that checks if the 'from name'
>> contains "Amazon" but the 'from domain' name does not contain
>> "Amazon"
>> (or variations for Kohls, Target, etc)? That's definitely for the
>> sophomore class in regex, and I'm struggling with the freshman
>> class.... Any regex experts that can whip this out?
>>
> Or, if you want to make the rule very specific, you can do something
> like this:
>
> describe FAKE_AMAZON_FROM Pick up who claim to be Amazon but aren't
> header __FAF1 from:name =~ /Amazon/
> header __FAF2 from:address =~ /amazon\.com/i
> meta FAKE_AMAZON_FROM ( __FAF1 && !__FAF2 )
> score FAKE_AMAZON_FROM 3.0
>
> The two subrules with '__' prefixes don't generate scores but take true
> or false values which the meta rule can test.
>
> The meta rule only fires if the name contains 'Amazon' and the address
> does not contain it. Note that the __FAF2 rule matches regardless of
> the mix of upper and lower case letters in the domain name because the
> 'i' suffix makes it a caseless comparison.
>
>
> Martin
>
>
With that rule as it stands, an easily spoofed "Amazon
<or...@myamazon.com>" would not hit FAKE_AMAZON_FROM. Even if the rule
specified "@amazon.com," then native DMARC support would be needed to
block spoofed From: headers for the next amazon.com spoof. Since SA
doesn't have native DMARC support, every SA instance would have to
locally manage hundreds of these high-profile targets for phishing.
We see this all of the time for Dropbox.com with various misspellings.
Dropbox.com has a DMARC record with "p=reject" so we can allow in
dropbox.com safely with a "whitelist_auth dropbox.com" and then create
rules to add lots of points to subjects and bodies with Dropbox.com and
various regexes that cover intentional misspellings.
whitelist_auth *@dropbox.com
whitelist_auth *@*.dropbox.com
The default SA rules handle Paypal spoofing pretty well with
def_whitelist_from_spf in 60_whitelist_spf.cf. Adding "Paypal" and
various misspellings to a from:name rule handles spoofing very well. I
am only proposing that we extend this to other high-profile domains like
Amazon.com. Rspamd is doing this.
--
David Jones
Re: Scoring Philosophy?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Sat, 2017-11-25 at 11:41 -0600, Jerry Malcolm wrote:
> Thanks so much for all the info. I have installed KAM rules, and
> I've
> started becoming a ninja writing my own (simple) rules. MUCH
> improved
> results (amazing when you finally learn what your doing....)
>
> I figure before this is all over with, I'm going to have to become
> very
> knowledgeable about regex. But I'm not there yet. Just out of
> curiosity, has anybody written a rule that checks if the 'from name'
> contains "Amazon" but the 'from domain' name does not contain
> "Amazon"
> (or variations for Kohls, Target, etc)? That's definitely for the
> sophomore class in regex, and I'm struggling with the freshman
> class.... Any regex experts that can whip this out?
>
Or, if you want to make the rule very specific, you can do something
like this:
describe FAKE_AMAZON_FROM Pick up who claim to be Amazon but aren't
header __FAF1 from:name =~ /Amazon/
header __FAF2 from:address =~ /amazon\.com/i
meta FAKE_AMAZON_FROM ( __FAF1 && !__FAF2 )
score FAKE_AMAZON_FROM 3.0
The two subrules with '__' prefixes don't generate scores but take true
or false values which the meta rule can test.
The meta rule only fires if the name contains 'Amazon' and the address
does not contain it. Note that the __FAF2 rule matches regardless of
the mix of upper and lower case letters in the domain name because the
'i' suffix makes it a caseless comparison.
Martin
Re: Scoring Philosophy?
Posted by Jerry Malcolm <te...@malcolms.com>.
Thanks so much for all the info. I have installed KAM rules, and I've
started becoming a ninja writing my own (simple) rules. MUCH improved
results (amazing when you finally learn what your doing....)
I figure before this is all over with, I'm going to have to become very
knowledgeable about regex. But I'm not there yet. Just out of
curiosity, has anybody written a rule that checks if the 'from name'
contains "Amazon" but the 'from domain' name does not contain "Amazon"
(or variations for Kohls, Target, etc)? That's definitely for the
sophomore class in regex, and I'm struggling with the freshman
class.... Any regex experts that can whip this out?
Thanks in advance.
Jerry
Re: Scoring Philosophy?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 22 Nov 2017, at 7:36 (-0500), Martin Gregorie wrote:
> On Wed, 2017-11-22 at 00:39 -0500, Bill Cole wrote:
>> A related and increasingly common (dunno why) source of never
>> hitting DNSBL rules is a form of firewall/router NAT sometimes
>> called
>> "Secure NAT" where inbound connections have their source IP's
>> replaced with the IP of the device handling the NAT.
>>
> Thanks for the heads-up on this 'Secure NAT' facility: this the first
> I've heard of it, but I don't buy ADSL routers very often.
I don't think i've ever seen it in ADSL or DOCSIS routers except for
"hairpin" connections where an inside device tries to connect to an
outside address. Which is probably a bug...
I have seen it behind Cisco PIX/ASA devices, F5 BIG-IP load balancers,
and some software-defined networking subsystems in "cloud" environments.
> I have a slightly OTT question about it: in your experience has this
> 'Secure NAT' facility been selectable as part of the device's
> configuration or is it always on?
I've always run into it from the standpoint of a network tenant or
advisor to a network tenant not a network admin, i.e. managing servers
on a RFC1918 network whose border gateways I don't directly control or
helping someone in that situation. For example, I worked some years ago
in a corporate environment where F5 had recently landed a big deal and
everything suddenly needed to be behind a pair of BIG-IP load balancers,
even the outside mail cluster. I didn't like it beforehand, but when it
was done and the guy who'd taken the F5 kickback^W^W^W^W approved the F5
contract suddenly started to get a flood of spam, I discovered that
"Secure NAT" was apparently the default. In that case I got my MTAs
released from captivity, since DNS does good-enough load balancing for
mail. More recently, I had a *considerate* net admin ask me if I wanted
his ASA to do "smtp fixup" (NO) and/or "secure NAT" (NO) for a mail
cluster, so I guess it's at least optional for the ASA (and probably
whatever old PIXs are still out there.) For cloud/SDN environments I
don't know which providers default which way, but generally speaking if
you point a MX to a cloud provider, you should shell out for a real IP
that isn't fiddled with, not a NAT address.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Currently Seeking Steady Work: https://linkedin.com/in/billcole
Re: Scoring Philosophy?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Wed, 2017-11-22 at 00:39 -0500, Bill Cole wrote:
> A related and increasingly common (dunno why) source of never
> hitting DNSBL rules is a form of firewall/router NAT sometimes called
> "Secure NAT" where inbound connections have their source IP's
> replaced with the IP of the device handling the NAT.
>
Thanks for the heads-up on this 'Secure NAT' facility: this the first
I've heard of it, but I don't buy ADSL routers very often.
I have a slightly OTT question about it: in your experience has this
'Secure NAT' facility been selectable as part of the device's
configuration or is it always on?
Martin
Re: Scoring Philosophy?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 21 Nov 2017, at 16:01 (-0500), Jerry Malcolm wrote:
> I have the Bayesian filter working, with a simple way to train it.
> I have sent over 5000 training messages to it over the past 6-8
> months.
That's good, but only if it has a mix of ham and spam. If you only tell
the Bayes filter about one or the other, it will work poorly. Also,
while there is widely differing opinion on the "autolearn"
functionality, I find it keeps my Bayes DB pretty accurate, with
bayes_auto_learn_threshold_nonspam set to -0.1 (it defaults to 0.1) and
bayes_auto_learn_threshold_spam to 8 (default is 12.)
On the larger issue of whether SpamAssassin is an "out-of-the-box" total
solution for spam control, the simple answer is "no." No such thing
exists or CAN exist. I've worked with about a dozen mail systems
handling mail for about a hundred distinct domains (I'm old) and while
they have had many commonalities, each has needed its own tweaking to
optimize, and in cases where I've run multi-tenant systems, seemingly
similar customers have required divergent filtering, i.e. multiple small
businesses of similar scale in the same metropolitan area have each
needed domain-specific filtering that their neighbors using the same
infrastructure & services provider couldn't tolerate. The FUSSP is a
myth. (see https://www.rhyolite.com/anti-spam/you-might-be.html for
signs of FUSSP delusions.)
Beyond the fact that similar domains and even similar individuals can
have starkly different anti-spam needs, there is a blind spot in
SpamAssassin which is the result of its contributors generally
practicing layered defense in such a way that they never even show to
SpamAssassin a large fraction of the spam which targets them. SA will
not catch some of the most blatant and even dangerous spam because it is
easily caught by safe MTA (or pre-MTA, e.g. postscreen) anti-spam
tactics or even network layer tools like the Spamhaus DROP and EDROP
lists. If you do not use mechanisms that end the majority of SMTP
sessions before the DATA phase, you will need to be especially careful
about correct and customized configuration of SA.
One common area to be particularly careful about in configuring SA is
network classification: the trusted_networks and internal_networks
settings. If you do not set those correctly, you can end up never
hitting any of the DNSBL rules or hitting them improperly because SA
isn't working with the right Received header for a particular DNSBL. A
related and increasingly common (dunno why) source of never hitting
DNSBL rules is a form of firewall/router NAT sometimes called "Secure
NAT" where inbound connections have their source IP's replaced with the
IP of the device handling the NAT. This typically kills any ability of a
MTA or a filter like SA to use DNSBLs or any other anti-spam tactic that
requires knowing the client IP (or the client IP of the last
external-client transport hop.)
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Currently Seeking Steady Work: https://linkedin.com/in/billcole