Searched but did not find any info re scores for squirrelmail inbound

[bongomania <od...@usa.net>]

My email server, squirrelmail, has spamassassin already installed.  To
configure, it says to enter the score above which emails should be
quarantined.  Unfortunately nowhere on that page, nor in the SA FAQ, nor in
the SA WIKI, nor in a search of old messages, can I find any mention of what
scores are normal to choose.  Looking at the scoring system, it seems most
flags are worth less than 2 points.  But the max is 999!  So what is the
right range between 1 and 999 for normal usage?

And, honestly, why is such basic info missing from the entry-level usage
notes and FAQ?

Thanks for your help!
-- 
View this message in context: http://old.nabble.com/Searched-but-did-not-find-any-info-re-scores-for-squirrelmail-inbound-tp29008487p29008487.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Searched but did not find any info re scores for squirrelmail inbound

["McDonald, Dan" <Da...@austinenergy.com>]

On Jun 27, 2010, at 8:22 PM, bongomania <od...@usa.net> wrote:

> 
> My email server, squirrelmail, has spamassassin already installed.  To
> configure, it says to enter the score above which emails should be
> quarantined.  

Generally, 5 indicates spam. As a few false positives do occur at those levels, so I usually mark spam at 5 and quarantine around 7 to 20. Above 20, I usually just discard. 

> Unfortunately nowhere on that page, nor in the SA FAQ, nor in
> the SA WIKI, nor in a search of old messages, can I find any mention of what
> scores are normal to choose.  

You may find the amavisd-new FAQ to be useful. 

> Looking at the scoring system, it seems most
> flags are worth less than 2 points.  But the max is 999!  So what is the
> right range between 1 and 999 for normal usage?
> 
> And, honestly, why is such basic info missing from the entry-level usage
> notes and FAQ?
> 
> Thanks for your help!
> -- 
> View this message in context: http://old.nabble.com/Searched-but-did-not-find-any-info-re-scores-for-squirrelmail-inbound-tp29008487p29008487.html
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
> 

Re: Searched but did not find any info re scores for squirrelmail inbound

[Karsten Bräckelmann <gu...@rudersport.de>]

On Mon, 2010-06-28 at 14:57 -0400, Alex wrote:
> > Nope, spamd does not do anything with the email either.
> 
> Thanks for correcting me. I use amavisd. For those who use spamd, how
> do they determine the email destiny based on the score? With just
> procmail?

Yes, or any other MDA, probably using sieve. Note though, that such MDA
usually delivers identified spam into a dedicated "quarantine" folder
*per* *user*, rather than globally.

Moreover, merely focussing on the delivery folder is not all to it. How
do they "use spamd" in the first place?

Just like you integrate Amavisd-new with your MTA, you also need to do
this in any other case. Procmail can do the spamc filter calling. In a
general case (including any sieve MDA, IIRC) you once again need to
integrate SA with the MTA.


> I thought spamd also managed the quarantine, but I guess not.

Nope, it doesn't.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Searched but did not find any info re scores for squirrelmail inbound

[Alex <my...@gmail.com>]

Hi,

>> [...] spamassassin itself only does the scoring -- it's up to another
>> program, such as amavisd-new (separate application) or spamd (included
>> with spamassassin) to do something with the email once it has been
>> determined to be spam.
>
> Nope, spamd does not do anything with the email either.

Thanks for correcting me. I use amavisd. For those who use spamd, how
do they determine the email destiny based on the score? With just
procmail? I thought spamd also managed the quarantine, but I guess
not.

Thanks,
Alex

Re: Searched but did not find any info re scores for squirrelmail inbound

[Karsten Bräckelmann <gu...@rudersport.de>]

On Sun, 2010-06-27 at 21:34 -0400, Alex wrote:
> [...] spamassassin itself only does the scoring -- it's up to another
> program, such as amavisd-new (separate application) or spamd (included
> with spamassassin) to do something with the email once it has been
> determined to be spam.

Nope, spamd does not do anything with the email either.

As you correctly stated, SpamAssassin itself only does the scoring. Same
for spamd, the SpamAssassin daemon. SA can score a message, classify
based on a threshold, add headers, optionally rewrite a few select
headers, or wrap the original, unaltered (spam) message in a new
message.

Or in short -- score, classify and report.

That's it. That's what SA does.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Searched but did not find any info re scores for squirrelmail inbound

[Alex <my...@gmail.com>]

Hi,

> My email server, squirrelmail, has spamassassin already installed.  To

Squirrelmail isn't your email server, it's a client to an email server
like postfix or sendmail.

> configure, it says to enter the score above which emails should be
> quarantined.  Unfortunately nowhere on that page, nor in the SA FAQ, nor in

Perhaps it's not as clear as it should be, but you can find it here:

http://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Conf.html#scoring_options

The default score is 5, before an email is considered spam, but
spamassassin itself only does the scoring -- it's up to another
program, such as amavisd-new (separate application) or spamd (included
with spamassassin) to do something with the email once it has been
determined to be spam.

You should ask your administrator what the default score is, because
while 5 is what most implementations use, it doesn't necessarily mean
it is what yours is using.

Also, even if it is 5, there may be some false positives (mail
inadvertently marked as spam when it shouldn't have been) that raise
the score above 5 that you may want to analyze before discarding.

Regards,
Alex

Re: Searched but did not find any info re scores for squirrelmail inbound

[Karsten Bräckelmann <gu...@rudersport.de>]

On Sun, 2010-06-27 at 18:22 -0700, bongomania wrote:
> My email server, squirrelmail, has spamassassin already installed.  To
> configure, it says to enter the score above which emails should be
> quarantined.  Unfortunately nowhere on that page, nor in the SA FAQ, nor in
> the SA WIKI, nor in a search of old messages, can I find any mention of what
> scores are normal to choose.

That is probably because SA does not know about quarantining. SA scores
a message. Quarantining, rejecting, delivering into a dedicated spam
folder -- all actions that SA does not do.

As you correctly stated yourself, you are not configuring SA by choosing
a quarantine threshold. You want to read the docs of the software you
are actually configuring.


> Looking at the scoring system, it seems most
> flags are worth less than 2 points.  But the max is 999!  So what is the
> right range between 1 and 999 for normal usage?

These limits are not imposed by SA, but that other software you are
trying to set up.


> And, honestly, why is such basic info missing from the entry-level usage
> notes and FAQ?

Cause it ain't a SA thang.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}