Training byessian filter in a gatway situation.

[Anthony Metcalf <an...@anferny.ath.cx>]

Hi All,
	I have been hunting around on the web now for some weeks, trying to
find an answer to my question. I think I am incapable of being succinct
enough to get an answer through searching though. :)

If there is a howto out there, or some other source that will answer
this question, please point me directly at that.

Now for the question.

I have a mail gateway, that intercepts mail to and from my company, and
virus/spam filters it, before passing it on to the internal (Exchange)
server or the internet.

This system works, in that all mail is being spam and virus filtered. I
can see this from headers in the mails, and subject tags added by spam
assassin.

The system is no tagging much though, on one mailbox in particular, it
tags maybe 10% of the mail. This is a web visible mail box with about
99% spam.

As the server my mail client interacts with is not the one spam
filtering, I would like to set up two accounts on the gateway box, ham
and spam, so I can farward mail to those accounts, and have spamassassin
learn what is ham and spam from them.

How do I go about this?

System Steup:

Internet<-->gateway(linux,postfix, amavisd, clamav, f-prot,
spamassassin)<-->internal server(winodows, exchange)

Thanks again for any help, and sorry for the long post.

Re: Training byessian filter in a gatway situation.

[Johann Spies <js...@sun.ac.za>]

On Wed, Jan 12, 2005 at 12:43:34PM +0000, Anthony Metcalf wrote:
> 
> As the server my mail client interacts with is not the one spam
> filtering, I would like to set up two accounts on the gateway box, ham
> and spam, so I can farward mail to those accounts, and have spamassassin
> learn what is ham and spam from them.
> 
> How do I go about this?
> 
> System Steup:
> 
> Internet<-->gateway(linux,postfix, amavisd, clamav, f-prot,
> spamassassin)<-->internal server(winodows, exchange)
> 

I have SA running on three servers that forms an email gateway.  I
don't scan outgoing mail for spam.  I have requested users to send
spam that got through to me by attaching the spam to the email.  

Those messages are saved in the "spam" folder and a cron job unpacks
them into seperate messages in a maildir folder named "nuwespam".  The
same program unpacks the attached "hams" from "xham" to "ham".  When I
come across individual spams I save them in the "nuwespam" folder
directly.

The program unpacking the attachements will only handle attachments of
the RFC822 standard and ignore the rest.  I have written it in Ocaml.
Unfortunately it was developed for this spesific situation and not
really suitable for distribution.  If I have time and there is a need
for it, I might try and adapt it to be more generic and more useful
for other users as well.

The three servers then collect the "nuwespam" and  "ham" folders on a
daily basis and feed them to sa-learn.

>From time to time I select ham message from emails I receive to save
to the "ham" folder because the feedback I get from users are normally
more spam than ham.

Regards
Johann
-- 
Johann Spies          Telefoon: 021-808 4036
Informasietegnologie, Universiteit van Stellenbosch

     "Wherefore let him that thinketh he standeth take heed 
      lest he fall."            I Corinthians 10:12