New SA install, configuring for retraining on false positives

[David Mehler <da...@gmail.com>]

Hello,

I've got a Postfix email server going with a Mysql database backend on
FreeBSD 10.2. I'm now wanting to add Spamassassin to the picture and
am wondering current best practices? It's been a number of years since
I did it and last time effectiveness wasn't so good. I'm not sure if
it was because I was following old information or didn't have things
done right configuration wise?

It's looking like I have several options, MailScanner which hooks in
to SA, Amavisd-new ditto, or SA as a milter called directly from my
MTA. Comments on these or other methods?

I'm also wanting to get the latest antispam rules, are those from SA
or are there third party rules I should look into?

Finally, one of the things I'm going to implement in addition to SA is
Sieve, done with my MDA Dovecot, in which mail flagged witha spam
header is automatically moved in to a dedicated spam folder. I am then
wanting to set up a system to tell SA when it has misclassified a
false positive, what are people using in that environment?

Any other user feedback appreciated.

Thanks.
Dave.

Re: New SA install, configuring for retraining on false positives

[Reindl Harald <h....@thelounge.net>]

Am 05.11.2015 um 20:26 schrieb Joe Quinn:
> On 11/5/2015 1:44 PM, Reindl Harald wrote:
>>
>> Am 05.11.2015 um 19:24 schrieb Bill Cole:
>>> On 5 Nov 2015, at 6:52, David Mehler wrote:
>>>> or SA as a milter called directly from my
>>>> MTA.
>>>
>>> There is no such thing: SA is not a milter
>>
>> tell that our spamass-milter setup running for more than a year now
>> rejecting 99% of junk at MTA level (the piece making it through
>> postscreen, spf, ptr/helo, greylisting and what not) with nearly zero
>> false positives
>>
> Just to make sure it's clear, because this is an easy bit of authorship
> to be confused by:
> David is correct in that spamass-milter isn't spamassassin. It's
> credited on their manpage to Georg C. F. Greve <gr...@gnu.org> and Dan
> Nelson <dn...@allantgroup.com> and GPLv2 licensed.
>
> It falls under the snipped bit of the previous email, milters that can
> support SA. There's an overlap in concerns that makes it often on-topic
> here (much like with MD / Postfix / other elements of the mail stack),
> but we aren't the developers

i know that all, but "there is no such thing" is wrong

Re: New SA install, configuring for retraining on false positives

[Joe Quinn <jq...@pccc.com>]

On 11/5/2015 1:44 PM, Reindl Harald wrote:
>
>
> Am 05.11.2015 um 19:24 schrieb Bill Cole:
>> On 5 Nov 2015, at 6:52, David Mehler wrote:
>>> or SA as a milter called directly from my
>>> MTA.
>>
>> There is no such thing: SA is not a milter
>
> tell that our spamass-milter setup running for more than a year now 
> rejecting 99% of junk at MTA level (the piece making it through 
> postscreen, spf, ptr/helo, greylisting and what not) with nearly zero 
> false positives
>
Just to make sure it's clear, because this is an easy bit of authorship 
to be confused by:
David is correct in that spamass-milter isn't spamassassin. It's 
credited on their manpage to Georg C. F. Greve <gr...@gnu.org> and Dan 
Nelson <dn...@allantgroup.com> and GPLv2 licensed.

It falls under the snipped bit of the previous email, milters that can 
support SA. There's an overlap in concerns that makes it often on-topic 
here (much like with MD / Postfix / other elements of the mail stack), 
but we aren't the developers.

Re: New SA install, configuring for retraining on false positives

[Reindl Harald <h....@thelounge.net>]

Am 05.11.2015 um 19:24 schrieb Bill Cole:
> On 5 Nov 2015, at 6:52, David Mehler wrote:
>> or SA as a milter called directly from my
>> MTA.
>
> There is no such thing: SA is not a milter

tell that our spamass-milter setup running for more than a year now 
rejecting 99% of junk at MTA level (the piece making it through 
postscreen, spf, ptr/helo, greylisting and what not) with nearly zero 
false positives

Re: New SA install, configuring for retraining on false positives

[Bill Cole <sa...@billmail.scconsult.com>]

On 5 Nov 2015, at 6:52, David Mehler wrote:

> Hello,
>
> I've got a Postfix email server going with a Mysql database backend on
> FreeBSD 10.2. I'm now wanting to add Spamassassin to the picture and
> am wondering current best practices? It's been a number of years since
> I did it and last time effectiveness wasn't so good. I'm not sure if
> it was because I was following old information or didn't have things
> done right configuration wise?
>
> It's looking like I have several options, MailScanner which hooks in
> to SA,

But sadly uses an explicitly unsupported interface to Postfix that 
carries a real risk of breakage. This has resulted in openly hostility 
between MailScanner and Postfix developers that is obviously not what 
you want when selecting tools to integrate.

> Amavisd-new ditto,

The canonical content filtering tool for Postfix. Works, has lots of 
users, never a really wrong choice. It may give you enough rope to hang 
yourself with but you'd need to be a skilled hangman.

> or SA as a milter called directly from my
> MTA.

There is no such thing: SA is not a milter.

But of course there *are* multiple milters that can support SA. If 
you're comfortable writing Perl and like the idea of being able to 
implement your own custom filtering tweaks that don't fit well as SA 
rules, Consider MIMEDefang, a milter that also acts as a hub for other 
tools (such as AV software) similarly to amavisd-new and is configured 
by a set of Perl subroutine implementations that you can modify 
arbitrarily. This is a nice fit for logic that can't be done in Postfix 
itself because of the limitations on its internal content filters & 
policy controls but which don't make sense to implement as custom SA 
rules. MD definitely gives you more than enough rope to hang yourself 
with. To overextend that metaphor, it provides you a working rope 
factory designed for versatile retooling.

Other milters that do nothing but provide simple SA-MTA plumbing may 
make sense for small systems with limited memory or if you have a hatred 
for Perl (which makes SA problematic too...) but otherwise it is hard to 
see an advantage to them over MD or Amavis.

Re: New SA install, configuring for retraining on false positives

[David Jones <dj...@ena.com>]

>From: David Mehler <da...@gmail.com>
>Sent: Thursday, November 5, 2015 5:52 AM
>To: users@spamassassin.apache.org
>Subject: New SA install, configuring for retraining on false positives

>Hello,

>I've got a Postfix email server going with a Mysql database backend on
>FreeBSD 10.2. I'm now wanting to add Spamassassin to the picture and
>am wondering current best practices? It's been a number of years since
>I did it and last time effectiveness wasn't so good. I'm not sure if
>it was because I was following old information or didn't have things
>done right configuration wise?

>It's looking like I have several options, MailScanner which hooks in
>to SA, Amavisd-new ditto, or SA as a milter called directly from my
>MTA. Comments on these or other methods?

>I'm also wanting to get the latest antispam rules, are those from SA
>or are there third party rules I should look into?

>Finally, one of the things I'm going to implement in addition to SA is
>Sieve, done with my MDA Dovecot, in which mail flagged witha spam
>header is automatically moved in to a dedicated spam folder. I am then
>wanting to set up a system to tell SA when it has misclassified a
>false positive, what are people using in that environment?

>Any other user feedback appreciated.

If you don't want to mess with setting this up yourself from scratch, I
recommend using an EFA box in front and have it deliver to your
Dovecot box.
http://efa-project.org/
You would smarthost everything outbound from the Dovecot box back
through the EFA box to see both directions in the web interface for
very nice reporting capabilities.
You can train SA spam/ham easily from within the web interface.
This is a prebuilt MailScanner VM that has everything setup nicely
and can keep itself updated/patched very easily.

Dave J.

>Thanks.
>Dave.

Re: New SA install, configuring for retraining on false positives

[Axb <ax...@gmail.com>]

On 11/05/2015 12:52 PM, David Mehler wrote:
> It's looking like I have several options, MailScanner which hooks in
> to SA, Amavisd-new ditto, or SA as a milter called directly from my
> MTA. Comments on these or other methods?

Mailscanner and Postfix is a hack - it works BUT
Amavisd-new is good and very well supported...
Both in Perl...

If you want something lightweight and no Perl dependency party.

http://fuglu.org

Axb

Re: New SA install, configuring for retraining on false positives

[Reindl Harald <h....@thelounge.net>]

Am 05.11.2015 um 12:52 schrieb David Mehler:
> Finally, one of the things I'm going to implement in addition to SA is
> Sieve, done with my MDA Dovecot, in which mail flagged witha spam
> header is automatically moved in to a dedicated spam folder. I am then
> wanting to set up a system to tell SA when it has misclassified a
> false positive, what are people using in that environment?

you train ham exactly the same way as spam, in fact *you must* train 
enough ham to get bayes working properly