You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Reindl Harald <h....@thelounge.net> on 2014/09/17 10:51:32 UTC
"more_spam_from" like "more_spam_to"
Hi
for some mailing-lists a "more_spam_from" would make
sense instead whitelist a sender- is there a rule i
don't see or has somebody a working one for "local.cf"?
honestly i would like to have 4 options depending
on sender or RCPT
* more_spam (-2)
* most_spam (-4)
* lot_of_spam (-6)
* all_spam (-100)
Re: "more_spam_from" like "more_spam_to"
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>RW> A lot of people don't put mailing lists through Spamassassin, most
>RW> of them have already been spam filtered, and to get the best results
>RW> you have to extend your internal network and maintain it.
>Matus> no... they do not filter mail from mailing lists through SA. it
>Matus> is setting in outside spamassassin, usually in MTA, milter or
>Matus> procmail.
On 19.09.14 00:32, Ian Zimmerman wrote:
>To me, it sounds like this:
>
>"Lots of people don't put mailing lists through Spamassassin,"
funny, and this sound to me exactly that the mail from mailing lists is not
filtered by SA...
I do this too, for some lists (although not all).
Some lists can even unsubscribe user after receiving bounces ...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux is like a teepee: no Windows, no Gates and an apache inside...
Re: "more_spam_from" like "more_spam_to"
Posted by Ian Zimmerman <it...@buug.org>.
On Fri, 19 Sep 2014 08:37:45 +0200,
Matus UHLAR - fantomas <uh...@fantomas.sk> wrote:
RW> A lot of people don't put mailing lists through Spamassassin, most
RW> of them have already been spam filtered, and to get the best results
RW> you have to extend your internal network and maintain it.
Ian> Do you mean the "trusted_networks" setting here?
Matus> no... they do not filter mail from mailing lists through SA. it
Matus> is setting in outside spamassassin, usually in MTA, milter or
Matus> procmail.
Matus> trusted_networks is SA configuration setting so it can't be used
Matus> when SA is avoided. Also, it has much different meaning than not
Matus> scanning mail from those hosts.
Well, that is not how I read RW's message.
To me, it sounds like this:
"Lots of people don't put mailing lists through Spamassassin, in part
because of the extra work that would be required if they did; namely,
they'd have to extend their internal network and maintain it. This is
required for best results."
(I'm not a native English speaker either, but I've probably been
speaking and reading it a bit longer than you. Just guessing, and of
course no disrespect meant.)
Only RW can clarify ...
--
Please *no* private copies of mailing list or newsgroup messages.
Local Variables:
mode:claws-external
End:
Re: "more_spam_from" like "more_spam_to"
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>On Wed, 17 Sep 2014 13:43:49 +0100, RW <rw...@googlemail.com> wrote:
>
>RW> A lot of people don't put mailing lists through Spamassassin, most
>RW> of them have already been spam filtered, and to get the best results
>RW> you have to extend your internal network and maintain it.
On 18.09.14 22:09, Ian Zimmerman wrote:
>Do you mean the "trusted_networks" setting here?
no... they do not filter mail from mailing lists through SA.
it is setting in outside spamassassin, usually in MTA, milter or procmail.
trusted_networks is SA configuration setting so it can't be used when SA is
avoided. Also, it has much different meaning than not scanning mail from
those hosts.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 19.09.2014 um 14:42 schrieb Martin Gregorie:
> On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote:
>>> Most DNSBL tests are done on the last relay into the internal network.
>>>
>>> I'm not say this should be done, I'm saying that it's one reason why
>>> scanning mailing list can be more trouble than it's worth
>>
>> but how is that different to any other mail?
>>
> Probably because the last relay (the listserver) can be trusted (almost
> by definition) but its message sources cannot and some mailing lists
> don't check all submissions for spam. IME that applies especially to
> mailing lists that work alongside web forums to provide subscriber
> access by both web browser and e-mail.
>
> Obviously it is as easy to scan incoming e-mails before submitting them
> to the listserver and copying them to the web forum as it is to scan any
> inbound mail stream.
>
> However, it seems to be a lot harder to scan web input before accepting
> it into the forum and copying it to the associated mailing list.
> Consequently, a large proportion of the spam in these combined lists
> seems to be posted via the web forum. While volunteers usually monitor
> for and remove spam from the forum, that doesn't prevent web submitted
> spam from going out on the mailing list before the volunteers can
> recognise and deal with it.
>
> At the same time the web-sourced spam has no header-type information to
> show where it came from before it hit the listserver, so SA checks on it
> are pretty much limited to body, rawbody and URI rules: reliably scoring
> spam from these sources is hard.
that may all be true but don't change anything how a mail is handeled
nor does it bother the topic - no idea why now everybody hangs on
*one example* instead the topic - and no - detect spam from the body
is *not* hard, it works perfectly with the existing tags and bayes
what i want is some levels for sender/sender-domains or rcpt/rcpt-domains
with several negative scores and a simple name in a webinterface working
similar to "more_spam_from" but *more different* and *self defined* levels
frankly the whole question is in the subject and if i have one working example
how to implement that in context of a single user "sa-milter" and assign
domains/mailaddresses to that groups in "local.cf" i can make multiple ones
so can we please stop that endless meta-discussions
* is it possible
* if yes how
i can read the complete documentation and sourcecode for my own
the intention of my question to a ML is "has anybdody done that
before and could provide a working example"
Re: "more_spam_from" like "more_spam_to"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote:
> Am 19.09.2014 um 13:44 schrieb RW:
> > On Thu, 18 Sep 2014 22:09:23 -0700
> > Ian Zimmerman wrote:
> >
> >> On Wed, 17 Sep 2014 13:43:49 +0100,
> >> RW <rw...@googlemail.com> wrote:
> >>
> >> RW> A lot of people don't put mailing lists through Spamassassin, most
> >> RW> of them have already been spam filtered, and to get the best
> >> RW> results you have to extend your internal network and maintain it.
> >>
> >> Do you mean the "trusted_networks" setting here?
> >
> > Most DNSBL tests are done on the last relay into the internal network.
> >
> > I'm not say this should be done, I'm saying that it's one reason why
> > scanning mailing list can be more trouble than it's worth
>
> but how is that different to any other mail?
>
Probably because the last relay (the listserver) can be trusted (almost
by definition) but its message sources cannot and some mailing lists
don't check all submissions for spam. IME that applies especially to
mailing lists that work alongside web forums to provide subscriber
access by both web browser and e-mail.
Obviously it is as easy to scan incoming e-mails before submitting them
to the listserver and copying them to the web forum as it is to scan any
inbound mail stream.
However, it seems to be a lot harder to scan web input before accepting
it into the forum and copying it to the associated mailing list.
Consequently, a large proportion of the spam in these combined lists
seems to be posted via the web forum. While volunteers usually monitor
for and remove spam from the forum, that doesn't prevent web submitted
spam from going out on the mailing list before the volunteers can
recognise and deal with it.
At the same time the web-sourced spam has no header-type information to
show where it came from before it hit the listserver, so SA checks on it
are pretty much limited to body, rawbody and URI rules: reliably scoring
spam from these sources is hard.
Martin
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 19.09.2014 um 13:44 schrieb RW:
> On Thu, 18 Sep 2014 22:09:23 -0700
> Ian Zimmerman wrote:
>
>> On Wed, 17 Sep 2014 13:43:49 +0100,
>> RW <rw...@googlemail.com> wrote:
>>
>> RW> A lot of people don't put mailing lists through Spamassassin, most
>> RW> of them have already been spam filtered, and to get the best
>> RW> results you have to extend your internal network and maintain it.
>>
>> Do you mean the "trusted_networks" setting here?
>
> Most DNSBL tests are done on the last relay into the internal network.
>
> I'm not say this should be done, I'm saying that it's one reason why
> scanning mailing list can be more trouble than it's worth
but how is that different to any other mail?
or how would you imagine to route incoming mailing-list mails
somewhere else than to the MX of the RCPT domain which is
the machine running SA?
it's just a MX which receives a mail from X@Y and IP Z
Re: "more_spam_from" like "more_spam_to"
Posted by RW <rw...@googlemail.com>.
On Thu, 18 Sep 2014 22:09:23 -0700
Ian Zimmerman wrote:
> On Wed, 17 Sep 2014 13:43:49 +0100,
> RW <rw...@googlemail.com> wrote:
>
> RW> A lot of people don't put mailing lists through Spamassassin, most
> RW> of them have already been spam filtered, and to get the best
> RW> results you have to extend your internal network and maintain it.
>
> Do you mean the "trusted_networks" setting here?
Most DNSBL tests are done on the last relay into the internal network.
I'm not say this should be done, I'm saying that it's one reason why
scanning mailing list can be more trouble than it's worth.
Re: "more_spam_from" like "more_spam_to"
Posted by Ian Zimmerman <it...@buug.org>.
On Wed, 17 Sep 2014 13:43:49 +0100,
RW <rw...@googlemail.com> wrote:
RW> A lot of people don't put mailing lists through Spamassassin, most
RW> of them have already been spam filtered, and to get the best results
RW> you have to extend your internal network and maintain it.
Do you mean the "trusted_networks" setting here?
I do sometimes get spam from lists, and so far I have been feeding list
traffic to SA just like everything else. It doesn't seem to have any
adverse effects. My trusted_networks is set to just the MX host.
--
Please *no* private copies of mailing list or newsgroup messages.
Local Variables:
mode:claws-external
End:
Re: "more_spam_from" like "more_spam_to"
Posted by Jesse Norell <je...@kci.net>.
On Wed, 2014-09-17 at 16:47 +0200, Axb wrote:
> On 09/17/2014 04:27 PM, Jesse Norell wrote:
> <snip>
>
>
> > Just a thought - maybe a config setting to not do automatic bayes
> > training for a give from/to addr would be more appropriate? Say a meta
> > rule (more a "flag" but I don't know enough SA rules to know if those
> > exist) that you set in your own rules.
> >
> > Eg. disable all automatic training for these addrs:
> >
> > no_bayes_from whatever@list.com
> > no_bayes_to other@list.com
> >
> > That would be reusable in other rules/places if appropriate
>
> something like this?
>
> tflags RULE_NAME userconf noautolearn
Yeah, something like that. :) Sounds like the concern isn't just
feeding bad info to bayes though, but maybe this would be usable for
Harald as part of the generated local.cf rules.
--
Jesse Norell
Kentec Communications, Inc.
970-522-8107 - www.kci.net
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.09.2014 um 23:51 schrieb RW:
> On Wed, 17 Sep 2014 17:24:10 +0200
> Reindl Harald wrote:
>> please read my previous message
>>
>> what i asked is careful considered and exactly what i need
>> even if you could reach something similar with other ways
>> because the admin backend needs to be understood by other
>> persons too and finaly what can be done even by non-tech
>> people so they can give answers to endusers
>>
>> * a few rules with free chosen names and assigned scores
>> * the possibility to assign them to senders or sender-domains
>> * the possibility to assign them to rcpt or rcpt-domains
>
> As I told you before you can already do this if you are autogenerating
> rules for global configuration - just generate ordinary SpamAssassin
> rules
the *how* is the question and you talked about ~/.spamassassin
which just don't exist in the environment, i know the same now
as i started the thread "it is likely possible somehow"
_______________________________________
so *how* create rules itself defining "to_trust_1", "to_trust_2"
"to_trust_3", "from_trust_1", "from_trust_2" and assign them
a score level?
to_trust_1 imaginary1@example.com
to_trust_1 imaginary2@example.com
to_trust_2 imaginary3@example.com
to_trust_3 imaginary4@example.com
from_trust_1 sender1@example.net
from_trust_2 sender2@example.net
from_trust_3 sender3@example.net
from_trust_3 sender4@example.net
is it really that hard to understand that i seek for an example
_______________________________________
>>> as usal the cronjob builds "local.cf" from a template and that
>>> settings
>>
>> If you are going to autogenerate them into local.cf you can generate
>> header rules just as easily. The chief advantage of what you are
>> asking for would be for users to set in ~/.spamassassin.
Re: "more_spam_from" like "more_spam_to"
Posted by RW <rw...@googlemail.com>.
On Wed, 17 Sep 2014 17:24:10 +0200
Reindl Harald wrote:
> please read my previous message
>
> what i asked is careful considered and exactly what i need
> even if you could reach something similar with other ways
> because the admin backend needs to be understood by other
> persons too and finaly what can be done even by non-tech
> people so they can give answers to endusers
>
> * a few rules with free chosen names and assigned scores
> * the possibility to assign them to senders or sender-domains
> * the possibility to assign them to rcpt or rcpt-domains
As I told you before you can already do this if you are autogenerating
rules for global configuration - just generate ordinary SpamAssassin
rules.
They kind of globing rule you are asking for is for the benefit of end
users who are not allowed to use regular expressions rules in their per
user configuration or don't understand regular expressions.
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.09.2014 um 16:47 schrieb Axb:
> On 09/17/2014 04:27 PM, Jesse Norell wrote:
> <snip>
>
>> Just a thought - maybe a config setting to not do automatic bayes
>> training for a give from/to addr would be more appropriate? Say a meta
>> rule (more a "flag" but I don't know enough SA rules to know if those
>> exist) that you set in your own rules.
>>
>> Eg. disable all automatic training for these addrs:
>>
>> no_bayes_from whatever@list.com
>> no_bayes_to other@list.com
>>
>> That would be reusable in other rules/places if appropriate
>
> something like this?
>
> tflags RULE_NAME userconf noautolearn
please read my previous message
what i asked is careful considered and exactly what i need
even if you could reach something similar with other ways
because the admin backend needs to be understood by other
persons too and finaly what can be done even by non-tech
people so they can give answers to endusers
* a few rules with free chosen names and assigned scores
* the possibility to assign them to senders or sender-domains
* the possibility to assign them to rcpt or rcpt-domains
that's nothing highly important now but given that myself
had to whitelist a sender recently it may become relevant
while i would not completly whitelist because some other
says "they are trustable and don't send junk"
hence the scoring in different levels to look what score
was reached, why, adjust as needed and have some existing
dropdown options to adjust without touch the code of
admin-backends and cronjobs repeatly
Re: "more_spam_from" like "more_spam_to"
Posted by Axb <ax...@gmail.com>.
On 09/17/2014 04:27 PM, Jesse Norell wrote:
<snip>
> Just a thought - maybe a config setting to not do automatic bayes
> training for a give from/to addr would be more appropriate? Say a meta
> rule (more a "flag" but I don't know enough SA rules to know if those
> exist) that you set in your own rules.
>
> Eg. disable all automatic training for these addrs:
>
> no_bayes_from whatever@list.com
> no_bayes_to other@list.com
>
> That would be reusable in other rules/places if appropriate
something like this?
tflags RULE_NAME userconf noautolearn
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.09.2014 um 16:27 schrieb Jesse Norell:
> On Wed, 2014-09-17 at 14:54 +0200, Reindl Harald wrote:
>> Am 17.09.2014 um 14:43 schrieb RW:
>>> On Wed, 17 Sep 2014 11:50:43 +0200
>>> Reindl Harald wrote:
>>>
>>>> what i want to achieve is 4 levels of negative score for
>>>> both - FROM and TO just because it makes sense to handle
>>>> some mailing lists different without whitelist them completly
>>>> and the same for different RCPT, one user is living in asia
>>>> and needs complete different settings
>>>>
>>>> there is also a need to handle "securityfocus" ML different
>>>> to "postfix-users" without completly whitelist them
>>>
>>> A lot of people don't put mailing lists through Spamassassin, most of
>>> them have already been spam filtered, and to get the best results you
>>> have to extend your internal network and maintain it. And in my
>>> experience most list related spam is off-list anyway.
>>
>> that's a mail gateway delivering to different destination servers
>> for a bundle of domains - the problem is not list-related spam, the
>> problem is get a high score for discussions about spam which you
>> don't want to feed as positive into bayes
>
> Just a thought - maybe a config setting to not do automatic bayes
> training for a give from/to addr would be more appropriate? Say a meta
> rule (more a "flag" but I don't know enough SA rules to know if those
> exist) that you set in your own rules.
>
> Eg. disable all automatic training for these addrs:
>
> no_bayes_from whatever@list.com
> no_bayes_to other@list.com
>
> That would be reusable in other rules/places if appropriate.
automatic training is in general disabled
i maintain the bayes manually with for now 1500 spam as well ham samples
i really "need" what i asked for by looking at the userbase
and real world mail flow affecting my own messages
having the option to create rules for add different negative
scores based on sender/sender-domain as well as rcpt/rcpt-domain
the point is that i had yesterday myself two postfix-users
messages which hitted *exactly* the milter reject score
with a BAYES_00 because unluckily triggered 4 URIBL rules
at once
so i do not want to whitelist the sender in general or adjust the WL
score to match that two messages but take away the *real* WL option
and since the whole system is based on scores including 4 internal
DNSWL lists with different trust-levels and scores for postscreen
as well as SA i want to continue the score/trust-level approch instead
blind whitelisting
means i want 4 to 6 "trust-levels" in a already existing dropdown in
the WebUI and replace the "yes/no" option with that, for senders as
well as RCPT
that way i could adjust that scores in "local.cf" as time shows it's
needed while any other operator just selects named options without
care about scores
in the end the names/labels and scores of them needs to be careful
considered, just not now without knowing how and even if to implement
it at the end
what i design here is a complete solution for a inbound gateway
for a unknown count of destination servers maintainable by somebody
not need to know the implementation details - better said
"i desigend" because it is working for some weeks now nearly
perfect - just here and there wishes to adjust behavior
selective and careful instead "whitelist" or "block"
>> don't get me wrong but i spent really a lot of hours to consider
>> the environment which is nearly perfect and designed around 10
>> years expierience with the userbase and other solutions
>>
>> just some wishes for extensions i would like to be able to
>> do myself and all about scoring "whitelist_from" is not
>> enough or goes too far
>>
>> SA is only a very small piece of the complete system
>>
>>>> finally offer in the existing webinterface (self-written) a drop-down
>>>> for each listed address/domain as well as define the score for each
>>>> level in the general settings to adjust
>>>>
>>>> as usal the cronjob builds "local.cf" from a template and that
>>>> settings
>>>
>>> If you are going to autogenerate them into local.cf you can generate
>>> header rules just as easily. The chief advantage of what you are
>>> asking for would be for users to set in ~/.spamassassin.
>>
>> running as milter with a milter user and it's global bayes
>> there is no users setting - just a global system maintained centralized
>>
>>>> score USER_IN_MOST_SPAM_FROM -4
>>>> header USER_IN_MOST_SPAM_FROM
>>>> eval:check_from('USER_IN_MOST_SPAM_FROM')
>>>>
>>>> score USER_IN_ALMOST_ALL_SPAM_FROM -6
>>>> header USER_IN_ALMOST_ALL_SPAM_FROM
>>>> eval:check_from('USER_IN_ALMOST_ALL_SPAM_FROM')
>>>
>>> The terminology seems a bit defeatist. Would you really let through
>>> almost all spam at a threshold of 11.0?
>>
>> forget the terminology and the score points
>>
>> the point what i am asking for is removed in the quote:
>>
>> * implement several "WL" score levels based on sender
>> * implement several "WL" score levels based on RCPT
Re: "more_spam_from" like "more_spam_to"
Posted by Jesse Norell <je...@kci.net>.
On Wed, 2014-09-17 at 14:54 +0200, Reindl Harald wrote:
> Am 17.09.2014 um 14:43 schrieb RW:
> > On Wed, 17 Sep 2014 11:50:43 +0200
> > Reindl Harald wrote:
> >
> >> what i want to achieve is 4 levels of negative score for
> >> both - FROM and TO just because it makes sense to handle
> >> some mailing lists different without whitelist them completly
> >> and the same for different RCPT, one user is living in asia
> >> and needs complete different settings
> >>
> >> there is also a need to handle "securityfocus" ML different
> >> to "postfix-users" without completly whitelist them
> >
> > A lot of people don't put mailing lists through Spamassassin, most of
> > them have already been spam filtered, and to get the best results you
> > have to extend your internal network and maintain it. And in my
> > experience most list related spam is off-list anyway.
>
> that's a mail gateway delivering to different destination servers
> for a bundle of domains - the problem is not list-related spam, the
> problem is get a high score for discussions about spam which you
> don't want to feed as positive into bayes
Just a thought - maybe a config setting to not do automatic bayes
training for a give from/to addr would be more appropriate? Say a meta
rule (more a "flag" but I don't know enough SA rules to know if those
exist) that you set in your own rules.
Eg. disable all automatic training for these addrs:
no_bayes_from whatever@list.com
no_bayes_to other@list.com
That would be reusable in other rules/places if appropriate.
Jesse
> don't get me wrong but i spent really a lot of hours to consider
> the environment which is nearly perfect and designed around 10
> years expierience with the userbase and other solutions
>
> just some wishes for extensions i would like to be able to
> do myself and all about scoring "whitelist_from" is not
> enough or goes too far
>
> SA is only a very small piece of the complete system
>
> >> finally offer in the existing webinterface (self-written) a drop-down
> >> for each listed address/domain as well as define the score for each
> >> level in the general settings to adjust
> >>
> >> as usal the cronjob builds "local.cf" from a template and that
> >> settings
> >
> > If you are going to autogenerate them into local.cf you can generate
> > header rules just as easily. The chief advantage of what you are
> > asking for would be for users to set in ~/.spamassassin.
>
> running as milter with a milter user and it's global bayes
> there is no users setting - just a global system maintained centralized
>
> >> score USER_IN_MOST_SPAM_FROM -4
> >> header USER_IN_MOST_SPAM_FROM
> >> eval:check_from('USER_IN_MOST_SPAM_FROM')
> >>
> >> score USER_IN_ALMOST_ALL_SPAM_FROM -6
> >> header USER_IN_ALMOST_ALL_SPAM_FROM
> >> eval:check_from('USER_IN_ALMOST_ALL_SPAM_FROM')
> >
> > The terminology seems a bit defeatist. Would you really let through
> > almost all spam at a threshold of 11.0?
>
> forget the terminology and the score points
>
> the point what i am asking for is removed in the quote:
>
> * implement several "WL" score levels based on sender
> * implement several "WL" score levels based on RCPT
>
--
Jesse Norell
Kentec Communications, Inc.
970-522-8107 - www.kci.net
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.09.2014 um 14:43 schrieb RW:
> On Wed, 17 Sep 2014 11:50:43 +0200
> Reindl Harald wrote:
>
>> what i want to achieve is 4 levels of negative score for
>> both - FROM and TO just because it makes sense to handle
>> some mailing lists different without whitelist them completly
>> and the same for different RCPT, one user is living in asia
>> and needs complete different settings
>>
>> there is also a need to handle "securityfocus" ML different
>> to "postfix-users" without completly whitelist them
>
> A lot of people don't put mailing lists through Spamassassin, most of
> them have already been spam filtered, and to get the best results you
> have to extend your internal network and maintain it. And in my
> experience most list related spam is off-list anyway.
that's a mail gateway delivering to different destination servers
for a bundle of domains - the problem is not list-related spam, the
problem is get a high score for discussions about spam which you
don't want to feed as positive into bayes
don't get me wrong but i spent really a lot of hours to consider
the environment which is nearly perfect and designed around 10
years expierience with the userbase and other solutions
just some wishes for extensions i would like to be able to
do myself and all about scoring "whitelist_from" is not
enough or goes too far
SA is only a very small piece of the complete system
>> finally offer in the existing webinterface (self-written) a drop-down
>> for each listed address/domain as well as define the score for each
>> level in the general settings to adjust
>>
>> as usal the cronjob builds "local.cf" from a template and that
>> settings
>
> If you are going to autogenerate them into local.cf you can generate
> header rules just as easily. The chief advantage of what you are
> asking for would be for users to set in ~/.spamassassin.
running as milter with a milter user and it's global bayes
there is no users setting - just a global system maintained centralized
>> score USER_IN_MOST_SPAM_FROM -4
>> header USER_IN_MOST_SPAM_FROM
>> eval:check_from('USER_IN_MOST_SPAM_FROM')
>>
>> score USER_IN_ALMOST_ALL_SPAM_FROM -6
>> header USER_IN_ALMOST_ALL_SPAM_FROM
>> eval:check_from('USER_IN_ALMOST_ALL_SPAM_FROM')
>
> The terminology seems a bit defeatist. Would you really let through
> almost all spam at a threshold of 11.0?
forget the terminology and the score points
the point what i am asking for is removed in the quote:
* implement several "WL" score levels based on sender
* implement several "WL" score levels based on RCPT
Re: "more_spam_from" like "more_spam_to"
Posted by RW <rw...@googlemail.com>.
On Wed, 17 Sep 2014 11:50:43 +0200
Reindl Harald wrote:
> what i want to achieve is 4 levels of negative score for
> both - FROM and TO just because it makes sense to handle
> some mailing lists different without whitelist them completly
> and the same for different RCPT, one user is living in asia
> and needs complete different settings
>
> there is also a need to handle "securityfocus" ML different
> to "postfix-users" without completly whitelist them
A lot of people don't put mailing lists through Spamassassin, most of
them have already been spam filtered, and to get the best results you
have to extend your internal network and maintain it. And in my
experience most list related spam is off-list anyway.
> finally offer in the existing webinterface (self-written) a drop-down
> for each listed address/domain as well as define the score for each
> level in the general settings to adjust
>
> as usal the cronjob builds "local.cf" from a template and that
> settings
If you are going to autogenerate them into local.cf you can generate
header rules just as easily. The chief advantage of what you are
asking for would be for users to set in ~/.spamassassin.
> score USER_IN_MOST_SPAM_FROM -4
> header USER_IN_MOST_SPAM_FROM
> eval:check_from('USER_IN_MOST_SPAM_FROM')
>
> score USER_IN_ALMOST_ALL_SPAM_FROM -6
> header USER_IN_ALMOST_ALL_SPAM_FROM
> eval:check_from('USER_IN_ALMOST_ALL_SPAM_FROM')
The terminology seems a bit defeatist. Would you really let through
almost all spam at a threshold of 11.0?
Re: "more_spam_from" like "more_spam_to"
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.09.2014 um 11:31 schrieb Axb:
> On 09/17/2014 10:51 AM, Reindl Harald wrote:
>> Hi
>>
>> for some mailing-lists a "more_spam_from" would make
>> sense instead whitelist a sender- is there a rule i
>> don't see or has somebody a working one for "local.cf"?
>>
>> honestly i would like to have 4 options depending
>> on sender or RCPT
>>
>> * more_spam (-2)
>> * most_spam (-4)
>> * lot_of_spam (-6)
>> * all_spam (-100)
>
> http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.txt
>
> more_spam_to
> more_spam_to users@spamassassin.apache.org
yes - i mentioned that in my subject, but i asked for "more_spam_FROM"
instead just whitelist senders that seems to be defined all in
"WLBLEval.pm" which is a little bit unlucky to extend
what i want to achieve is 4 levels of negative score for
both - FROM and TO just because it makes sense to handle
some mailing lists different without whitelist them completly
and the same for different RCPT, one user is living in asia
and needs complete different settings
there is also a need to handle "securityfocus" ML different
to "postfix-users" without completly whitelist them
finally offer in the existing webinterface (self-written) a drop-down for
each listed address/domain as well as define the score for each level in
the general settings to adjust
as usal the cronjob builds "local.cf" from a template and that settings
not pissible taht way but below how i imagine that
____________________________________________________________________
score USER_IN_MORE_SPAM_TO -2
header USER_IN_MORE_SPAM_TO eval:check_to('USER_IN_MORE_SPAM_TO')
score USER_IN_MOST_SPAM_TO -4
header USER_IN_MOST_SPAM_TO eval:check_to('USER_IN_MOST_SPAM_TO')
score USER_IN_ALMOST_ALL_SPAM_TO -6
header USER_IN_ALMOST_ALL_SPAM_TO eval:check_to('USER_IN_ALMOST_ALL_SPAM_TO')
score USER_IN_ALL_SPAM_TO -100
header USER_IN_ALL_SPAM_TO eval:check_to('USER_IN_ALL_SPAM_TO')
____________________________________________________________________
score USER_IN_MORE_SPAM_FROM -2
header USER_IN_MORE_SPAM_FROM eval:check_from('USER_IN_MORE_SPAM_FROM')
score USER_IN_MOST_SPAM_FROM -4
header USER_IN_MOST_SPAM_FROM eval:check_from('USER_IN_MOST_SPAM_FROM')
score USER_IN_ALMOST_ALL_SPAM_FROM -6
header USER_IN_ALMOST_ALL_SPAM_FROM eval:check_from('USER_IN_ALMOST_ALL_SPAM_FROM')
score USER_IN_ALL_SPAM_FROM -100
header USER_IN_ALL_SPAM_FROM eval:check_from('USER_IN_ALL_SPAM_FROM')
____________________________________________________________________
Re: "more_spam_from" like "more_spam_to"
Posted by Axb <ax...@gmail.com>.
On 09/17/2014 10:51 AM, Reindl Harald wrote:
> Hi
>
> for some mailing-lists a "more_spam_from" would make
> sense instead whitelist a sender- is there a rule i
> don't see or has somebody a working one for "local.cf"?
>
> honestly i would like to have 4 options depending
> on sender or RCPT
>
> * more_spam (-2)
> * most_spam (-4)
> * lot_of_spam (-6)
> * all_spam (-100)
>
http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.txt
more_spam_to
more_spam_to users@spamassassin.apache.org