You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Scheidell <sc...@secnap.net> on 2009/01/22 17:51:34 UTC
SAs vbounce and autolearn
Just found out why, all of a sudden, users who never got blocked, now
are getting blocked.
Christmas, these brilliant people set up 'I am out of the office'
messages, which spamassassin 'vbounce' sees as a 'bounce'.
(seriously, is a OOO backscatter?)
if you don't set tflags noautolearn on your vbounce scoring rules, then
when the luser gets back from grandmas house and sends you an email, it
get scored really high.
Did I miss something in the documentation? or didn't I just think it
through?
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* King of Spam Filters, SC Magazine 2008
* Information Security Award 2008, Info Security Products Guide
* CRN Magazine Top 40 Emerging Security Vendors
* Finalist 2009 Network Products Guide Hot Companies
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________
Re: SAs vbounce and autolearn
Posted by Michael Scheidell <sc...@secnap.net>.
99 too high??? :-[
(amavisd as a 'bounce_killer_score' that is 100 in the
amavisd.conf-dist). does something similar.
Justin Mason wrote:
> have you changed the score of the vbounce rules from 0.1? this is why
> you shouldn't ;)
>
> --j.
>
> On Thu, Jan 22, 2009 at 16:51, Michael Scheidell <sc...@secnap.net> wrote:
>
>> Just found out why, all of a sudden, users who never got blocked, now are
>> getting blocked.
>>
>> Christmas, these brilliant people set up 'I am out of the office' messages,
>> which spamassassin 'vbounce' sees as a 'bounce'.
>> (seriously, is a OOO backscatter?)
>>
>> if you don't set tflags noautolearn on your vbounce scoring rules, then when
>> the luser gets back from grandmas house and sends you an email, it get
>> scored really high.
>>
>> Did I miss something in the documentation? or didn't I just think it
>> through?
>>
>>
>> --
>> Michael Scheidell, CTO
>> Phone: 561-999-5000, x 1259
>>
>>> | SECNAP Network Security Corporation
>>>
>> Certified SNORT Integrator
>> King of Spam Filters, SC Magazine 2008
>> Information Security Award 2008, Info Security Products Guide
>> CRN Magazine Top 40 Emerging Security Vendors
>> Finalist 2009 Network Products Guide Hot Companies
>>
>> ________________________________
>>
>> This email has been scanned and certified safe by SpammerTrap(R).
>> For Information please see www.secnap.com/products/spammertrap/
>>
>> ________________________________
>>
>>
>
>
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* King of Spam Filters, SC Magazine 2008
* Information Security Award 2008, Info Security Products Guide
* CRN Magazine Top 40 Emerging Security Vendors
* Finalist 2009 Network Products Guide Hot Companies
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
_________________________________________________________________________
Re: SAs vbounce and autolearn
Posted by Justin Mason <jm...@jmason.org>.
have you changed the score of the vbounce rules from 0.1? this is why
you shouldn't ;)
--j.
On Thu, Jan 22, 2009 at 16:51, Michael Scheidell <sc...@secnap.net> wrote:
> Just found out why, all of a sudden, users who never got blocked, now are
> getting blocked.
>
> Christmas, these brilliant people set up 'I am out of the office' messages,
> which spamassassin 'vbounce' sees as a 'bounce'.
> (seriously, is a OOO backscatter?)
>
> if you don't set tflags noautolearn on your vbounce scoring rules, then when
> the luser gets back from grandmas house and sends you an email, it get
> scored really high.
>
> Did I miss something in the documentation? or didn't I just think it
> through?
>
>
> --
> Michael Scheidell, CTO
> Phone: 561-999-5000, x 1259
>> | SECNAP Network Security Corporation
>
> Certified SNORT Integrator
> King of Spam Filters, SC Magazine 2008
> Information Security Award 2008, Info Security Products Guide
> CRN Magazine Top 40 Emerging Security Vendors
> Finalist 2009 Network Products Guide Hot Companies
>
> ________________________________
>
> This email has been scanned and certified safe by SpammerTrap(R).
> For Information please see www.secnap.com/products/spammertrap/
>
> ________________________________
>