You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by ttgh <to...@goldenhour.com> on 2015/02/16 18:44:57 UTC
train filter based on spam to ex-employees?
We get 'waves' of spam which are addressed to both long-time employees
(usually executives) as well as long-gone employees. It's safe to say that
ANYTHING sent to those ex-employees is spam but how do I use those messages
as an instant filter for the valid addressees?
I assume I need to learn how to use the Bayesian filter but I've been
avoiding that because of the apparent effort required to maintain it. Also
I'm concerned that there won't be a quick enough turnaround on filtering,
e.g. if 10 copies of a new spam arrive and the first several instances are
addressed to current employees, they will 'pass' the filter before the
known-bad addressees get scanned and added to the filter.
I should also point-out that our SA setup is acting as relay to an internal
server so once messages are passed they are no longer accessible to SA,
i.e., we're running Postfix but only as a relay not as the primary mail
store.
Thank you for any suggestions!
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: train filter based on spam to ex-employees?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 16.02.15 10:44, ttgh wrote:
>We get 'waves' of spam which are addressed to both long-time employees
>(usually executives) as well as long-gone employees. It's safe to say that
>ANYTHING sent to those ex-employees is spam but how do I use those messages
>as an instant filter for the valid addressees?
no. But any bulk mail sent to more than one or two such mailboxes is most
likely spam. Checking with something like local pyzor or DCC server could
help you much.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
There's a long-standing bug relating to the x86 architecture that
allows you to install Windows. -- Matthew D. Fuller
Re: train filter based on spam to ex-employees?
Posted by Antony Stone <An...@spamassassin.open.source.it>.
On Monday 16 Feb 2015 at 20:16, ttgh wrote:
> >> i saw last week a mail to our previous front-office which left
> >> the company in 2007 and i know the sender in person - it was not spam,
> >> he just replied to a years old message for whatever reason
>
> Thank you, that's an excellent point. In your example, however, I would
> point-out that your front-office person was someone tasked with
> communicating with outside contacts. Also, that their email was still
> being monitored.
I wonder what makes you believe that all email to your ex-employee accounts
qualifies as "spam".
Of course, that also begs the question of what you are defining as spam.
In general I am in agreement with most of the opinions which have been
expressed in this thread - that automatically using email sent to previously
valid but now defunct addresses as examples of spam is a bad idea. I also
agree that trying to do this without Bayes is ridiculous.
However I am getting the impression that you may have a different definition
of "spam" from some of the people providing answers to your question, and I
therefore think it would be useful to give as precise a definition as you can
of what email, exactly, you are trying to block.
Note that "blocking email to the now-unused addresses" would not be a helpful
definition, because this would be a simple filter at the receiving MTA
(indeed, why is your MTA still accepting to no-longer-valid addresses?),
whereas you appear to be wanting to use the emails sent to those addresses to
block something or other which is being sent to your still-valid addresses.
Therefore I ask myself "what is there in common between the emails you get to
the no-longer-valid addresses (which you could just throw away immediately if
you wanted to) and the emails you get to the currently-valid addresses (and
you appear to be trying to filter, based on something to do with the first
set)?"
I think the discussions back and forth so far have possibly suffered from
different sides having different ideas about what the objective is here.
Regards,
Antony.
--
Ramdisk is not an installation procedure.
Please reply to the list;
please *don't* CC me.
Re: train filter based on spam to ex-employees?
Posted by Reindl Harald <h....@thelounge.net>.
Am 16.02.2015 um 21:16 schrieb ttgh:
>>> i saw last week a mail to our previous front-office which left
>>> the company in 2007 and i know the sender in person - it was not spam,
>>> he just replied to a years old message for whatever reason
>
> Thank you, that's an excellent point. In your example, however, I would
> point-out that your front-office person was someone tasked with
> communicating with outside contacts. Also, that their email was still being
> monitored.
surely she was communiacting with outside contacts
no, the mail was not monitored, i am just one of this admins reading
maillogs as well as all other logs of services i am responsible for
frankly we killed by advise of a customer around 10000 mail-accounts a
year ago and there are still fabcebook and twitter notifies to these for
months rejected acounts
that's the reality and i would be careful to pretend that for address
XYZ that won't happen - the last newsletter to our primary contact
address aliased to the whole company i killed was from a front-office i
needed to google to get confirmed the person worked here
it was a regular newsletter subscription, i called the sender and he
told me a name - given that i am now working 1 years here you know the
big picture?
Re: train filter based on spam to ex-employees?
Posted by Reindl Harald <h....@thelounge.net>.
Am 17.02.2015 um 00:54 schrieb ttgh:
> @Antony, I particularly appreciated your response (and the spelling of your
> name). To clarify: I am not saying that all messages to ALL ex-staff are
> spam, only the messages to specific ex-staff. Also, this email server is
> acting as relay/filter for an internal Exchange server and does not have a
> list of still-valid internal accounts so until recently it accepted and
> scanned any message, even to long-gone employees. (And then wasted time
> trying to send the polite 'Unknown user' reply from Exchange.)
than just fix your exchange to response correctly for nvalid users and
enable http://www.postfix.org/ADDRESS_VERIFICATION_README.html on your
MX - voila now it knows valid accounts - you should always solve
problems where they exists and not screw around them
skip_rcpt_verification.cf in the config below contains domains where we
know the RCPT and given that all targets where we don't know are a
wildcahrd on the postfix server "reject_unlisted_recipient" is finein
the relay restrictions
unverified_recipient_reject_code = 550
unverified_recipient_reject_reason = Recipient address lookup failed
address_verify_positive_expire_time = 24h
address_verify_positive_refresh_time = 12h
address_verify_negative_expire_time = 2h
address_verify_negative_refresh_time = 1h
address_verify_poll_delay = 5s
smtpd_relay_restrictions =
reject_unlisted_recipient
reject_unauth_destination
reject_non_fqdn_recipient
reject_non_fqdn_sender
check_recipient_access proxy:hash:/etc/postfix/skip_rcpt_verification.cf
reject_unverified_recipient
Re: train filter based on spam to ex-employees?
Posted by ttgh <to...@goldenhour.com>.
Thank you, all, those are excellent examples.
@Antony, I particularly appreciated your response (and the spelling of your
name). To clarify: I am not saying that all messages to ALL ex-staff are
spam, only the messages to specific ex-staff. Also, this email server is
acting as relay/filter for an internal Exchange server and does not have a
list of still-valid internal accounts so until recently it accepted and
scanned any message, even to long-gone employees. (And then wasted time
trying to send the polite 'Unknown user' reply from Exchange.) I have now
implemented the Postfix recipient blacklist to drop messages intended for
those long-gone employees; my idea here was to unblock them and instead feed
them into a learning filter as known-spam.
FYI - Currently our edge server only blocks about 80% of incoming spam. (In
my own defense, I inherited this server and sans any configuration notes.)
The other 20% passes UNTOUCHED through our 3 RBLs, SA, ClamAV, Razor and
Pyzor. Our success rate is so low I first had to confirm that every element
of this open-source solution was working, e.g. I see X-Score rules from SA,
Razor and Pyzor. I also confirmed that SA is checking daily, then
downloading any updated rules from updates.spamassassin.org. There may very
well be something misconfigured in our system but I haven't been able to
find it. (I did find a redundant SA rule-set from SARE circa 2010 which I
removed, reducing our false-positives.)
@Matus, I appreciate the suggestion about a local Pyzor server! I'm not
sure how to implement that but it sounds like a good idea. Is it simpler
than enabling Bayes and training it with 1000s of ham/spam?
I reviewed my notes re Pyzor and updated local.cf to ensure its using a
newly-updated "servers" file. I had never run the Pyzor 'discover' command
but some of our spam was already being tagged with PYZOR_CHECK=1.985 so I
assumed it was working properly.
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546p114570.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: train filter based on spam to ex-employees?
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Mon, 16 Feb 2015, ttgh wrote:
>>> i saw last week a mail to our previous front-office which left
>>> the company in 2007 and i know the sender in person - it was not spam,
>>> he just replied to a years old message for whatever reason
>
> Thank you, that's an excellent point. In your example, however, I would
> point-out that your front-office person was someone tasked with
> communicating with outside contacts. Also, that their email was still being
> monitored.
>
What if your peon (non front-office person) was subscribed to e-mail notices
from some business (say like a travel/airline company). And they dust off
some old lists and send a note "say, we haven't heard from you in a while,
would you be interested in a good deal on some tickets". Do you want to
spam-learn potentially legitmate messages (the employee did request such
info, so it's not unsolicited-bulk)?
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: train filter based on spam to ex-employees?
Posted by ttgh <to...@goldenhour.com>.
>> i saw last week a mail to our previous front-office which left
>> the company in 2007 and i know the sender in person - it was not spam,
>> he just replied to a years old message for whatever reason
Thank you, that's an excellent point. In your example, however, I would
point-out that your front-office person was someone tasked with
communicating with outside contacts. Also, that their email was still being
monitored.
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546p114563.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: train filter based on spam to ex-employees?
Posted by Reindl Harald <h....@thelounge.net>.
Am 16.02.2015 um 20:53 schrieb ttgh:
> Also I still don't understand why everyone is so reticent to immediately
> black-list messages based on these 100% known-bad addressess. For instance,
> is it possible for a bulk spam message to trigger false positives?
because we all may have long years expierience?
frankly i saw last week a mail to our previous front-office which left
the company in 2007 and i know the sender in person - it was not spam,
he just replied to a years old message for whatever reason
do what you want - but i for myself will only use previous existing mail
accounts as spamtrap over my dead body
Re: train filter based on spam to ex-employees?
Posted by John Hardin <jh...@impsec.org>.
On Mon, 16 Feb 2015, ttgh wrote:
> John, by 'spam corpus' are you referring to the 'spam' side of the Bayesian
> filter?
Correct.
> If we manually delay/review these known-bad accounts are we creating a
> window of opportunity for those same messages to pass through to current
> users?
To a degree, yes. You have to weigh that against the impact of false
positives.
> I've been assuming we would need to create an intentional delay (e.g. 60
> second) on all Amavis processing,
I don't see the need for that.
> combined with an exception for the known-bad addresses wherein they
> would immediately get added to the Bayesian filter. Does the Bayesian
> update in real-time as you feed it new spam or do you need to request a
> periodic rebuild?
It updates in real time if you have the autolearn option enabled. I don't
use it (my user base is tiny) so others would have to provide practical
advice on that.
> Also I still don't understand why everyone is so reticent to immediately
> black-list messages based on these 100% known-bad addressess.
Because very little in the real world is 100% guaranteed, and it's
generally felt better to get a few more spams than it is to misclassify
and possibly lose hams.
> For instance, is it possible for a bulk spam message to trigger false
> positives?
It depends. If you're in the pharmaceuticals business, potentially yes. :)
> There is zero concern about valid company clients/contacts mistakenly
> emailing these ex-employees, e.g. these were entry-level staff who did not
> interact with clients and just used their office email for personal use (and
> got themselves onto lots of spam lists in the process).
Okay, that does sound like a reasonably safe source, then.
> I mean, we literally are 100% positive their incoming email is spam...
Well, if you're confident, then proceed. Give yourself a way to recover,
though.
Forward mail for the "honeypot" mailboxes to your spam corpus mailbox and
train from that, running sa-learn on a schedule depending on volume
(hourly, every few hours, on down to once daily). Rotate the spam corpus
mailbox daily or weekly to reduce the work sa-learn has to do wading
through old messages, but do retain the historical mailboxes so you can
review and reclassify messages (i.e. retrain as ham) if necessary.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...for a nation to tax itself into prosperity is like a man
standing in a bucket and trying to lift himself up by the handle.
-- Winston Churchill
-----------------------------------------------------------------------
6 days until George Washington's 283rd Birthday
Re: train filter based on spam to ex-employees?
Posted by ttgh <to...@goldenhour.com>.
John, by 'spam corpus' are you referring to the 'spam' side of the Bayesian
filter? If we manually delay/review these known-bad accounts are we
creating a window of opportunity for those same messages to pass through to
current users?
I've been assuming we would need to create an intentional delay (e.g. 60
second) on all Amavis processing, combined with an exception for the
known-bad addresses wherein they would immediately get added to the Bayesian
filter. Does the Bayesian update in real-time as you feed it new spam or do
you need to request a periodic rebuild?
___________
Also I still don't understand why everyone is so reticent to immediately
black-list messages based on these 100% known-bad addressess. For instance,
is it possible for a bulk spam message to trigger false positives?
There is zero concern about valid company clients/contacts mistakenly
emailing these ex-employees, e.g. these were entry-level staff who did not
interact with clients and just used their office email for personal use (and
got themselves onto lots of spam lists in the process). Also, we can pick
ex-staff who have been gone more than 5 years if necessary. I mean, we
literally are 100% positive their incoming email is spam...
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546p114558.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: train filter based on spam to ex-employees?
Posted by John Hardin <jh...@impsec.org>.
On Mon, 16 Feb 2015, ttgh wrote:
> Reindl, thank you for the reply but in our situation we have 100% confidence
> that these old addressees are spam. In any case, that's our risk to bear.
> Can you offer any suggestions on how to use these old addressees as a
> 'honeypot' or even an outright ban list? (I'm not sure what the technical
> description should be.)
Even if you're 100% confident, it's a bad idea to feed them into your spam
corpus blindly. Capture them and every couple of days review them and if
they really are spam transfer them to your vetted spam corpus. Then train
from that.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
News flash: Lowest Common Denominator down 50 points
-----------------------------------------------------------------------
6 days until George Washington's 283rd Birthday
Re: train filter based on spam to ex-employees?
Posted by Reindl Harald <h....@thelounge.net>.
Am 16.02.2015 um 19:10 schrieb ttgh:
> Reindl, thank you for the reply but in our situation we have 100% confidence
> that these old addressees are spam. In any case, that's our risk to bear.
> Can you offer any suggestions on how to use these old addressees as a
> 'honeypot' or even an outright ban list? (I'm not sure what the technical
> description should be.)
in no way since you refuse to use bayes and frankly a spamfilter without
bayes won't work well at all - otherwise you could forward all these
acccounts to a central account and after *manual review* train bayes
with the messages
and no - a global bayes for spamass-milter is not that hard to maintain,
in doubt you need 200 ham and 200 spam examples to get it start
reasonable well and that will help you greatly because all other users
benfit from the training messages you get to that accounts
disable autolearning and so on - i have around 10 years expierience with
spamfilters and in the past we had autolearning appliances got more and
more worse after 1-2 years until reset the complete bayes and train from
scratch
Re: train filter based on spam to ex-employees?
Posted by ttgh <to...@goldenhour.com>.
Reindl, thank you for the reply but in our situation we have 100% confidence
that these old addressees are spam. In any case, that's our risk to bear.
Can you offer any suggestions on how to use these old addressees as a
'honeypot' or even an outright ban list? (I'm not sure what the technical
description should be.)
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546p114548.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: train filter based on spam to ex-employees?
Posted by Reindl Harald <h....@thelounge.net>.
Am 16.02.2015 um 18:44 schrieb ttgh:
> We get 'waves' of spam which are addressed to both long-time employees
> (usually executives) as well as long-gone employees. It's safe to say that
> ANYTHING sent to those ex-employees is spam but how do I use those messages
> as an instant filter for the valid addressees?
*no* it is not
there are a million of valid reasons not contact somebody for a long
time and then find out the address no longer exists or get a outdated
contact from a 3rd party
Re: train filter based on spam to ex-employees?
Posted by David Jones <dj...@ena.com>.
>From: ttgh <to...@goldenhour.com>
>Sent: Monday, February 16, 2015 11:44 AM
>To: users@spamassassin.apache.org
>Subject: train filter based on spam to ex-employees?
>We get 'waves' of spam which are addressed to both long-time employees
>(usually executives) as well as long-gone employees. It's safe to say that
>ANYTHING sent to those ex-employees is spam but how do I use those messages
>as an instant filter for the valid addressees?
Not a valid indicator of spam in my opinion. Legit senders could be trained as
spam and block valid mail. Also, that list would be tough to maintain.
Setup a good whitelist_from_rcvd, whitelist_from_spf, whitelist_from_dkim
then let Bayesian and other rules do their work on the rest. This also keeps
the SA processing time down low.
At the MTA level, use some reliable RBLs and basic HELO checks to block
most of the spam.
Setup a high number MX server that temp fails everything after a couple
seconds delay. This will attract some of the spam away from your main
MX.
Setup negative SA scoring on some of the reliable whitelists and positive
scoring on some RBLs that are took risky for you to block at the MTA
level. For example, SpamCop is very nice but I am not able to use it in my
MTA so I add points for hits.
I have recently changed my thinking on blocking spam toward more of
the reputation of the sending mail server. This seems to work well and
helps with new spam campaigns. The downside is compromised accounts
on legit mail servers but this is really hard to block anyway. My servers
usually block these after 30 minutes or so based on RBLs, DCC, Razor, etc.
>I assume I need to learn how to use the Bayesian filter but I've been
>avoiding that because of the apparent effort required to maintain it. Also
>I'm concerned that there won't be a quick enough turnaround on filtering,
>e.g. if 10 copies of a new spam arrive and the first several instances are
>addressed to current employees, they will 'pass' the filter before the
>known-bad addressees get scanned and added to the filter.
>I should also point-out that our SA setup is acting as relay to an internal
>server so once messages are passed they are no longer accessible to SA,
>i.e., we're running Postfix but only as a relay not as the primary mail
>store.
Thank you for any suggestions!
--
View this message in context: http://spamassassin.1065346.n5.nabble.com/train-filter-based-on-spam-to-ex-employees-tp114546.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.