auto-whitelist is making spams sneak through

[Mike Pepe <la...@doki-doki.net>]

I'm getting more and more spams sneaking through lately.

I'm running SA 3.0.4 on Fedora Core 3.

In analyzing the ones that make it through, I see that other users in my 
domain are CC, which causes the auto-whitelist to score the spam lower 
than if I run it through manually without that test.

I've just set auto-whitelist to 0 in my .spamassassin/user_prefs.cf 
which I hope will stop that from happening, but in the meantime is there 
some way to manipulate or even reset my whitelist database?

thanks

-Mike

Re: auto-whitelist is making spams sneak through

[Matt Kettler <mk...@evi-inc.com>]

Mike Pepe wrote:
> I'm getting more and more spams sneaking through lately.
> 
> I'm running SA 3.0.4 on Fedora Core 3.
> 
> In analyzing the ones that make it through, I see that other users in my
> domain are CC, which causes the auto-whitelist to score the spam lower
> than if I run it through manually without that test.

Really, that shouldn't matter. the AWL doesn't care about recipients. It cares
about the sender and the "originating" IP (which is really the first untrusted
IP, since all the ones before it could be forged).

Are you sure it's the auto-whitelist (AWL)?

Only whitelist_to, more_spam_to, or all_spam_to should be affected by the Cc list.

> 
> I've just set auto-whitelist to 0 in my .spamassassin/user_prefs.cf
> which I hope will stop that from happening, but in the meantime is there
> some way to manipulate or even reset my whitelist database?

read man spamassassin, and look at these options:

--remove-addr-from-whitelist

--add-addr-to-whitelist

--add-addr-to-blacklist

Despite what many might think, these commands are pretty much only useful in
making fixes to a misguided AWL.

They aren't really very useful for black/whitelisting senders in the general sense.

Re: auto-whitelist is making spams sneak through

[Steven Dickenson <st...@mrchuckles.net>]

On Jun 22, 2005, at 9:36 PM, Mike Pepe wrote:
> In analyzing the ones that make it through, I see that other users  
> in my domain are CC, which causes the auto-whitelist to score the  
> spam lower than if I run it through manually without that test.

I'm sure others may chime in to say that auto-whitelist is just doing  
it's job.  However, it's for reasons such as this that I always  
disable auto-whitelist.  It usually proves to be a source of much  
confusion and FP/FN mail for me.  YMMV.

> I've just set auto-whitelist to 0 in my .spamassassin/user_prefs.cf  
> which I hope will stop that from happening, but in the meantime is  
> there some way to manipulate or even reset my whitelist database?

You can reset the auto-whitelist by deleting it.

rm ~/.spamassassin/auto-whitelist*

- S
---
Steven Dickenson <st...@mrchuckles.net>
http://www.mrchuckles.net