Re[3]: Increase this weekend?

[Robert Menschel <Ro...@Menschel.net>]

Hello Diane,

Tuesday, August 3, 2004, 12:23:04 PM, you wrote:

d> Thanks for the tips. I may ask you later about your cheating method.  ;)

d> As for configuration, I can do:
d> blacklist
d> whitelist
d> required hits
d> rewrite subject
d> score
d> subject tag

d> Is that all you can do at your host Bob?

Without cheating, yes. Not sure what you many by "subject tag", though,
unless that's the same thing as rewriting the subject.

First thing I did last year when I first discovered I had SA capabilities
and read the SA web site was increase my required hits to 9 (I'm what
you'd call conservatively aggressive -- I hate spam, and nuke all spam so
my end-users don't see them (with a 99.8% accuracy rate), but I hate
false positives even more, so I increased the required hits to make sure
I didn't get any false positives from the default system.

I then increased a number of scores on the safest and most commonly hit
rules to allow for that increased required hits.

I then grabbed the blacklist William Stearns maintains at
http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf
It's a big help, and I update my copy here from his system every month or
so.

I also have a few whitelists, but I try to keep those to a minimum.

All of that got me to around 98% accuracy.  I then began to cheat, and
that's how I get to 99.8%.

d> The servers are Linux and I have dabbled in Unix a few times in the 
d> last 10 years or so.

So it's very possible some adaptation of my system will work for you.
Basic requirements are that you be able to create secondary/intermediate
mailboxes, and run cron jobs to handle automated sa-learn and
spamassassin runs.

d> The misguided spams have slowed down since yesterday but were 
d> completely out of control Sat - Mon.

Never had a problem here.  Apparently my system headed them off.

Bob Menschel

Re[2]: Increase this weekend?

[Robert Menschel <Ro...@Menschel.net>]

Hello Jeff,

I agree with you, but

Tuesday, August 3, 2004, 4:49:56 PM, you wrote:

JC> On Tuesday, August 3, 2004, 12:50:00 PM, Robert Menschel wrote:
>> I then grabbed the blacklist William Stearns maintains at
>> http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf
>> It's a big help, and I update my copy here from his system every month or
>> so.

JC> Uh, sa-blacklist is getting huge lately.  Better to use
JC> the SURBL version of it: ws.surbl.org in order to
JC> prevent server choking and SpamAssassing crashing...
JC> (not trying to FUD, but....)
JC>   http://www.surbl.org/lists.html#ws
JC>   http://www.surbl.org/quickstart.html

we are talking about a lowly domain owner on a shared server, where we do
not have the ability to modify the SA setup.  I can't install surbl on my
host's server, and chances are she can't either.

The blacklist is the majority of my user_prefs, even with just about all
SARE rules in there as well, and yes, it consumes overhead, but it's the
best solution in my environment.

When my host eventually upgrades to 3.0 with surbl built-in, then
depending upon results I may discontinue using sa-blacklist.cf ... until
then I rely on it.

Bob Menschel

Re: Increase this weekend?

[Jeff Chan <je...@surbl.org>]

On Tuesday, August 3, 2004, 12:50:00 PM, Robert Menschel wrote:
> I then grabbed the blacklist William Stearns maintains at
> http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf
> It's a big help, and I update my copy here from his system every month or
> so.

Uh, sa-blacklist is getting huge lately.  Better to use
the SURBL version of it: ws.surbl.org in order to
prevent server choking and SpamAssassing crashing...
(not trying to FUD, but....)

  http://www.surbl.org/lists.html#ws

  http://www.surbl.org/quickstart.html

Jeff C.
-- 
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/