Spam Assassin Update

[vickys]

I hear about Spam Assassin version 3, how can I update from 2.55.? I am getting killed with Spam and Spam Assassin misses most of it, as well as flagging some of what I want. There has to be a better way to deal with this. Thanks for any help.

[dbmasters]

I don't think that is something YOU update, HostPC does...so I presume you'll have to wait until they do it server-wide.

[ozee]

Unless you installed your own, apart from Installatron... I think...

[Joe]

Spamassassin isn't part of installatron, it's installed server wide.

Until it's tested and fully functional (they're still working on a couple of integration issues) we will not implement the upgrade alone.

Joe

[vickys]

So what can I do? I have tried using filters, but they don't seem to be working. Or maybe I don't understand how they are supposed to work. For domain adro.net, a commonly spammed address is admo@adro.net. It is often used as a cc to other, legitimate addresses. So I set up a filter for the word admo@adro.net. ... Oh now I see. I thought it searched header and body, but it only searches subject and body. Is there no way to search the header? I have to find a server side solution to this *rapidly* escalating problem.

[tnas]

A first step would be to encode the email address on your homepage. Spam-bots are very good at getting email addresses off websites. Encoding it makes it available to browsers, but unclear to many spam-bots looking for email addresses.

Blacklisting and whitelisting is available w/ spamassassin, but that only helps with repetative spammers. (ie. you can block whole domains... *@mydomain.com)

It's a constant battle... sometimes the only solution is to change your active email address.

[Fabio]

I've had quite a bit a success with Spamassassin. I have my threshold at 2.0 and I have added everyone in my addressbook to the whitelist as well as a few domains (ie *@hostpc.com). I used to get about 40 spam mails a days. It's down to just about 5 or 6. I would consider that a marked improvement.


Fabio

bitxl.com

[vickys]

OK, I'm trying to make Spam Assassin choose more accurately. I have added some blacklist_to entries to my user_prefs file but they are not having any effect. Each entry is on a separate line like blacklist_to admo@adro.net

Any idea how I can get this to work? The other changes I have made, such as to the score required, have taken effect, but not these. I followed the instructions at http://spamassassin.apache.org/full/3.0.x/...acklist_options (http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#whitelist_and_blacklis t_options) I'd sure like this to work. My business accounts can't set a threshhold of 2 and be sure to get mail from potential clients. Blocking mail with one of four addresses in any of the to fields would eliminate 50% of the spam right off the bat.

[thevillageinn]

you should probably use the instructions that correspond with the version of Spamassassin that is running on the HostPC servers.

also, you could use the Direct Admin spamassassin configuration interface. Under the e-mail section on the Direct Admin control panel is a link for Spamassassin...go there and in the text box that corresponds with blacklist addresses, add them there.

also, I'm not sure that the blacklist_to option is supported by the current implementation of spamassassin through Direct Admin.

I couldn't find the changelog at spamassassin's website either.

hope that helps.

[tnas]

Backlisting is based on the FROM address. It also does not "block" the mail, it just adds 100 points to the spam score. You still need to have a spam level set, and mail rules to handle/delete spam.


edit:
Just tried the whitelist_to option. It does work. I am guessing the blacklist_to option would also work, but you have to edit the SA config file manually. The option to edit it is at the bottom of the setup screen. Note, that this is not in your regular backups, so if you make a bunch of modifications to this then you should make a copy of it and save it somewhere too.

whitelist_to youremail@yourdomain.com
blacklist_to youremail@yourdomain.com

[vickys]

Originally posted by tnas@Dec 7 2004, 06:58 AM

Just tried the whitelist_to option. It does work. I am guessing the blacklist_to option would also work, but you have to edit the SA config file manually. The option to edit it is at the bottom of the setup screen. Note, that this is not in your regular backups, so if you make a bunch of modifications to this then you should make a copy of it and save it somewhere too.

whitelist_to youremail@yourdomain.com
blacklist_to youremail@yourdomain.com

Quoted post


Um, yeah. This is exactly what I did and it is *not* working. Anyone have any idea why? Or better yet, how to get it working?

[vickys]

Originally posted by thevillageinn@Dec 7 2004, 12:43 AM
you should probably use the instructions that correspond with the version of Spamassassin that is running on the HostPC servers.



Can you point me in their direction? I found 2.6, which is marked old, and 3.0, but not 2.55.

Am I allowed to install the newer version for my domains myself?

[tnas]

Originally posted by vickys@Dec 7 2004, 03:03 PM
Um, yeah. This is exactly what I did and it is *not* working. Anyone have any idea why? Or better yet, how to get it working?

Quoted post


If you have set the config file properly, you can view the properties of a message that you received, and see what tests it failed, and the score for each.
I have tested the blacklist_to function, and it too is working. I did have to assign a score with it for it to be recognized as spam.

from the email header....
* 10 USER_IN_BLACKLIST_TO User is listed in 'blacklist_to'

from the config file...

score USER_IN_BLACKLIST_TO 10

blacklist_to youremail@yourdomain.com



I'm on www13 just incase this is a per server issue.

[vickys]

Tom, I thought we had it as I didn't have the score line before. I now have these lines in my user_prefs file:

score USER_IN_BLACKLIST_TO 10.00

blacklist_to admo@adro.net

Plus a few more blacklist_to lines.

Still no joy. This test is not reported in the header, and e-mails to admo@adro.net that are cc'd to another address sail right on through. I tried the score with and without the decimal places, and I also tried score BLACKLIST_TO 10. [Where did you find the reference to "USER_IN_BLACKLIST_TO"?] I am sure I am doing something wrong, but what? I cut and pasted the lines above so any typos should be evident. Is there another line I could be missing? Some mail is flagged SPAM and the headers tell me it is scanning, just not on the terms I want. I am on www11, but I'm not sure that makes a difference.

[thevillageinn]

Originally posted by vickys@Dec 7 2004, 11:03 AM
Um, yeah. This is exactly what I did and it is *not* working. Anyone have any idea why? Or better yet, how to get it working?



have you set spamassassin up correctly, other than just the blacklist_to option? maybe it is working, but no changes are being written to the subject (because of config settings) or the messages aren't being moved to a specific folder (also because of config settings)

like tnas mentioned, a look at the headers of the e-mails received on an account with spamassassin will reveal what's going on, or not going on.

I looked around at the spamassassin site, but didn't find any documentation for 2.5.5, but did also find the 2.6 docs. If you can unpack RPM files (with most any program which opens gzip), there are loads of linux rpm sites with spamassassin 2.5.5, and I'd assume they have documentation included. (in fact they do...see linked file)

Spamassassin 2.5.5 docs (http://www.danjcraig.com/tempdl/spamassassin-2.5.5-docs.zip)

also, I see you are on www11: www11.privatelabeldns.com

is anyone here also on www11, with working spamassassin?

do you have a reseller account? is spamassassin enabled from the reseller panel on the account "adro.net"? it's not user configurable on my reseller panel, but it does show up as "on".

[vickys]

Thanks for the questions and the doc link, Dan. I really want this to work.

I have a reseller account. I have SpamAssassin enabled on one of my personal accounts and on one test reseller account. I logged in as the user and made the changes there myself. SpamAssassin is working. It modifies the headers, and changes the subject line if the score exceeds the threshhold, 4.8 in one case and 4.9 in another. I changed them from 5 just so I could see if any of the changes were taking effect. At this point I am not having messages moved, just marked.

My blacklist_to entries are having no effect, and they do not show up in the test list in the header for relevant e-mails. Since Tom was able to get his blacklist_to working, it does not sound like a version issue but rather something local to my installation, or my config file. I'm still reading, though I admit I don't understand all of it. I appreciate the pointers. Got any more ideas?

[tnas]

Wow vickys, I have no clue as to why it is not working for you.
My last thought is to check the header info of a mail that has been flagged by SA and check the TO: field, to make sure it IS matching to the email you are trying to blacklist. Other that that, it looks like you have it set up correctly to me.

the reference to " [Where did you find the reference to "USER_IN_BLACKLIST_TO"?] " came from the tests performed list on the spamassassin website for v2.6. I then made a blacklist_to entry in my config file, and the line in me previous message was from the header of the message I sent to myself.

[thevillageinn]

you could copy and paste your config file, if you either "xxxx" any personal info, or if there isn't any personal info.

you could copy and paste some e-mail headers, with any personal info removed.

Other than these, at this point, I don't know what else. Have you set up a "blacklist_to" entry for an e-mail address that you own? that way you could test whether the option is even working when you are sending yourself an e-mail.

I'm confident that we'll figure it out eventually. Spamassassin is pretty new to the HostPC service, so it's pretty unfamiliar to most of us as well. I know I'm learning right along with you at this point.

[vickys]

user_prefs:

required_hits 4.8
required_hits 4.8
rewrite_subject 1
subject_tag *****SPAM*****
report_safe 0




required_score 4.8
rewrite_header subject *****SPAM*****

score USER_IN_BLACKLIST_TO 10

blacklist_to admo@adro.net
blacklist_to giiyd@adro.net
blacklist_to webmaster@adro.net
blacklist_to erefst@adro.net


e-mail header:

Return-path: <xxxxxx@xxx.net>
Envelope-to: xxx@adro.net
Delivery-date: Wed, 08 Dec 2004 22:19:45 -0500
Received: from mail by www11.privatelabeldns.com with spam-scanned (Exim 4.43)
id 1CcEqG-0007Sb-Vm; Wed, 08 Dec 2004 22:19:45 -0500
Received: from [204.127.202.55] (helo=sccrmhc11.comcast.net)
by www11.privatelabeldns.com with esmtp (Exim 4.43)
id 1CcEqG-0007SW-Ps; Wed, 08 Dec 2004 22:19:44 -0500
Received: from Inna (unknown[67.183.248.146](misconfigured sender))
by comcast.net (sccrmhc11) with SMTP
id <2004120903193301100diu7ne>; Thu, 9 Dec 2004 03:19:44 +0000
From: xxx <xxx@xxx.net>
Date: Tue, 07 Dec 2004 20:45:02 -0800
To: admo@adro.net
Cc: Jon <xxx@adro.net>
Subject: test
X-Spam-Status: No, hits=0.0 required=4.8
tests=none
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
Message-Id: <E1CcEqG-0007Sb-Vm@www11.privatelabeldns.com>


Thanks for your help, Dan and Tom. It is quite puzzling to me. It gets stranger. The last time I tried the same test the header changed. Both accounts reported 5.0 hits required, although I had not changed the settings from 4.8 and 4.9. I just tried it again and they are back to 4.8 and 4.9. Methinks someone is working on this from the server end. I sure hope we find the answer. The blacklist_to entry is still being ignored. Tom, thanks for that reference. I had looked at that page, but forgotten about it.

[vickys]

I have noticed my whitelist_from entries in one of my personal accounts are not working either. They are still being flagged as spam. I had used the configuration generator at http://www.yrex.com/spam/spamconfig.php and thought perhaps that was causing a problem, so I started over and let DA create the file. No joy. I even added a score line for USER_IN_WHITELIST but still no joy. What could I be doing wrong? Is anyone on www11 using SpamAssassin?

[thevillageinn]

I'm not ignoring your problem, but I'm still stumped at this point.

I think it may be time for a helpdesk ticket, if your settings aren't working, and you are using the DA interface for spamassassin, there's not much more you can do, and they need to check into the functionality of spamd on www11. (I think)

[vickys]

Dan, I think you are right. I've been away for a few days but I'll open that ticket now. Thanks for trying. I've learned a bit in the struggle.