I'm a little surprised nobody has chimed in on this, so I'll go ahead.
First off, spamdyke indeed appears to be working well for you. A bit
better than I would have expected even, but that's only based on a hunch
(I've yet to run stats on my servers).
The problem you face with the SA bayes database is that it's global, and
what's spam to one customer might not be spam to another. My thinking is
that using a user feedback mechanism to update bayes is not going to
work well in multi-domain environments. Note, I do implement this sort
of thing on QMT hosts that have single or few domains however.
I think your best approach will be to gather feedback from your
complaining users, and look at each instance individually.
Examine what the SA score is presently on such items. The QMT stock
values for SA are a bit loose, so tightening them down a bit will
probably help. Personally, I use spam-hits=5.1 in simcontrol (rejects
emails above this), and required_score 3.7 in the SA local.cf file,
which is the score above which messages are tagged. YMMV, as I do use a
tailored bayes db for scoring.
Then have your users set up mail filters to put spam in a Junk folder,
to get it out of their inbox. This will make a big impact on their
perception of how much spam they receive.
FWIW, here's the SA local.cf file I'm presently using:
ok_locales all
skip_rbl_checks 1
required_score 3.7
report_safe 0
rewrite_header Subject [SPAM]
use_pyzor 1
use_auto_whitelist 1
bayes_path /home/vpopmail/.spamassassin/bayes
use_bayes 1
use_bayes_rules 1
bayes_auto_learn 1
bayes_auto_learn_threshold_spam 5.5
bayes_auto_learn_threshold_nonspam 0.1
bayes_auto_expire 0
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
trusted_networks 192.168/16
# temporary fix for this rule
score FH_DATE_PAST_20XX 0.0
# Rule2XSBody - speedup by compilation of ruleset to native code
loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
# adjusting these scores gives bayes more weight
# commented values are the defaults
# score BAYES_00 0 0 -2.312 -2.599
# score BAYES_05 0 0 -1.110 -1.110
# score BAYES_20 0 0 -0.740 -0.740
# score BAYES_40 0 0 -0.185 -0.185
# score BAYES_50 0 0 0.001 0.001
# score BAYES_60 0 0 1.0 1.0
# score BAYES_80 0 0 2.0 2.0
# score BAYES_95 0 0 3.0 3.0
# score BAYES_99 0 0 3.5 3.5
score BAYES_00 0 0 -2.612 -2.899
score BAYES_05 0 0 -1.110 -1.110
score BAYES_20 0 0 -0.740 -0.740
score BAYES_40 0 0 -0.185 -0.185
score BAYES_50 0 0 0.001 0.001
score BAYES_60 0 0 1.5 1.5
score BAYES_80 0 0 3.0 3.0
score BAYES_95 0 0 4.0 4.0
score BAYES_99 0 0 5.1 5.1
Let us know how you make out.
And remember to KISS.
--
-Eric 'shubes'
On 11/23/2011 03:28 PM, Casey wrote:
Anyone got any suggestions? I think what would really help would be if I
could figure out a relatively easy way to train my SA boxes. If there
was a simple and easy way for my customers to report spam and help train
the spam filters that would be great...the problem is not everyone uses
our webmail clients or even IMAP for that matter.
I was hoping to hear from some fellow toaster users out there that have
multiple domains with many users to see how they are accomplishing
things. If nothing else, if someone knew of a good way to create "spam"
or "junk" folders for the IMAP users and then automatically move
messages that were tagged by SA into the junk folders, that would be slick.
I know there is a plugin for roundcube, that I actually am using on a
Debian server at home but I'm wondering if there is a way to global
implement this. I'd rather have this take place outside of any webmail
interface, and instead incorporate it at a lower level with with the
IMAP/POP3 daemons. I wouldn't be surprised if this could easily be
accomplished using Dovecot, but I'm really not sure - and last I heard,
Qmailtoaster was still using Courier in the official releases. Doesn't
mean I'm not willing to veer from the norm and switch to the up and
coming ;-)
The real tricky part at the moment is that I have my server's roles all
split up, so mail hits spamdyke, then gets passed to the SA servers, and
then from there it goes to the server that actually houses the user
accounts and mail. I think that's what adds a layer of complexity to
using spamassassin and effectively training it.
Help! Please?
Casey
On 11/21/11 3:15 PM, Casey wrote:
Hi all,
Been getting some complaints recently from a couple of customers that
have been receiving a bit more spam than usual. Just wanted to see how
others had their spamdyke/simscan/spamassassin/clamav configured.
Spamdyke is definitely doing its job and doing it well on my gateway
servers, as you can see below:
*Gateway1
*This report was generated Mon Nov 21 00:11:55 2011
244499 70.34% DENIED_RDNS_MISSING
37848 10.88% DENIED_RDNS_RESOLVE
25915 7.45% DENIED_GRAYLISTED
24359 7.00% ALLOWED
9045 2.60% TIMEOUT
5106 1.46% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
698 0.20% DENIED_SENDER_NO_MX
41 0.01% DENIED_OTHER
28 0.00% ERROR
17 0.00% DENIED_SENDER_BLACKLISTED
11 0.00% DENIED_TOO_MANY_RECIPIENTS
---------------- Summary ----------------
Allowed: 24359 7.00%
Timeout: 9045 2.60%
Errors : 28 0.00%
Denied : 314135 90.38%
Total : 347567 100.00%
*Gateway2*
This report was generated Mon Nov 21 00:06:33 2011
235998 86.06% DENIED_RDNS_MISSING
23896 8.71% DENIED_RDNS_RESOLVE
8414 3.06% DENIED_GRAYLISTED
3570 1.30% TIMEOUT
1092 0.39% ALLOWED
692 0.25% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
484 0.17% DENIED_SENDER_NO_MX
57 0.02% DENIED_OTHER
14 0.00% ERROR
---------------- Summary ----------------
Allowed: 1092 0.39%
Timeout: 3570 1.30%
Errors : 14 0.00%
Denied : 269541 98.29%
Total : 274217 100.00%
*
Gateway3*
This report was generated Mon Nov 21 00:05:16 2011
11899 41.92% DENIED_RDNS_RESOLVE
10505 37.01% DENIED_RDNS_MISSING
3237 11.40% DENIED_GRAYLISTED
1970 6.94% TIMEOUT
334 1.17% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
219 0.77% DENIED_SENDER_NO_MX
196 0.69% ALLOWED
23 0.08% DENIED_OTHER
1 0.00% DENIED_EARLYTALKER
---------------- Summary ----------------
Allowed: 196 0.69%
Timeout: 1970 6.94%
Errors : 0 0.00%
Denied : 26218 92.36%
Total : 28384 100.00%
Yet, I'm still receiving complaints from a few. I think my
spamassassin boxes need some tuning, but I'm not sure where to start.
How are others handling spamassassin training? I just noticed that
"use_bayes", "use_bayes_rules", and "bayes_auto_learn" were all
previously set to "0", so I enabled them all over the weekend..but I
have the feeling theres a bit more to it than that. For example, what
would be the best way to train SA on servers that are handling
hundreds of domains?
Our gateway servers don't actually have the users or mail stored on
them, they simply accept mail for the domains listed in rcpthosts, and
send them to the appropriate servers using smtproutes. So I'm not sure
how this factors in.
Any help would be appreciated.
Thanks,
Casey
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com
