On 11/18/2013 09:22 AM, Eric Broch wrote:
On 11/18/2013 8:35 AM, Eric Shubert wrote:
On 11/18/2013 12:56 AM, Peter Peltonen wrote:
Hi,
On Mon, Nov 18, 2013 at 12:08 AM, Kelly Cobean <[email protected]
<mailto:[email protected]>> wrote:
__
So I'm wondering if anyone knows of any good writeups or tutorials
on how to do pattern based mail dropping or other suggestions on how
to cut down on the garbage. I don't want SA to drop the messages
because every now and again it'll flag a legit message.
The most common suggestion on the list is to use Spamdyke. Have you
tried it? It blocks email from misconfigured servers which are usually
computers hijacked by spambots. Take a look at:
http://wiki.qmailtoaster.com/index.php/Spamdyke
Regards,
Peter
Indeed, spamdyke's "the bomb". It'll lighten the load on your server
considerably by eliminating 80+% of the spam w/out even receiving it!
If I had to pick any one anti-spam software to use, it'd be spamdyke
(over spamassassin or dspam).
spamdyke is going to be a 'stock' part of the upcoming QMT release
(which is coming along nicely, and I expect to have ready for testing
within a week or two).
Eric S.,
I'm not sure that I'm seeing that high a number of spam blocked by
Spamdyke. You must have it configured more effectively than I. Any
chances that you could share your config file? My clients are still
seeing way to much spam even with Spamdyke installed. As you say, I'd
rather take care of it before it reaches the internals of my server, though.
Eric B.
It's pretty much stock. Anything in config-files is pretty much
domain-specific (iirc).
[root@tacs-mail ~]# cat /etc/spamdyke/spamdyke.conf
# access-file causes spamassassin not to scan (RELAYCLIENT being set)
#access-file=/etc/tcprules.d/tcp.smtp
#dns-blacklist-entry=zombie.dnsbl.sorbs.net
#dns-blacklist-entry=dul.dnsbl.sorbs.net
#dns-blacklist-entry=bogons.cymru.com
dns-blacklist-entry=zen.spamhaus.org
dns-blacklist-entry=bl.spamcop.net
#dns-blacklist-entry=dnsbl-1.uceprotect.net
#full-log-dir=/var/log/spamdyke
graylist-dir=/var/spamdyke/graylist
# shubes 9/9/2013 - graylisting turned off
#graylist-level=always
graylist-level=none
graylist-max-secs=2678400
graylist-min-secs=180
greeting-delay-secs=6
header-blacklist-entry=From:*>,*<*
idle-timeout-secs=180
ip-blacklist-file=/etc/spamdyke/blacklist_ip
ip-in-rdns-keyword-blacklist-file=/etc/spamdyke/blacklist_keywords
ip-in-rdns-keyword-whitelist-file=/etc/spamdyke/whitelist_keywords
ip-whitelist-file=/etc/spamdyke/whitelist_ip
local-domains-file=/var/qmail/control/rcpthosts
log-level=info
#log-level=verbose
log-target=stderr
max-recipients=15
#policy-url=http://my.policy.explanation.url/
rdns-blacklist-file=/etc/spamdyke/blacklist_rdns
rdns-whitelist-file=/etc/spamdyke/whitelist_rdns
recipient-blacklist-file=/etc/spamdyke/blacklist_recipients
recipient-whitelist-file=/etc/spamdyke/whitelist_recipients
reject-empty-rdns
reject-ip-in-cc-rdns
reject-missing-sender-mx
reject-unresolvable-rdns
sender-blacklist-file=/etc/spamdyke/blacklist_senders
sender-whitelist-file=/etc/spamdyke/whitelist_senders
#smtp-auth-command=/home/vpopmail/bin/vchkpw /bin/true
#smtp-auth-level=always
tls-certificate-file=/var/qmail/control/servercert.pem
tls-level=smtp
[root@tacs-mail ~]#
The 80+% number is just a feel. It could be coming down without me
noticing. I'd really like to implement a script that would give me hard
numbers. Care to share what you're using? (You might have already -
there have been a couple floating around.)
I expect that spammers will eventually get smart enough to configure
their servers properly, thus getting through some of spamdyke's filters
(rDNS related) which have been very effective in the past. That's one
reason I'm glad to see your work with dspam. I expect dspam will
effective as spammers get better at their craft.
Fighting spam is an ongoing battle, with each side alternatively gaining
ground. FWIW.
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
