Re: Spamassassin Reporting Qn
Title: RE: Spamassassin Reporting Qn Don't have the users FORWARD the mail to the account of the SA box. That will screw things up, especially with Exchange. Instead, make a public folder on the SA box, probably IMAP, and have users COPY or MOVE spam messages into this folder. They can do this with drag-n-drop, or by right-clicking on the message and selecting Move or maybe Copy. Run a cron script on the SA box to learn the stuff in the folder every so often, then empty it out. I believe there is a script on the wiki for managing the SA learning end of this, and a description in more detail on how to set all this up. Loren
Re: Spamassassin Reporting Qn
There is a gotcha in doing that, Glenn. One person's spam is another
person's ham. It is better if each user has his or her own Bayes rules.
For that I built a pair of IMAP mailboxes into which I can dump the
spam and ham samples for each user. If doing this for other than me
or Loren I'd dump them once they had been processed, sight unseen by
human eyes. Neither Loren nor I seem to be as interested in each other's
ham and spam samples as we are in eliminating spam. So I save both for
retraining Bayes if something tubes the Bayes system.
Since going to the trouble if creating IMAP mailboxes, which are a very
general solution if spam is moved into them for disposal, I have discovered
that the OE MUAs we use can simply export the spam as individual files by
drag and drop. That could be used with a SAMBA exported directory on the
mail server for generic training with one "spam" user account or it could
be done per user with per user spam accounts. While I know I can do this
I prefer the IMAP trick. It works and is somewhat easier.
Note that I do NOT use forwarding for exactly the consideration you cite.
I move (or copy) spam into the spam folder and let a cron job train the
Bayes for each user at least once a day.
{^_^}
- Original Message -
From: "Glenn Elliott" <[EMAIL PROTECTED]>
> Hi Rainer,
>
> Sorry..
>
> What is happening is spam is getting through spamassassin and the users
> identify it as spam. I want to train spamassassin and an easy way to do
this
> would be to ask all the users to forward spam to a central mailbox on the
> spamassassin server which I can then use to train spamassassin.. Am I
making
> sense? Is this possible? No user accounts are on the spamassassin server.
>
> Regards,
>
> Glenn.
>
> -Original Message-
> From: Rainer Sokoll [mailto:[EMAIL PROTECTED]
>
> On Thu, Jan 27, 2005 at 07:52:29PM +1100, Glenn Elliott wrote:
>
> > My question is does spamassassin use the from address when learning as
> > the from will equate to the internal users email address and not the
> spammers...
> > I dont want to register my internal users as spammers!
>
> IMHO, it does not make sense to scan mail from your internal users. Its
just
> wasting resources.
> Here, in a similar setup like yours, I use spamass-milter to feed SA.
> The milter can ignore mail from the internal network:
> >From the startup script:
>
> ---8<---
> su amavis -c "/usr/local/sbin/spamass-milter -i 10.0.0.0/8 -f -p \
> /var/spamass/spamass-milter.sock"
> ---8<---
>
> So, everything from 10/8 is ignored
>
>
> Rainer
>
Re: Spamassassin Reporting Qn
On Thu, Jan 27, 2005 at 08:45:37PM +1100, Glenn Elliott wrote: > What is happening is spam is getting through spamassassin and the users > identify it as spam. I want to train spamassassin and an easy way to do this > would be to ask all the users to forward spam to a central mailbox on the > spamassassin server which I can then use to train spamassassin.. Am I making > sense? Is this possible? No user accounts are on the spamassassin server. Ah, now I understand. OK, I want to do the same like you, and have that idea: Assumed your Exchange supports IMAP (mine does so) Create a public folder in Exchange where users can put their spam in. (they would have to drag'n drop the offending mail into that folder, not just forward it, since this would remove all headers). Once a day or so, I would connect to this public folder, download all mails onto a local hard disk (mbox format) , delete the mails on the Exchange server, move the file containing tha spams to the machine running SA and then fire up sa-lern --mbox. On any flavour of Uni*x, this can be done automagically by using the usual suspects (cron, scp, ssh...) Rainer
RE: Spamassassin Reporting Qn
Title: RE: Spamassassin Reporting Qn Hi Rainer, Sorry.. What is happening is spam is getting through spamassassin and the users identify it as spam. I want to train spamassassin and an easy way to do this would be to ask all the users to forward spam to a central mailbox on the spamassassin server which I can then use to train spamassassin.. Am I making sense? Is this possible? No user accounts are on the spamassassin server. Regards, Glenn. -Original Message- From: Rainer Sokoll [mailto:[EMAIL PROTECTED]] Sent: Thursday, 27 January 2005 8:41 PM To: users@spamassassin.apache.org Subject: Re: Spamassassin Reporting Qn On Thu, Jan 27, 2005 at 07:52:29PM +1100, Glenn Elliott wrote: > My question is does spamassassin use the from address when learning as > the from will equate to the internal users email address and not the spammers... > I dont want to register my internal users as spammers! IMHO, it does not make sense to scan mail from your internal users. Its just wasting resources. Here, in a similar setup like yours, I use spamass-milter to feed SA. The milter can ignore mail from the internal network: From the startup script: ---8<--- su amavis -c "/usr/local/sbin/spamass-milter -i 10.0.0.0/8 -f -p \ /var/spamass/spamass-milter.sock" ---8<--- So, everything from 10/8 is ignored Rainer
Re: Spamassassin Reporting Qn
On Thu, Jan 27, 2005 at 07:52:29PM +1100, Glenn Elliott wrote: > My question is does spamassassin use the from address when learning as the > from will equate to the internal users email address and not the spammers... > I dont want to register my internal users as spammers! IMHO, it does not make sense to scan mail from your internal users. Its just wasting resources. Here, in a similar setup like yours, I use spamass-milter to feed SA. The milter can ignore mail from the internal network: >From the startup script: ---8<--- su amavis -c "/usr/local/sbin/spamass-milter -i 10.0.0.0/8 -f -p \ /var/spamass/spamass-milter.sock" ---8<--- So, everything from 10/8 is ignored Rainer
Spamassassin Reporting Qn
Guys, Spamassassin sits on our DMZ mail server and cleans the spam nicely, protecting our internal MS Exchange box. I want to report spam which users receive on exchange... I can get them to forward any spam to a mailbox on the spamassassin mail server and run spamassassin -r to report on the mail. My question is does spamassassin use the from address when learning as the from will equate to the internal users email address and not the spammers... I dont want to register my internal users as spammers! Thanks for your time. Glenn.
