Topic: HELP: From Spam Assassin To ASSP Question

[hordeusr]

For our server ASSP puts much less load on the server.  I let it learn for a couple of weeks.  For us, it works better than any other SPAM solution.  It's very rare for anyone to get spam, when they do they use the "report as spam" link in the webmail (that forwards it to ASSP).  It makes heavy use of a whitelist, all outgoing receipients are added to the whitelist by ASSP.  A false positive is returned to the sender with instructions on what to do.  Oh, and it blocks whatever attachments you want (via the extension).  The only viruses CLAMAV ever see's is zip viruses, the rest are blocked by ASSP(I have it set to block all executable attachments).  Here is my current stats...
assp ver 1.1.0

ASSP Proxy Uptime:        329.886 days
SMTP Connections Received:  274704
Relay Attempts Rejected:    2719 (1.0%)
MESSAGE HANDLING Statistics
Messages Processed:        256917 (778.8 per day)
Rules Spams:                15476
Bayesian Spams:        84965
Spamlover Spams Passed:     2977
Attachments Blocked:        26516
Viruses Detected:        0
Spam Bombs Blocked:        0
Scripts Blocked:        0
Whitelisted Messages:       31643
External Spam Percentage:   56.8%

(I haven't tried the virus protection (uses clam database)

[Mumm-Ra]

I use ASSP on my home server.
I managed to configure it as how I like it pretty much straight away ( I already had a ruck of spam that I sent through the filter).
The only time I receive spam now is through my second mail server (hosted by my domain registrar) but I've now forwarded this mail to my gmail account (which does spam & av filtering) and I now pop it from there instead.

Perfect solution.

[djhomeless]

It could mean that everything is going via the relays, but that would (a) be unusual & (b) be easy to spot - all your incoming mail would arrive via the relays & you should know what their IP's are.

Agreed. I can see the IP of my backup MX every once in a while, but not often. The odd thing is if I go to DNSReport.com, they always show my mail server times out (I think it is a security measure). Regardless, I am going to switch over to spamcop for a few days to see the difference.

BTW, I just checked & you don't have any other MX set other than your SME.  I see you're on Bulldog - how do you rate them?

I literally just switched to Bulldog two weeks ago. So far the phone quality has been iffy, but improving. The broadband itself has been very fast, the only reason I took a change on them was because they offer 512 upstream. So far so good!

Geoffrey

[mach1_4fun]

mach1_4fun,

how can I check if my rbl list is working?

If you log in to your admin account through webmail and you will see that spam assassin sends a daily blocking report to that mail box.

heres what mine looks like:
Period Beginning : Fri Feb  4 00:00:01 2005
Period Ending    : Sat Feb  5 00:00:01 2005

Reporting Period : 24.00 hrs
--------------------------------------------------

Total spam rejected   :     1239 ( 57.98%)
    RBL rejected   :     1029 ( 48.15%)
     Score above 15   :       32 (  2.58%)
Total ham accepted    :      898 ( 42.02%)
                        -------------------
Total emails processed:     2137 (   89/hr)

Average spam threshold :        1.04
Average spam score     :        1.48
Average ham score      :      -73.65

[djhomeless]

24 hours after adding bl.spamcop.net to my rbl list, I still have zero RBL's in my daily update.

This is getting very odd. I swear I can see only a small percentage of mail going via the backup MX. Maybe I should turn off the backup for a few days to check?

Geoffrey

[azche24]

Hi, DJ,

i suffer from this at my home-server. No RBL at all. I am receiving lots of spam througth SpamAssassin now.

I already checked all the settings. Something fuxxed up when updating, because i had the RBL Installation by jesper earlier than the normal spamass panel.

So i will build up the server from the core again as soon as 6.5 RC is out.

[sc300t]

My RBL is also 0. This is very weird. We have more than 80 users. Here's the spam filter report:

Period Beginning : Fri Feb  4 00:00:00 2005
Period Ending    : Sat Feb  5 00:00:00 2005

Reporting Period : 24.00 hrs
--------------------------------------------------

Total spam rejected   :      128 ( 29.98%)
       RBL rejected   :        0 (  0.00%)
     Score above 15   :       48 ( 37.50%)
Total ham accepted    :      299 ( 70.02%)
                        -------------------
Total emails processed:      427 (   18/hr)

Average spam threshold :        2.00
Average spam score     :       13.92
Average ham score      :      -22.65

Statistics by Hour
-------------------------------------
Hour                 Spam         Ham
-------------    --------    --------
2005-02-04, 00             5           1
2005-02-04, 01             4           2
2005-02-04, 02             3           3
2005-02-04, 03             7           3
2005-02-04, 04             5           0
2005-02-04, 05             3           1
2005-02-04, 06             4           6
2005-02-04, 07             6          12
2005-02-04, 08             7          15
2005-02-04, 09             5          34
2005-02-04, 10             3          31
2005-02-04, 11             7          31
2005-02-04, 12             4          26
2005-02-04, 13             4          21
2005-02-04, 14             3          24
2005-02-04, 15             4          38
2005-02-04, 16             7          12
2005-02-04, 17            19           5
2005-02-04, 18             4           2
2005-02-04, 19             4           4
2005-02-04, 20             2           5
2005-02-04, 21             5           7
2005-02-04, 22             7          13
2005-02-04, 23             6           3

[sc300t]

I think my spam filter will work so much better if the rbl works. Can anybody help me?

[djhomeless]

Do you have a backup mail server?

[sc300t]

No, I dont have a backup mail server

[sonoracomm]

Hi,

Though I wrote the SME ASSP howto mentioned above, I don't profess to be an expert.  YMMV.

I have about two dozen ASSP/SME installations in the field in production.  All small/med businesses.

I have used RBLs in the past.  I found them less than sufficient, but simple to implement.  Not one customer thought the RBL alone was sufficient.

I find ASSP to be _very_ effective in the environments where I have installed it.  100% of the time.  Care does need to be taken to not 'poison' its databases...and it's easier to do than you might think.  For example, _never_ send a message to or reply to a spammer!

When I install ASSP, I don't even use test mode.  I found it was just to confusing for my clients and unnecessary.  However, using the sample spam/notspam databases, it _is_ pretty agresasive and will have a few false positives.  

I _always_ create a 'spambucket' account and have all filtered mail sent to this account.  That way, the 'spam administrator', just has to check the 'spambucket' account (via webmail, usually) once a day and no mail is ever lost.

I also always create a special code, like the companys phone number, that will allow messages to pass through  the spam filter.  That way road warriors just put their phone number in their signature and they never have to worry about their messages to other employees not getting through the spam filter.

In small businesses, ASSP quickly reaches a very high degree of accuracy with _very_ few false positives.  I can understand why it might not work as well with only a couple of messages per day, but I'll bet it would be a great improvement over nothing at all.  

Go to http://assp.sourceforge.net for a much better understanding.

G

p.s.  For now, it is not for 6.5b.  I'll update it soon...