Koozali.org: home of the SME Server

SpamAssassin config question

Offline ddougan

  • *
  • 155
  • +0/-0
    • http://www.DouganConsulting.com
SpamAssassin config question
« on: November 24, 2005, 11:52:38 PM »
I've Jesper's SA contrib on a 6.0 server. I've added an IP address to the WBL section, but traffic from the address is still getting through to the AV software. Am I missing something? I'd like to drop all traffic from the site (they're full of Sober-Z viruses).

Thanks,

Des
Des Dougan

Offline raem

  • *
  • 3,972
  • +4/-0
Re: SpamAssassin config question
« Reply #1 on: November 25, 2005, 06:30:00 AM »
ddougan

> I've added an IP address to the WBL section, but
> traffic from the address is still getting through

I thought that panel only accepts email addresses or domain names not IPs.

Why don't you request one of the external RBL's to list that IP, then it will get blocked by the RBL list setup.
...

Offline raem

  • *
  • 3,972
  • +4/-0
Re: SpamAssassin config question
« Reply #2 on: November 25, 2005, 06:32:29 AM »
ddougan

> I'd like to drop all traffic from the site

Perhaps this

http://forums.contribs.org/index.php?topic=29297.0
...

Offline raem

  • *
  • 3,972
  • +4/-0
Re: SpamAssassin config question
« Reply #3 on: November 25, 2005, 06:35:32 AM »
ddougan

> I'd like to drop all traffic from the site


....or this

http://forums.contribs.org/index.php?topic=29414.msg123011#msg123011
...

Offline ddougan

  • *
  • 155
  • +0/-0
    • http://www.DouganConsulting.com
SpamAssassin config question
« Reply #4 on: November 25, 2005, 06:54:25 AM »
Hi Ray,

Thanks for your replies. I'll check out the links you provided. I've also being working on implementing your Virus and File-Blocking Howto, which will also help.

According to the second screen, you can "Input the email address, domain, or IP address", although I don't believe the IP blocking works (unless it needs to be entered with quotes or something).

Regards,

Des
Des Dougan

Offline raem

  • *
  • 3,972
  • +4/-0
SpamAssassin config question
« Reply #5 on: November 25, 2005, 09:00:59 AM »
ddougan

> According to the second screen, you can "Input the > email address, domain, or IP address",

...and indeed it does say that too...hmmm


> although I don't believe the IP blocking works

To state the obvious, you did select Black list ?

Also keep in mind that although the screen words say "reject" a blacklisted address message, that is not correct. The message will be tagged as spam and moved to the junkmail folder (if selected).
This is done at final delivery by procmail, which means these messages will still be passed to the virus scanner and therefore get quarantined if they have  a virus.
So using the Black list settings in the Spam filter panel does NOT reject messages (as suggested).
I proved this by testing it with email addresses.

If you implement the Virus & File filtering and RBL list rejection techniques, then that should take care of a  lot of incoming rubbish. Even if you get a lot on one day, the chances are that the external sending IP will get listed on RBL's within a few hours, so therefore future messages from that IP will get rejected tommorrow if they send from the same IP.
...

Offline raem

  • *
  • 3,972
  • +4/-0
SpamAssassin config question
« Reply #6 on: November 25, 2005, 09:33:27 AM »
ddougan

> although I don't believe the IP blocking works

I just checked that panel function again.

For Blacklisting Email address & *domainname, spam tagging works correctly.

For IP numbers blacklisting it does nothing, mail is sent to Inbox & I assume obeys the normal spam rules.
...

Offline ddougan

  • *
  • 155
  • +0/-0
    • http://www.DouganConsulting.com
SpamAssassin config question
« Reply #7 on: November 26, 2005, 05:47:31 AM »
Ray,

Very many thanks for your replies, and for your research. It's especially good to know the order in which mail is processed - it was difficult to determine where AV processing fits in relation to SA - so thanks for clarifying.

I am planning to look at your virus/file filtering contrib in a few minutes - didn't get there last night.

Regards,

Des
Des Dougan