Topic: Messagewall versus Spamassassin

[Julian Luton]

Dear All,

The time has come for me to do something to stem the flood of spam my clients are getting.
At the moment they are all on 5.6
Does anyone have any experiences, postitive or negative, of Messagewall or Spamassassin recently?
I tried Spamassassin about a year agound and didn't find it that effective.
I particularly want something that will delete or quarantine spam as opposed to just flag it up.

All the best,
Julian

[Schotty]

Hello!
Well my mail server is 28 days old , running with Spamassasin.
So far 145 spams have been flagged and moved to folder Junkmail.
4 SpamMails have got into my inbox, and no mails reached the Junkmail which shouldnt be there!
And I am using a score of 8!!!!

The problem with deleting spams automaticaly is what happens when a mail is deleted and it isnt a spam??

I am very happy with spamassasin.


Schotty

[Julian Luton]

Good to hear Schotty

Anyone out there using messagewall?

[Ray Mitchell]

Schotty wrote:
> The problem with deleting spams automaticaly is what happens
> when a mail is deleted and it isnt a spam??
 
I am also a recent user of spamassassin (using the Greg Zartman version for sme 5.6) and it is working quite well.

It seems to me that during the initial period of use, manual scanning of the tagged spam messages is needed in order for you to identify email that is wanted and put those source addressess into spamassassins white list.

If you are using POP delivery you can setup message rules in your email client to delete or move the messages tagged as spam, or for that matter setup a procmail rule on a per user basis to do a similar thing.

Regards
Ray

[Tim Litwiller]

I have used both and far prefer spamassassin.  You do have to keep it up to date tho since spammers also know about it and run thier spam thru it and tweak it to get it to score lower.

I installed Gregs contrib and then  I check for updated spamassassin rpms and install them when ever they come out.

This doesn't break Gregs contrib.  A few of his settings are out of date on the new versions but it just ignores them.

On contribs.org or somewhere I found another install that updates some of the config  setting.
add this to /etc/mail/spamassassin/local.cf
spam_level_stars 1 so it adds a header with a star for each whole point of the spam score then you can use the procmail rules below to get rid of the spam

I have spamassassin tag the email and then in .procmailrc I have several rules

# ------------------------------
# Kill high score messages - over 15
# ------------------------------
:0:
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*.*
/dev/null

# ------------------------------
# sort likely spam over 9 to another mail box
# ------------------------------
:0:
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*.*
! spamreview@domain.com

# ------------------------------
# sort the rest of tagged spam to imap spam folder
# ------------------------------
:0:
* ^X-Spam-Status: Yes
spam

[Tim Litwiller]

ps.
add subject_tag STRING [SPAM-_hits_ ] to the config file makes a suject change that reads like
[SPAM-14.3] subject of spam

[Julian Luton]

Brilliant stuff

Thanks for all the feedback guys - I'll go ahead with Spamassassin and if I come across any more usefull gotcha's I will of course post them back.

All the best,
Julian

[Craig F.]

Messagewall filters at the mailserver level, and drops control connections (with a 552 error) when certain words, headers, mailers, relays, viruses, etc appear. It's a fairly static beast, though. Other than the occasional addition to the small list of common words, it doesn't change processing much.

SpamAssasin trains using the mail that is already on your system, and uses that to assume whether and e-mail is spam or not. It is way more dynamic, and because of this, it requires a bit of hand-holding... This *is* the more accurate of the two. It just depends on how much effort you want to put in.

They are two different beasts. While it's easy to look at it as an "or" question, the overhead on messagewall is small enough that "both" can be an option. Messagewall on a P166 debian machine is filtering a schools' Exchange servers (1000+ students)


Craig F.


PS Yes I am a slight bit biased, as I released the MessageWall e-smith contrib to go with the messagewall RPM of Charlie Brady's. I still think "both" could still be an option.