LinuxQuestions.org - Need spamassassin config help

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - Need spamassassin config help (https://www.linuxquestions.org/questions/linux-server-73/need-spamassassin-config-help-519549/)

Need spamassassin config help

Right, I need to have spamassassin tag mails with a score above 4.5 - that is done in local.cf file - no problems. But I also need spamassassin to delete mails with a score above 10 - how do I do that, and still keep the normal rewrite subject with a score of 4.5?

The local.cf part is easy, that would simply include the line:

required_hits 4.5

The deleting I think falls outside of spamassassin. That is done by another agent using the spamassassin score. In my case, I have a qmail scanner installed, and it can delete based on the spam score. It tags mail as spam if the score is greater than X, and you can add a line making it so anything with a score 5.5 greater than the minimum score (4.5 + 5.5 = 10.0) would get deleted.

You could check on having spamassassin delete in the document that comes with the spamassassin install. Just enter:

perldoc Mail::SpamAssassin::Conf

on the machine that has spamassassin installed.

Peace,
JimBass

If you already have the two-tiered approach (almost-certainly-spam and probably-spam folders for your mail), just change almost-certainly-spam to /dev/null in your .procmailrc file and be aware that you may lose the occasional false positive. There's more info at http://wiki.apache.org/spamassassin/...ailsMarkedSpam

Here is how I'm doing it in local.cf:

Code:

#  Set the threshold at which a message is considered spam (default: 5.0)

#

required_score 7.0

5.0 is quite aggressive and I'm encountering false positives so I changed it to 7.0. SA recommends 8.0 if you are an ISP or hosting several domains. 5.0 is only for private servers.

I've integrated SA with amavisd-new and by adjusting amavisd.conf, certain levels of spam can be deleted and no longer need quarantined as you would wish.

Code:

$#$sa_quarantine_cutoff_level = 20; # spam level beyond which quarantine is off

But I'm not changing this because I need information from my qurantine in order to block spam relays.

------
GANI

I'm using the programs from the guide on www.qmailrocks.com.

JimBass: As I wrote the req_hits in local.cf is configures properly, but I still get mails with a score above 10 (they are then marked with [*SPAM*] in the header) - but instead of using bandwith on downloading them from the server, I would like to delete then.

gilead: thanks for the link, I'll just have a look at it.

gani: Cheers, the last option you write, does it go in local.cf or??

You should have posted up front that you were using qmailrocks! The way to do what you're looking for is in plain text -
http://qmailrocks.org/qmailscanner_db.htm

Code:

Can I delete e-mails that Spamassassin labels as spam?



Yes. Edit the /var/qmail/bin/qmail-scanner-queue.pl file and find the following line:



my $sa_delete='0';



Now replace the '0' with a number that represents how far above your SpamAssassin "required_hits" variable that Qmail-scanner should start deleting messages at. For example, if you SpamAssassin required_hits variable is set to "5" and you set the "sa_delete" variable to "1.0", then any message that has a spam score of 1.0 over the "5" mark would be deleted. In other words, any mail with a score of 6 or more would be trashed automatically. So for this example, you would change the "sa_delete" variable as follows:



my $sa_delete='1.0';

In your case, if 4.5 marks it as spam, and you want 10.0 and above deleted, then make "my $sa_delete='5.5';"

Peace,
JimBass

Quote:

Originally Posted by JimBass

You should have posted up front that you were using qmailrocks! The way to do what you're looking for is in plain text -
http://qmailrocks.org/qmailscanner_db.htm

Code:

Can I delete e-mails that Spamassassin labels as spam?



Yes. Edit the /var/qmail/bin/qmail-scanner-queue.pl file and find the following line:



my $sa_delete='0';



Now replace the '0' with a number that represents how far above your SpamAssassin "required_hits" variable that Qmail-scanner should start deleting messages at. For example, if you SpamAssassin required_hits variable is set to "5" and you set the "sa_delete" variable to "1.0", then any message that has a spam score of 1.0 over the "5" mark would be deleted. In other words, any mail with a score of 6 or more would be trashed automatically. So for this example, you would change the "sa_delete" variable as follows:



my $sa_delete='1.0';

In your case, if 4.5 marks it as spam, and you want 10.0 and above deleted, then make "my $sa_delete='5.5';"

Peace,
JimBass

Yup - just after I posted it I remembered that I use the qmail-scanner-queue (with C wrapper). I have just dited the file, and it seems like it is working properly now.

(mental note to myself - next time, use brain.. :))

Quote:

gani: Cheers, the last option you write, does it go in local.cf or??

/etc/amavisd.conf

I'm using Postfix amavisd-new, SA and ClamAV plus other contributed tarpitting mitigations combined with Postgrey
and HELO rejections I'm able to block not less 95% of spams and prevents spammers reaching DATA and saving
lots of bandwidth and CPU resource.

--------
GANI