Permanent white listing

[Georges A. Tomazi]

Hi,

A 13:48 17/06/2002 +0100, Julian Field a écrit :

[...]

>Look at www.eicar.org.

Thx.

>>However, spam filtering doesn't work as expected. No matter the contents of
>>a message, it gets always marked as "whitelisted" - and I'm not using any
>>white listing. For example, these are the headers with a test spam sent
>>from some external account :
>>
>>Accept Spam From =
>
>Try commenting out all the "Accept Spam From" lines, rather than leaving
>them blank. I suspect the configuration file reader is seeing that as 'any
>network whose IP addresses match ""' which is all of them.

Much better, this time I get in the headers (for the same message) :

[...]

Subject: {SPAM?} This is a SPAM !
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: SpamAssassin (score=11.3, required 5, PLING_PLING,
PLING, DOUBLE_CAPSWORD, ONCE_IN_LIFETIME, CALL_FREE, REMOVE_SUBJ,
LINES_OF_YELLING, FREQ_SPAM_PHRASE, X_RCVD_IN_UNCONFIRMED_DSBL)

[...]

However I don't get the usual SpamAssassin behaviour such (for the same
message again) :

Subject: *****SPAM*****
X-Spam-Status: Yes, hits=12.7 required=5.0
         tests=DATE_MISSING,X_NOT_PRESENT,FROM_MISSING,SUBJ_MISSING,
               INVALID_DATE,DOUBLE_CAPSWORD,ONCE_IN_LIFETIME,CALL_FREE,
               REMOVE_SUBJ,LINES_OF_YELLING,FREQ_SPAM_PHRASE,
               MISSING_HEADERS
         version=2.30
X-Spam-Flag: YES
X-Spam-Level: ************
X-Spam-Checker-Version: SpamAssassin 2.30 (devel $Id: SpamAssassin.pm,v
1.94 2002/06/14 23:17:15 hughescr Exp $)

SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details:   (12.7 hits, 5 required)
SPAM: DATE_MISSING       (-2.1 points) Missing Date: header
SPAM: X_NOT_PRESENT      (-1.9 points) Message has no X- headers
SPAM: FROM_MISSING       (4.3 points)  Missing From: header
SPAM: SUBJ_MISSING       (1.4 points)  Subject: is empty or missing
SPAM: INVALID_DATE       (0.5 points)  Invalid Date: header (not RFC 822)
SPAM: DOUBLE_CAPSWORD    (1.1 points)  BODY: A word in all caps repeated on
the line
SPAM: ONCE_IN_LIFETIME   (1.8 points)  BODY: Once in a lifetime, apparently
SPAM: CALL_FREE          (0.7 points)  BODY: Contains a tollfree number
SPAM: REMOVE_SUBJ        (3.4 points)  BODY: List removal information
SPAM: LINES_OF_YELLING   (-0.0 points) BODY: A WHOLE LINE OF YELLING DETECTED
SPAM: FREQ_SPAM_PHRASE   (2.4 points)  Contains phrases frequently found in
spam
SPAM:                    [score:  17, hits: all information, are you,]
SPAM:                    [federal legislation, for your, from our, future]
SPAM:                    [mailings, mail address, our company, permanently]
SPAM:                    [removed, please send, remove the, removed from,]
SPAM:                    [subject line, that can, the subject, word]
SPAM:                    [remove, you for, you like, you need, you not,]
SPAM:                    [you with, your mail]
SPAM: MISSING_HEADERS    (1.1 points)  Missing To: header
SPAM:
SPAM: -------------------- End of SpamAssassin results ---------------------

My main interest is in the "X-Spam-*" headers.

I didn't disable any option in my "spam.assassin.prefs.conf" :

required_hits           5
auto_report_threshold   30
ok_locales              en
score RCVD_IN_BL_SPAMCOP_NET    4
score RCVD_IN_RBL               10
score RCVD_IN_RSS               1
score RCVD_IN_DUL               1

Can I get the "regular" SpamAssassin headers and comments ?

One more question : before trying to use MailScanner / SpamAssassin, I had
quite a lot of filtering rules (headers consistency, RBL, some virus
signature checking, address ans domain lookups, etc...). I guess that I
should disable them since MailScanner/SpamAssassin are doing pretty much
the same job and as two sendmail are running all checks will be redundant.
Am I right ?

[...]

Thanks again !

Georges

--
Georges A. Tomazi - gt at diapason.com