bayes 00
Jim Coates
jimc at LARIDIAN.COM
Thu Mar 3 23:28:16 GMT 2005
I will take a look at the archives.
I think my settings on bayes and SpamAssassin are decent, as there really
are only a couple users that are getting much of anything.
Thanks,
Jim
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Peter Russell
Sent: Thursday, March 03, 2005 4:57 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: bayes 00
umm maybe you should be thinking about bayes and spam assassin setting son
your server. Most folks dont get many spams thorugh on a well tuned gateway.
Then once you are sure you ahve done everything you can move onto catching
and learning from the users?
The outlook bit has been discussed many times in the archives.
Jim Coates wrote:
> The concern with using IMAP for us is that my company's employees
> aren't centrally located (IE - we aren't all in the same office) and I
> don't trust IMAP without being part of the VPN etc.
>
> I could make everyone log in to the VPN and then copy over to IMAP,
> but it would cause their Outlook etc to give failure notices anytime
> they weren't connected to the VPN (as the IMAP accounts would not be
> able to be reached).
>
> We don't leave any copies of mail on the server itself once the user
> pulls it down, so I can't have them log back in via webmail etc to
> move it either.
>
> Hmmm...
>
> I'd like to hear what others are doing, as we have a couple users that
> in spite of the MailScanner and SpamAssassin settings, they are still
> getting a good deal of spam per day.
>
> Thanks,
> Jim Coates
> Laridian, Inc.
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Peter Russell
> Sent: Thursday, March 03, 2005 4:37 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: bayes 00
>
>
> YEah tghis is everyone's concern. Its been documented in the archives
> that most people attempt to use either an IMAP script on the
> mailscanner machine to pull the mail from the
> exchange/groupwise/domino server to an mbox/maildir and then run
> sa-learn on - as imap does a copy basically, rather than forwarding
> and destroying the original headers.
>
> Or even better is have access on your mail system so everyone can COPY
> into another mailbox and then run sa-learn on it.
>
> You could get bayes to ignore all the headers and just learn the
> content?
>
> I am not sure what everyone does about checking through all the mail
> to make sure the usrs ahvent put ham in the spa,m box etc
>
>
> Jim Coates wrote:
>
>>I've toyed with the idea of creating a mailbox for SPAM and HAM that
>>users can forward email into to be learned using a CRON job.
>>
>>However, I'm concerned that since they would be forwarding the email,
>>the headers would be incorrect (different from the original).
>>
>>Is there a way around this as it seems ideal to simply let users
>>forward email that they consider SPAM into some sort of account the be
>>learned on a CRON basis by SpamAssassin?
>>
>>Jim Coates
>>Laridian, Inc.
>>
>>-----Original Message-----
>>From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>>Behalf Of Peter Russell
>>Sent: Thursday, March 03, 2005 3:20 PM
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: bayes 00
>>
>>
>>Then its really hard - unlress you archive a users or a lot of
>>incoming mail for a while, OR setup a mailbox to spam and ham on your
>>servers. Again, it will require a little planning and research. There
>>is a guide in the maq on www.mailscanner.info and plebnty in the list
>>archives.
>>
>>Let us know how you go.
>>
>>
>>David Curtis wrote:
>>
>>
>>>Thanks.
>>>I am not sure how to sa-learn in this case. We are setup as a gateway
>>>for an GroupWise server.
>>>
>>>
>>>
>>>
>>>>>>martinh at SOLID-STATE-LOGIC.COM 03/03 10:14 AM >>>
>>>
>>>David
>>>
>>>you have to teach bayes when it's wrong. (see info in sa-learn)
>>>
>>>also having alot of the rules from www.rulesemporium.com/rules.htm
>>><http://www.rulesemporium.com/rules.htm> can help alot too. Drip feed
>>>them in and see which ones help the most.
>>>
>>>DO NOT use bigevil.cf, instead make sure the URI-RBL's are turned on,
>>>again these help alot.
>>>
>>>
>>>--
>>>Martin Hepworth
>>>Snr Systems Administrator
>>>Solid State Logic
>>>Tel: +44 (0)1865 842300
>>>
>>>
>>>David Curtis wrote:
>>>
>>>>Fresh install of Fedora Core 3. Postfix 2.2 Fresh install of SA
>>>
>>>3.0.2. > Fresh install of Razor and DCC and MailScanner 4.39.6-1. I
>>>followed the > MailScanner install doc. >
>>>
>>>> >>> martinh at SOLID-STATE-LOGIC.COM 03/03 9:41 AM >>>
>>>>David
>>>>
>>>>restore from an earlier version...?? You backup the thing, yes???
>>>>
>>>>Anyway reminds us what extra rules you run like the SARE ones etc..
>>
>>They
>>
>>
>>>>may help. What version of SA and do you run the URI-RBL stuff?
>>>>
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>David Curtis wrote:
>>>> > I think my bayes is messed up. I have several dozen e-mails that
>>>>I
>>>
>>>think
>>>
>>>> > are spam. The rule for bayes_00 is letting it through. > Here
>>>>is the score: > X-SBSD-MailScanner-SpamCheck: not spam,
>>>>SpamAssassin (score=3.294, > required 3.75, BAYES_00 -2.60,
>>>>DCC_CHECK 2.17, DIGEST_MULTIPLE
>>
>>0.10,
>>
>>
>>>> > HTML_90_100 0.02, HTML_IMAGE_RATIO_02 0.02, HTML_MESSAGE 0.00,
>>>>
>>>>> MIME_HTML_ONLY 0.18, RAZOR2_CF_RANGE_51_100 0.06, RAZOR2_CHECK
>>
>>1.51,
>>
>>
>>>> > RCVD_IN_NJABL_SPAM 1.84)
>>>> > X-SBSD-MailScanner-SpamScore: 3
>>>> >
>>>> > Any idea?
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> >
>>>> > This email may contain information protected under the Family >
>>>>Educational Rights and Privacy Act (FERPA) or the Health Insurance
>>>>
>>>>>Portability and Accountability Act (HIPAA). If this email
>>>>
>>>>contains > confidential and/or privileged health or student
>>>>information and you > are not entitled to access such information
>>>>under FERPA or HIPAA, > federal regulations require that you
>>>>destroy this email without > reviewing it and you may not forward
>>>>it to anyone. > > ------------------------ MailScanner list
>>>>------------------------ > To unsubscribe, email
>>>>jiscmail at jiscmail.ac.uk with the words: > 'leave mailscanner' in
>>>>the body of the email. > Before posting, read the MAQ
>>>>(http://www.mailscanner.biz/maq/) and > the archives
>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>> >
>>>> > Support MailScanner development - buy the book off the website!
>>>>
>>>><br
>>>
>>>/>*******************************************************************
>>>*
>>>**
>>>
>>>><br />
>>>><br />This email and any files transmitted with it are confidential
>>>>and <br />intended solely for the use of the individual or entity to
>>>>whom
>>>
>>>they
>>>
>>>><br />are addressed. If you have received this email in error please
>>>
>>>notify
>>>
>>>><br />the system manager.
>>>><br />
>>>><br />This footnote confirms that this email message has been swept
>>>><br />for the presence of computer viruses and is believed to be
>>>>clean. <br /> <br
>>>
>>>/>*******************************************************************
>>>*
>>>**
>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>>(http://www.mailscanner.biz/maq/) and the archives
>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>This email may contain information protected under the Family
>>>>Educational Rights and Privacy Act (FERPA) or the Health Insurance
>>>>Portability and Accountability Act (HIPAA). If this email contains
>>>>confidential and/or privileged health or student information and you
>>>>are not entitled to access such information under FERPA or HIPAA,
>>>>federal regulations require that you destroy this email without
>>>>reviewing it and you may not forward it to anyone.
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>>(http://www.mailscanner.biz/maq/) and the archives
>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>*Support MailScanner development - buy the book off the website!*
>>>
>>><br
>>>/>*******************************************************************
>>>*
>>>**
>>><br />
>>><br />This email and any files transmitted with it are confidential and
>>><br />intended solely for the use of the individual or entity to whom
they
>>><br />are addressed. If you have received this email in error please
>>
>>notify
>>
>>
>>><br />the system manager.
>>><br />
>>><br />This footnote confirms that this email message has been swept
>>><br />for the presence of computer viruses and is believed to be
>>>clean. <br /> <br
>>
>>/>********************************************************************
>>**
>>
>>
>>>------------------------ MailScanner list ------------------------ To
>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>(http://www.mailscanner.biz/maq/) and the archives
>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>This email may contain information protected under the Family
>>>Educational Rights and Privacy Act (FERPA) or the Health Insurance
>>>Portability and Accountability Act (HIPAA). If this email contains
>>>confidential and/or privileged health or student information and you
>>>are not entitled to access such information under FERPA or HIPAA,
>>>federal regulations require that you destroy this email without
>>>reviewing it and you may not forward it to anyone.
>>>
>>>------------------------ MailScanner list ------------------------ To
>>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>>mailscanner' in the body of the email. Before posting, read the MAQ
>>>(http://www.mailscanner.biz/maq/) and the archives
>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>*Support MailScanner development - buy the book off the website!*
>>
>>
>>------------------------ MailScanner list ------------------------ To
>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>mailscanner' in the body of the email. Before posting, read the MAQ
>>(http://www.mailscanner.biz/maq/) and the archives
>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>------------------------ MailScanner list ------------------------ To
>>unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
>>mailscanner' in the body of the email. Before posting, read the MAQ
>>(http://www.mailscanner.biz/maq/) and the archives
>>(http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> mailscanner' in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
> mailscanner' in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
>
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail at jiscmail.ac.uk with the words: 'leave
mailscanner' in the body of the email. Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner
mailing list