SA Network Tests

[Martin Hepworth]

Rodney

don't so this here, do in in SA .

edit spam.assassin.prefs.conf

comment out the "skip_rbl_tests 1" line

and turn off the RBL's you don't want by giving them a zero
score...here's mine that only runs the xbl and orb ones..

score __RCVD_IN_NJABL 0.0
score RCVD_IN_NJABL_DUL 0.0
score RCVD_IN_NJABL_MULTI 0.0
score RCVD_IN_NJABL_PROXY 0.0
score RCVD_IN_NJABL_RELAY 0.0
score RCVD_IN_NJABL_SPAM 0.0
score RCVD_IN_NJABL_CGI 0.0
score __RCVD_IN_SORBS 0.0
score RCVD_IN_SORBS_HTTP 0.0
score RCVD_IN_SORBS_MISC 0.0
score RCVD_IN_SORBS_SMTP 0.0
score RCVD_IN_SORBS_SOCKS 0.0
score RCVD_IN_SORBS_WEB 0.0
score RCVD_IN_SORBS_BLOCK 0.0
score RCVD_IN_SORBS_ZOMBIE 0.0
score RCVD_IN_SORBS_DUL 0.0
score __RFC_IGNORANT_ENVFROM 0.0
score DNS_FROM_RFC_DSN 0.0
score DNS_FROM_RFC_POST 0.0
score DNS_FROM_RFC_ABUSE 0.0
score DNS_FROM_RFC_WHOIS 0.0
score DNS_FROM_RFC_BOGUSMX 0.0
score RCVD_IN_DSBL 0.0
score DNS_FROM_AHBL_RHSBL 0.0
score HABEAS_INFRINGER 0.0
score HABEAS_USER 0.0
score RCVD_IN_BSP_TRUSTED 0.0
score RCVD_IN_BSP_OTHER 0.0
score __SENDERBASE 0.0
score SB_NEW_BULK 0.0
score SB_NSP_VOLUME_SPIKE 0.0
score RCVD_IN_RSL 0.0
score RCVD_IN_MAPS_RBL 0.0
score RCVD_IN_MAPS_DUL 0.0
score RCVD_IN_MAPS_RSS 0.0
score RCVD_IN_MAPS_NML 0.0


Also make sure you set the trusted_networks and internal_networks
options properly or it's likely to misfire and start letting the spam
through
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html#network_test_options

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Rodney Green wrote:
> For the "Spam List =" configuration option in MailScanner.conf, it says
> you can use a ruleset file. What format would you use to list the RBLs?
>
>
> Martin Hepworth wrote:
>
>> Ah I see
>>
>> well network tests cover RBL's, URI-RBL's from surbl.org and perhaps
>> even things like pyzor/dcc etc.
>>
>> I run a couple of RBL's and the URI-RBL's which are truely great.
>>
>> Not sure they'll help with FP's, but if bayes is FP-ing then enableing
>> the network tests will reduce the bayes scores in SA 3.x.
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Rodney Green wrote:
>>
>>> Martin,
>>>
>>> Truthfully, I don't know yet. I'm not even sure of what's all available.
>>> I saw something stating that the network tests helped to reduce false
>>> negatives. So, something that would help with that would be great.
>>>
>>> Thanks,
>>> Rodney
>>>
>>> Martin Hepworth wrote:
>>>
>>>> Rodney
>>>>
>>>> what 'network tests' are you interested in?
>>>>
>>>> see the doccy at spamassassin.apache.org for the options you can put
>>>> into spam.assassin.prefs.conf.
>>>>
>>>> --
>>>> Martin Hepworth
>>>> Snr Systems Administrator
>>>> Solid State Logic
>>>> Tel: +44 (0)1865 842300
>>>>
>>>>
>>>> Rodney Green wrote:
>>>>
>>>>> Martin,
>>>>>
>>>>> Thanks, I'll look into how to do that. :-) I'm not familiar with
>>>>> spamd.
>>>>>
>>>>> Rodney
>>>>>
>>>>> Martin Hepworth wrote:
>>>>>
>>>>>> Rodney
>>>>>>
>>>>>> just put the spamd settings into spam.assassin.prefs.conf and MS will
>>>>>> use them for the SA part.
>>>>>>
>>>>>> --
>>>>>> Martin Hepworth
>>>>>> Snr Systems Administrator
>>>>>> Solid State Logic
>>>>>> Tel: +44 (0)1865 842300
>>>>>>
>>>>>>
>>>>>> Rodney Green wrote:
>>>>>>
>>>>>>> Is it possible to enable SA network tests when running it with MS?
>>>>>>> I've
>>>>>>> searched and only found reference to it in relation to running
>>>>>>> spamd,
>>>>>>> which I'm not using.
>>>>>>>
>>>>>>> Thanks,
>>>>>>> Rodney
>>>>>>>
>>>>>>> --
>>>>>>> This message has been scanned for viruses and
>>>>>>> dangerous content by MailScanner, and is
>>>>>>> believed to be clean.
>>>>>>>
>>>>>>> ------------------------ MailScanner list ------------------------
>>>>>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>>> 'leave mailscanner' in the body of the email.
>>>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>>>
>>>>>>> Support MailScanner development - buy the book off the website!
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> **********************************************************************
>>>>>>
>>>>>>
>>>>>> This email and any files transmitted with it are confidential and
>>>>>> intended solely for the use of the individual or entity to whom they
>>>>>> are addressed. If you have received this email in error please notify
>>>>>> the system manager.
>>>>>>
>>>>>> This footnote confirms that this email message has been swept
>>>>>> for the presence of computer viruses and is believed to be clean.
>>>>>>
>>>>>> **********************************************************************
>>>>>>
>>>>>>
>>>>>> ------------------------ MailScanner list ------------------------
>>>>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>>> 'leave mailscanner' in the body of the email.
>>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>>
>>>>>> Support MailScanner development - buy the book off the website!
>>>>>>
>>>>>
>>>>> --
>>>>> Rodney Green
>>>>> Network/Security Administrator
>>>>> Trayer Products, Inc.
>>>>> E-Mail: rgreen at trayerproducts.com
>>>>> Phone: 607-734-8124 Ext. 343
>>>>>
>>>>> --
>>>>> This message has been scanned for viruses and
>>>>> dangerous content by MailScanner, and is
>>>>> believed to be clean.
>>>>>
>>>>> ------------------------ MailScanner list ------------------------
>>>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>>> 'leave mailscanner' in the body of the email.
>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>>
>>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> **********************************************************************
>>>>
>>>> This email and any files transmitted with it are confidential and
>>>> intended solely for the use of the individual or entity to whom they
>>>> are addressed. If you have received this email in error please notify
>>>> the system manager.
>>>>
>>>> This footnote confirms that this email message has been swept
>>>> for the presence of computer viruses and is believed to be clean.
>>>>
>>>> **********************************************************************
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>
>>> --
>>> Rodney Green
>>> Network/Security Administrator
>>> Trayer Products, Inc.
>>> E-Mail: rgreen at trayerproducts.com
>>> Phone: 607-734-8124 Ext. 343
>>>
>>> --
>>> This message has been scanned for viruses and
>>> dangerous content by MailScanner, and is
>>> believed to be clean.
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>
>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> --
> Rodney Green
> Network/Security Administrator
> Trayer Products, Inc.
> E-Mail: rgreen at trayerproducts.com
> Phone: 607-734-8124 Ext. 343
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!