Re Help with spamassassin+mailscanner

[Denis Beauchemin]

vinayan KP a écrit :
> Sir,
> When I built the server, I had only SUSE 10.2 and SUSE 10.3 was just
> out I think.  Our old server had a motherboard failure and could not
> find a replacement quickly. So had to buy a new server and get the
> server ready in a day.  I wish you will be kind enough to help me fix
> my problem.
>
>
> As I told you for SA score > Required SpamAssassin Score (= 3) it works.
>
>
> see the 3 sample headers below:
>
> Where
>
> X-yoursite-MailScanner ---> is the old mailscanner before mail server (M1)
> X-econdse-MailScanner ---> is the new postfix server (M2)
>
> ==========================================================
> X-yoursite-MailScanner-Information: Please contact the ISP for more information
> X-yoursite-MailScanner: Found to be clean
> X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (score=35.003,
>      required 3, autolearn=spam, BAYES_99 3.50, FORGED_MUA_OUTLOOK 4.06,
>      FORGED_RCVD_HELO 0.14, INVALID_MSGID 2.19, RCVD_IN_SORBS_DUL 2.05,
>      RCVD_IN_XBL 3.90, URIBL_AB_SURBL 3.81, URIBL_JP_SURBL 4.09,
>      URIBL_OB_SURBL 3.01, URIBL_SBL 1.64, URIBL_SC_SURBL 4.50,
>      URIBL_WS_SURBL 2.14)
> X-yoursite-MailScanner-SpamScore: sssssssssssssssssssssssssssssssssss
> X-yoursite-MailScanner-From: rosendowithoutholden at greenbuilder.com
> Subject: {Spam?} Most Popular Watches of All Trademarks
> X-Spam-Status: Yes, Yes
> X-econdse-MailScanner-Information: Please contact the ISP for more information
> X-econdse-MailScanner: Found to be clean
> X-econdse-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
>      score=11.515, required 3, BAYES_99 3.50, FORGED_MUA_OUTLOOK 4.06,
>      FORGED_RCVD_HELO 0.14, INVALID_MSGID 2.19, URIBL_SBL 1.64)
> X-econdse-MailScanner-SpamScore: sssssssssss
> =============================================================
>
> X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (score=20.545,
>      required 3, autolearn=spam, BAD_ENC_HEADER 3.10, BAYES_99 3.50,
>      FROM_EXCESS_QP 0.00, RCVD_IN_BL_SPAMCOP_NET 4.00,
>      RCVD_IN_SORBS_DUL 2.05, SUBJECT_EXCESS_QP 0.00, URIBL_AB_SURBL 3.81,
>      URIBL_JP_SURBL 4.09)
> X-yoursite-MailScanner-SpamScore: ssssssssssssssssssss
> X-yoursite-MailScanner-From: tracy-hlahjaks at tombushmazda.dealerspace.com
> X-Spam-Status: Yes, Yes
> X-econdse-MailScanner-Information: Please contact the ISP for more information
> X-econdse-MailScanner: Found to be clean
> X-econdse-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=6.146,
>      required 3, BAD_ENC_HEADER 3.10, BAYES_60 1.00, FROM_EXCESS_QP 0.00,
>      RCVD_IN_SORBS_DUL 2.05, SUBJECT_EXCESS_QP 0.00)
> X-econdse-MailScanner-SpamScore: ssssss
>
> =================================================================
>
> X-yoursite-MailScanner-Information: Please contact the ISP for more information
> X-yoursite-MailScanner: Found to be clean
> X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (score=21.744,
>      required 3, BAYES_99 3.50, SUBJECT_DRUG_GAP_P 0.70,
>      URIBL_AB_SURBL 3.81, URIBL_JP_SURBL 4.09, URIBL_OB_SURBL 3.01,
>      URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)
> X-yoursite-MailScanner-SpamScore: sssssssssssssssssssss
> X-yoursite-MailScanner-From: leonore_fideliaeb at focusers.com
> X-Spam-Status: Yes, Yes
> X-econdse-MailScanner-Information: Please contact the ISP for more information
> X-econdse-MailScanner: Found to be clean
> X-econdse-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
>      score=20.244, required 3, BAYES_80 2.00, SUBJECT_DRUG_GAP_P 0.70,
>      URIBL_AB_SURBL 3.81, URIBL_JP_SURBL 4.09, URIBL_OB_SURBL 3.01,
>      URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)
> X-econdse-MailScanner-SpamScore: ssssssssssssssssssss
>
> =================================================================
> Here the mailscanner on new server gets almost equal score in 3rd
> heardr, less in 2nd header and very less score in 3rd header and check
> lesser lists.  Why this happens?
>
>
>
>
>
> Find below 2 headers for mails which the old mailscanner finds as spam
> and the new mailscanner finds as clean.
>
> -----------------------------------------------------------------------------------------------------------------------------
> X-yoursite-MailScanner-Information: Please contact the ISP for more information
> X-yoursite-MailScanner: Found to be clean
> X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (score=10.601,
>      required 3, BAYES_50 0.00, HTML_10_20 1.35, HTML_MESSAGE 0.00,
>      PLING_QUERY 0.51, URIBL_JP_SURBL 4.09, URIBL_OB_SURBL 3.01,
>      URIBL_SBL 1.64)
> X-yoursite-MailScanner-SpamScore: ssssssssss
> X-yoursite-MailScanner-From: surjeet1978 at gmail.com
> X-Spam-Status: Yes, No
> X-econdse-MailScanner-Information: Please contact the ISP for more information
> X-econdse-MailScanner: Found to be clean
> X-econdse-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
>      score=0.678, required 3, BAYES_05 -1.11, HTML_MESSAGE 0.00,
>      INFO_TLD 1.27, PLING_QUERY 0.51)
>
> --------------------------------------------------------------------------------------------------------------------------
> X-yoursite-MailScanner-Information: Please contact the ISP for more information
> X-yoursite-MailScanner: Found to be clean
> X-yoursite-MailScanner-SpamCheck: spam, SpamAssassin (score=27.176,
>      required 3, autolearn=spam, BAYES_99 3.50,
>      RCVD_IN_BL_SPAMCOP_NET 4.00, RCVD_IN_SORBS_DUL 2.05,
>      RCVD_IN_XBL 3.90, URIBL_JP_SURBL 4.09, URIBL_OB_SURBL 3.01,
>      URIBL_SC_SURBL 4.50, URIBL_WS_SURBL 2.14)
> X-yoursite-MailScanner-SpamScore: sssssssssssssssssssssssssss
> X-yoursite-MailScanner-From: c_rosamaria_iz at honeywell.com
> X-Spam-Status: Yes, No
> X-econdse-MailScanner-Information: Please contact the ISP for more information
> X-econdse-MailScanner: Found to be clean
> X-econdse-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
>      score=1.298, required 3, BAYES_00 -2.60, RCVD_IN_XBL 3.90)
> X-econdse-MailScanner-SpamScore: s
> X-econdse-MailScanner-From: c_rosamaria_iz at honeywell.com
> -------------------------------------------------------------------------------------------------------------------------------
>
> What should I do so that new mailscanner also gets a high score for
> the above two mails and get tagged as {Spam?}
>
> Regards
> Vinu
>
>   

Vinu,

Go to /etc/mail/spamassassin on your old server and grep URIBL in all 
files.  You will most likely find a .cf file with many URIBL hits (mine 
is called spamcop_uri.cf).  Copy that file to /etc/mail/spamassassin on 
your new server to score the URIBL* rules that you are looking for.

Also on your new server, make sure you have the following lines in any 
of the *.pre files (from my 3.2.4 files):
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
loadplugin Mail::SpamAssassin::Plugin::DCC
loadplugin Mail::SpamAssassin::Plugin::SpamCop
loadplugin Mail::SpamAssassin::Plugin::URIDetail
loadplugin Mail::SpamAssassin::Plugin::Bayes
loadplugin Mail::SpamAssassin::Plugin::BodyEval
loadplugin Mail::SpamAssassin::Plugin::DNSEval
loadplugin Mail::SpamAssassin::Plugin::HTMLEval
loadplugin Mail::SpamAssassin::Plugin::HeaderEval
loadplugin Mail::SpamAssassin::Plugin::MIMEEval
loadplugin Mail::SpamAssassin::Plugin::RelayEval
loadplugin Mail::SpamAssassin::Plugin::URIEval
loadplugin Mail::SpamAssassin::Plugin::WLBLEval

Then, reload MailScanner.

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x62252 F: 819.821.8045