users who get more than there share of spam

[Julian Field]

John Baker wrote:
> I do use most of this stuff. What is kam? I'm not familiar with that one.
You can get it from:
http://www.peregrinehw.com/downloads/SpamAssassin/contrib/KAM.cf

I get it every day on a cron job. I have attached the cron job for you. 
Just unpack the zip file, bung it in /etc/cron.daily and make sure it's 
rwxr-xr-x. It does a random delay before fetching the file, so as to not 
stress their poor server too much.

It's *very* useful.
> I use sare rules from Rules emporium but I've probably been to 
> conservative about this and added more this morning.
>
> I'll see how things look a few after some tuning up here and then put 
> what's getting through up.
>
> Thanks,
>
> John
> Scott Silva wrote:
>> on 5-27-2008 12:59 PM John Baker spake the following:
>>> Hi all,
>>>
>>> I wondered if any of the experts on the list had any suggestions for 
>>> this problem.
>>>
>>> I have a few users who gave their name to the wrong website and get 
>>> way more than there share of spam.  I've been trying to figure out a 
>>> way to bring those numbers down for them.
>>>
>>> Most of the spam coming through to us either doesn't make it past 
>>> the geylist or gets marked  by the Mailscanner process and then sent 
>>> to a junk folder by procmail upon delivery. These folks get hundreds 
>>> in the junk mail folder every day and hundreds per week that slip 
>>> through the process. It makes their mail unmanageable particularly 
>>> as we are in an area where many of them still have to retrieve their 
>>> mail with a 28k dialup connection when they are at home.
>>>
>>> At this point it seems as though improving the spam marking process 
>>> for us would involve spending money on external services that we 
>>> don't have to spend and it is working well enough for the average 
>>> user. Would anybody have any suggestions on how to help users who 
>>> get caught up in this sort of thing short of giving them a new 
>>> address and bouncing everything to the old one?
>>>
>>> Thanks
>> What are you using for options to spamassassin?
>> Any digests like razor or pyzor?
>> Any other rules like kam or some of the sare rules?
>> Blacklists?
>>
>> If you can post links to a couple COMPLETE mail files, either from 
>> queue files or quarantined, others here will run them through our 
>> systems and post the results we get.
>>
>
>

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules at Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: KAM.cf.sh.zip
Type: application/zip
Size: 741 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20080528/814c55a4/KAM.cf.sh-0001.zip