spamaction highscore rules.

Martin Hepworth maxsec at gmail.com
Fri May 15 09:42:11 IST 2009


Kasper
You should be able to do a lookup on the fly (look-a-head). How you do this
depends on the MTA but there are lots of info on this in the wiki.

1GB ram won't help - be careful on the number of children and batch size,
with 1GB ram you'll need to keep that down. maybe 2 children and 20 as the
batch size.

-- 
Martin Hepworth
Oxford, UK

2009/5/15 Kasper Sacharias Eenberg <kse at hovmark.dk>

>  Unfortunately, we do not, completely that is.
>
> I implemented some user checking. But we have many mailservers running.
> Lotus Domino, Microsoft Exchange, Zarafa and simply postfix/dovecot.
> It's a pain gathering from that many servers.
> It's on my todo list though.
> I'll prioritize it up.
>
> The main problem however, might be that the server only has 1GB of ram, for
> some reason or other.
> The other spamfilters have better hardware, but this is used as our
> primary, until i set up replication of rules and such. And add more filters.
>
> Tuning has been done on all servers.
>
>
> With regards,
>   ------------------------------
>
>
> Kasper Eenberg
>
> *HOVMARK DATA*
> Ravnevej 13
> dk-6705 Esbjerg Ø
> tlf:   +45 76 12 59 04
> mobil: +45 40 70 69 63
>
> On Fri, 2009-05-15 at 08:47 +0100, Martin Hepworth wrote:
>
> Kasper
>
>
>
>  I presume you do things like drop unknown users at the MTA? This can
> reduce the load by well over 50%. Also have a look in the wiki about
> performance tuning MailScanner - local caching nameserver, using only a few
> RBL's etc etc.
>
>
>
>  --
>
>  Martin
>
>  2009/5/15 Kasper Sacharias Eenberg <kse at hovmark.dk>
>
>  Thanks for the help.
>
> But i'm afraid this server is already way overloaded, and that this might
> kill it.
> Are there any alternatives to this? Any rules i can write?
>
> Adding "To:             @eurocargoservices.dk delete" does not work, as
> you say.
>
>
> With regards,
>
>
>   ------------------------------
>
>
>
> Kasper Eenberg
>
> *HOVMARK DATA*
> Ravnevej 13
> dk-6705 Esbjerg Ø
> tlf:   +45 76 12 59 04
> mobil: +45 40 70 69 63
>
>
>
>   On Wed, 2009-05-13 at 09:59 +0100, Martin Hepworth wrote:
>
>
>
> Best way to avoid this situation is split the email up into individual
> recipients and then the rules on forwarding will work fine. The problem is
> if the 'to' contains multiple recipients and gives conflicting actions eg
> deliver and not-deliver which one should it obey???? MailScanner can't get
> which one is correct so uses the Envelope-To: as the overriding value.
>
>
> How to split the emails up is dependant on the MTA you use but sendmail,
> Exim and Postfix are covered in the wiki (
> http://wiki.mailscanner.info/doku.php?id=&idx=documentation:configuration:mta
> )
>
>
> --
> Martin Hepworth
> Oxford, UK
>
> 2009/5/13 Kasper Sacharias Eenberg <kse at hovmark.dk>
>
> So, i embarassed myself to my company yesterday.
>
> I managed to write a highscore rule that passed on all spam mails, that it
> should be dropping.
> But nevermind that.
>
>
> My problem is, i have two domains.
> eurocargoservices.de
> eurocargoservices.dk
>
> The .de company wants to receive all spam mails. They receive alot of mails
> from China and russia, which normally get tagged as spam (Since i took over
> the filter it now work quite well though, ignoring them).
>
>
> However, som spam mails are sent with both the .de and .dk domain in the
> 'to' header.
> And when the .de domain is in the recipient, the rule that delivers mail to
> .de takes action, and the spam is delivered to the .dk.
>
> It seems "Use Default Rules With Multiple Recipients = yes" does not work.
>
> These are the rules:
> To:             @eurocargoservices.de deliver
> FromOrTo:       default         forward isspam at localhost
>
>
> Live long and prosper,
>   ------------------------------
>
>
>
>
>
> Kasper Eenberg
>
> *HOVMARK DATA*
> Ravnevej 13
> dk-6705 Esbjerg Ø
> tlf:   +45 76 12 59 04
> mobil: +45 40 70 69 63
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
>
>
>
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
>
>
> --
> Martin Hepworth
> Oxford, UK
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090515/3f9e0a7b/attachment.html


More information about the MailScanner mailing list