Does Spamassassin Still Work?

[ozee]

SA is marking the headers as scanning the spam, but it has been weeks since it actually marked anything as spam...

Lots of the spam that we're getting is scored 3-3.5, so it's slipping under the 5.0 filter -- but alot of the ham we get is 3-3.5, too!

[Jeff]

Originally posted by ozee@May 24 2005, 04:35 AM
SA is marking the headers as scanning the spam, but it has been weeks since it actually marked anything as spam...

Lots of the spam that we're getting is scored 3-3.5, so it's slipping under the 5.0 filter -- but alot of the ham we get is 3-3.5, too!
Quoted post

Ozee, if SA is appearing in the headers, it is working. Spammers are adjusting their tactics to get around filters like SpamAssassin. If you don't want to lower your threshold, then you may need to add some client filtering to catch more of the spam.

Joe is discussing an additional filtering option with the folks at DirectAdmin. Nothing to announce yet, mostly because DA is slow to respond, but there may be hope on the horizon for another layer of protection.

[glorybox]

Mine quit working on May 30. I have the threshold set to 1.0 and it was working really well, but nothing has been tagged since the 30. I don't think the headers are even being marked. Checked my configuration and everything is okay there, though.

Casey
----------------------
www.superdork.net

[Jeff]

Originally posted by glorybox@Jun 2 2005, 08:40 AM
Mine quit working on May 30. I have the threshold set to 1.0 and it was working really well, but nothing has been tagged since the 30. I don't think the headers are even being marked. Checked my configuration and everything is okay there, though.

Casey
----------------------
www.superdork.net
Quoted post

When SpamAssassin stops showing up in the headers, you need to open a helpdesk ticket.

[axm26]

Hello,

I have been monitoring my mail for a few weeks but I never get anything tagged with a subject of ***SPAM***. I have used set the DirectAdmin SpamAssassin setup to change the subject but it does not seem to do anything. It does seem to catch spam though because my headers do have the SpamAssassin info.

Is there anything special I have to do to enable the subject rewriting?



Thank You.

[Jeff]

Originally posted by axm26@Jun 3 2005, 06:27 AM

Is there anything special I have to do to enable the subject rewriting?
Thank You.
Quoted post

If no subjects are being re-written, then SpamAssassin is not really "catching" anything for you, since it doesn't ever delete spam. You should experiment with a lower threshold. If the default is 5, try lowering it to 3 for awhile. If 3 isn't low enough, try 2 or 1.

[thevillageinn]

Originally posted by Jeff@Jun 3 2005, 06:23 AM
If no subjects are being re-written, then SpamAssassin is not really "catching" anything for you, since it doesn't ever delete spam. You should experiment with a lower threshold. If the default is 5, try lowering it to 3 for awhile. If 3 isn't low enough, try 2 or 1.


and don't forget to whitelist known e-mail addresses which you don't want to mark as spam.

[ozee]

Is there a tutorial someplace? How do I white/black list? How can I setup custom scores?

Why do I keep getting messages that have "unavailable" in the autolearn?

X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on www31.hostpc.com
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable
version=3.0.2

BTW, this particular message with a score of 0 was blatant spam I received this morning. I've gotten several 0's this last week.

[Jeff]

Originally posted by ozee@Jun 6 2005, 04:32 AM
Is there a tutorial someplace? How do I white/black list? How can I setup custom scores?

Why do I keep getting messages that have "unavailable" in the autolearn?
Quoted post

Autolearn is not enabled yet. Joe is checking with the DirectAdmin developers, probably today, on whether the Bayesian filters associated with autolearn are usable with DirectAdmin. (Even if they are compatible it is possible they will take too much of a performance toll to be usable.)

[thevillageinn]

The spamassassin settings can be changed in your domain control panel.

Look for it under "E-Mail Management" then under "Spamassassin Setup"

All the most common things can be controlled here. A while back I posted a link to an online spamassassin setup script which asked some questions then cranked out a config file which you could put into your spamassassin directory in your account.

[ozee]

OK, I just got this one. It shows "Autolearn=No". What's the difference between this one (where it did get scanned with autolearn=no) and the one I posted above where it didn't get scanned and autolearn=unavailable)??

X-Spam-Status: No, score=2.6 required=5.0 tests=HTML_50_60,HTML_BACKHAIR_8,
HTML_MESSAGE,HTML_OBFUSCATE_10_20,PRIORITY_NO_NAME autolearn=no
version=3.0.2


I'll look for that post you mention, Dan. I found the blacklist/whitelist stuff, but there's nowhere to adjust the test values. I'm seeing lots of obvious spams that are scoring in the 2.2-2.6 range (which is the same range for many legit emails!). If I can adjust some of those test scores, that'll get them up to the 5.0.

[thevillageinn]

oh, I don't think you can change the score a particular test gives. I've found spamassassin to be virtually useless. Plus, Direct Admin seems to be a few versions behind all the time with spamassassin as well - rendering it even less useful.

I used to use a bayesian filter in my personal squirrelmail installation but a server move rendered it inoperable and I never bothered to wipe the database (the only bit of troubleshooting I didn't try on it) - I didn't want to lose all of the tokens of good and bad e-mails I'd saved over the months.

I pretty much gave up. I still use an early version of MailWasher to view what's on the server and just delete the spam or junk that I don't want and then only download the good stuff to my local e-mail client.

[tnas]

Yes, you can modify the scores given to different tests.

See this link for the tests performed..
http://spamassassin.apache.org/tests_3_0_x.html

You do need to edit the config file manually.
Here is a piece of my config file...

score DRUGS_ERECTILE 4.5

blacklist_from *@bussujob.us

whitelist_from emailaddress@archwireless.net


I have found the whitelist_from useful for those occasional HTML emailers that I still want to get emails from.

[thevillageinn]

Originally posted by tnas@Jun 7 2005, 07:17 AM
Yes, you can modify the scores given to different tests.


That's probably some of the best news I've seen regarding Spamassassin. I had looked for information like that, but didn't find any info telling me it was alterable.

Thanks for the link! I may finally get Spamassassin working the way I want now...actually tagging spam.

[ozee]

How does SA decide which messages it's gonna scan??

One message yesterday had this header - timestamp: Wed, 08 Jun 2005 15:09:25 -0400, www31.


X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable
version=3.0.2

tests = none??

This message was obvious spam!

Hello,

You have been chosen to participate in an invitation only limited time event!
Are you currently paying over 3% for your mortgage? STOP! We can help you lower that today!
Answer only a few questions and we can give you an approval in under 30 seconds – it’s that simple!
...


It seems like at one time I found something that said that when autolearn=unavailable, it indicates that something isn't entirely correct. It should be yes or no... not unavailable. (Now I suppose you're going to want the link... can't find it right now, sorry)

[tnas]

It will only give you the tests that it fails...ie gets score for. There are still SPAM that will not be flagged.... it is all text, has valid email headers, doesn't mention key words... SA isn't perfect. It would be nice if it could "READ" and understand messages that are garbage, but it works better than nothing at all! I am able to flag with "***SPAM***" around 30% of actual spam messages. I have gotten comfortable with not even looking at these and just moving them to my deleted folder. I do occasionally look to see if there is anything flagged incorrectly....and to check and see if I'm still wanted by all those babes and mortgage companies! :P

Not sure on the "autolearn = unavailable" It is always "no" in the X-SPAM headers that I get. I'll have to check a few more. "unavailable" doesn't sound right.

[ozee]

Well -- I had previously searched and searched and had never been able to find any instructions for editing the scores, but tnas's suggestion and link have provided EXACTLY what I was looking for. I am now able to tweak the scores and get them to add up to more than 5.0, so SA will deal with them. It seems like the spams are all hitting on the same set of scores where none of the hams are, so I've been able to successfully improve spam detection by tweaking those few scores.

I'm still seeing an occasional "unavailable", but this ability has made SA a useful tool again. I'm just about ready to let SA start deleting spams instead of just marking them for Thunderbird to filter out.

Thanks tnas!!

[tnas]

You're welcome.

Don't forget you can lower the overall score needed too. 4.8 4.3 ... 4.0

I too have seen the "autolearn = unavailable" on a few mails, and it always corresponds to a zero score even though it might be spam. Not sure what causes it. I KNOW spammers would love to know.

[ozee]

Lowering the score-threshhold really wasn't going to work -- I was getting spams with scores as low as 1.3 or 1.4. And I get legit hams with scores as high as 3.8 or more... but it seems like the spams are always triggering the same scores - I just needed to get the values of those scores high enough to trap them.