Zimbra offers Open Source email server software and shared calendar for Linux and the Mac
Go Back   Zimbra :: Forums > Zimbra Collaboration Suite > Administrators

Welcome to the Zimbra :: Forums!
Welcome, if you would like to post a comment please register. We also encourage you to explore all things Zimbra with our team and members of the community.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1 (permalink)  
Old 01-28-2008, 10:49 AM
Moderator
 
Posts: 1,027
Angry Spam weirdness

This is for all you SpamAssassin gurus out there. I have a specific low-volume commercial emailer--low enough not to get on all the blacklists because he targets construction dealers such as us--for whom the only real key (short of blacklisting a domain) that would really catch all his junk is the fact that he's in Singapore, so all his emails come to me as future-dated. Here's a header that shows that in fact, the future dating is being recognized by SpamAssassin:
Quote:
No, score=3.896 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DATE_IN_FUTURE_12_24=2.189, DEAR_SOMETHING=1.605, HTML_MESSAGE=0.001, RDNS_NONE=0.1]
That's not enough to get him tagged as spam in my system, and I'm a little reluctant to lower my threshold even further than I already have overall. However, if I could raise that DATE_IN_FUTURE_12_24 to a higher score, say an even 3 points, it would solve my problem.

I tried to do this by adding the following lines to my /opt/zimbra/conf/spamassassin/local.cf:
Code:
# Increase future date score to control Asian spam
score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599
I have a variety of other settings in local.cf that appear to be working, including enhanced Bayes scoring and commercial whitelist penalties. However this particular line seems to refuse to work at all. I've tried it both with the single score and all four scores, neither way works.

Can anyone point me in the direction of why this line, among all the others, is being ignored?

In case there is an issue with conflicting rules or orders, here is my entire local.cf:
Code:
#My tweaks to the Bayes scoring system - DWM
score BAYES_00 0.0001 0.0001 -2.312 -2.599
score BAYES_05 0.0001 0.0001 -1.110 -1.110
score BAYES_20 0.0001 0.0001 -0.740 -0.740
score BAYES_40 0.0001 0.0001 -0.185 -0.185
score BAYES_50 0.0001 0.0001 0.001 0.001
score BAYES_60 0.0001 0.0001 1.0 1.0
score BAYES_80 0.0001 0.0001 2.5 2.5
score BAYES_95 0.0001 0.0001 5.5 5.5
score BAYES_99 0.0001 0.0001 6.5 6.5

# Score to penalize Bonded Sender Program (BSP) whitelisting
score RCVD_IN_BSP_TRUSTED 2
score RCVD_IN_BSP_OTHER 2
score RCVD_IN_BONDEDSENDER 2

# Score to penalize Habeas whitelisting
score HABEAS_ACCREDITED_COI 2
score HABEAS_ACCREDITED_SOI 2
score HABEAS_CHECKED 2

# Score to penalize ISIPP/IADB SuretyMail whitelisting
score RCVD_IN_IADB_VOUCHED 2
score RCVD_IN_IADB_DOPTIN 2
score RCVD_IN_IADB_ML_DOPTIN 2

# Score to penalize DNSWL whitelisting
score RCVD_IN_DNSWL_LOW 2
score RCVD_IN_DNSWL_MED 2
score RCVD_IN_DNSWL_HI 2

# Turn off 'Auto-Whitelist'
use_auto_whitelist 0

# Increase future date score to control Asian spam
score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599
Thanks, folks!

Dan
Reply With Quote
  #2 (permalink)  
Old 01-28-2008, 12:51 PM
Junior Member
 
Posts: 9
Default Did you try a spamassassin LINT?

May be it would say if there is a conflict...
Reply With Quote
  #3 (permalink)  
Old 01-28-2008, 12:56 PM
Moderator
 
Posts: 1,027
Default

The spamassassin utilities are not loaded with Zimbra, so no, I have not. I may have to download them and cobble them in but like to avoid messing with the install if I can help it. . .
Reply With Quote
  #4 (permalink)  
Old 01-29-2008, 03:30 AM
Junior Member
 
Posts: 9
Wink A quick workaround

Add a new rule with the same catch condition as the original one... New name with the added score...
This way the message would trigger one additional rule and that's it...

Hope it helps.
Reply With Quote
  #5 (permalink)  
Old 01-29-2008, 11:54 AM
Moderator
 
Posts: 1,027
Default

Well Mike almost hit it yesterday in an offline chat, but I just noticed what is probably the problem this morning. The header shows a hit in DATE_IN_FUTURE_12_24 and I was changing the scores for _24_48. I have now revised the CORRECT rule in local.cf and will post back success or failure based on the next emails that come in.

Don'cha just hate how these damn computers can't read our minds?
Reply With Quote
  #6 (permalink)  
Old 01-29-2008, 12:10 PM
Moderator
 
Posts: 6,236
Default

Told him to edit as they stood in the regular scores file - then bug me if they didn't apply when he stuck them in local.cf

Possibilities include:
DATE_IN_FUTURE_03_06
DATE_IN_FUTURE_06_12
DATE_IN_FUTURE_12_24
DATE_IN_FUTURE_24_48
DATE_IN_FUTURE_48_96
DATE_IN_FUTURE_96_XX
From the other side:
DATE_IN_PAST_03_06
DATE_IN_PAST_06_12
DATE_IN_PAST_12_24
DATE_IN_PAST_24_48
DATE_IN_PAST_96_XX
Reply With Quote
  #7 (permalink)  
Old 01-29-2008, 12:42 PM
Moderator
 
Posts: 1,027
Default

Quote:
Originally Posted by mmorse View Post
Told him to edit as they stood in the regular scores file - then bug me if they didn't apply when he stuck them in local.cf
Trouble is, I edited the 24_48 file in the regular section too, so it didn't work last night either. . .
Reply With Quote
  #8 (permalink)  
Old 01-29-2008, 12:55 PM
Moderator
 
Posts: 6,236
Default

oh that's classic - heck, I just now forgot the passphrase for one of my private keys...
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes


Similar Threads

Why Join?

Registering let's you ask questions, makes it easier to search, displays any files attached to posts, and notifies you about replies.

blog.zimbra.com




 

SEO by vBSEO ©2011, Crawlability, Inc.