Improving spam filtering

[rsharpe]

In the wiki there are steps on howto implement SQLgrey. http://wiki.zimbra.com/index.php?tit...g_with_SQLGrey

[claros]

Originally Posted by tdi

Postgres ZIMBRA 4.0.4/Centos 4.4

1. Install postgres

In wiki.zimbra.com there is a page about sqlgray.
As you already wrote a so detailed post, you could just copy it into a new wiki page.
There are new pages about a plenty of tweaks previously discussed in this post...

Ciao

[dlochart]

First of all thanks a bunch for this. It seems as though this part of Zimbra (its external composite pieces) are not documented like they need to be.

I do have a question. I followed the instructions (did not do DCC yet) and I sent a test mail (local to local) I did a tcpdump and saw the traffic for razor2 but I did not see any traffic for pyzor.

How do I know if.when pyzor is activated?

Also how do I know what is happening with SPF? I enabled it (but I have not added an SPF record for my domain yet) I sent the mails internally so that might come into play for SPF but I am unsure. Any body have a clue? or something I can try? This is a totally internal domain for the time being.

thanks

Doug

[inigoml]

Originally Posted by dlochart

How do I know if.when pyzor is activated?

I tested it after receiving spam mails with pyzor labels.

Also how do I know what is happening with SPF? I enabled it (but I have not

For SPF, you should try sending and email from a SPF enabled domain directy to your server, for example from Gmail.
So:
telnet yourhost 25
>helo mail.gmail.com
> mail from: <test@gmail.com>
> rcpt to: <youraccount@yourdomain.com>
> data
> From: Test
> To: Test
> Subject: Test
> . (dot and enter)

After receiving email, check spamassassin headers for SPF failure.

[dlochart]

Originally Posted by inigoml

I tested it after receiving spam mails with pyzor labels.

I am unable to do this. As of now this mail domain is totally internal. I can send mail out but I cannot send mail to within. Maybe someone could post/send me a spam message (what ... I am asking for spam ) that would trigger a pyzor header. Then I can chaneg the rcpt to and send it to an internal address

Originally Posted by inigoml

For SPF, you should try sending and email from a SPF enabled domain directy to your server, for example from Gmail.
So:
telnet yourhost 25
>helo mail.gmail.com
> mail from: <test@gmail.com>
> rcpt to: <youraccount@yourdomain.com>
> data
> From: Test
> To: Test
> Subject: Test
> . (dot and enter)

After receiving email, check spamassassin headers for SPF failure.

Thanks, that'll work!

[dlochart]

I am a bit confused. I have been so wrapped up in trying to come up to speed with all this stuff postfix, spam assassin, zimbra etc that I forgot that zimbra also uses DSPAM ???

I tried to test the SPF settings as was suggested and when I look at the headers I mainly see DSPAM headers giving the scores. I do see one X-Amavis-Alert and a few X-Spam headers (are X-Spam SpamAssassin headers?)

So how does DSPAM fit into all of this and do I need to worry about it?

My SPF seemed to not work can someone offer some diagnostic tips?

I followed the WIKI. Nowhere do I see a flag to turn on or off SPF. I only see a .../spamassassin/25_spf.cf file that queries to make sure that the SPF plugin is installed.

BTW I did run this make sure I had the SPF package installed.

perl -e 'require Mail::SPF::Query'

It came back without complaining

Also any other tips for Pyzor?

thanks

Doug

[Klug]

Originally Posted by inigoml

Your command should be something kile this (zmtrainsa inspired):
From your spam folder, create a spam index file:
ls > spam.index
And then, as zimbra user::
sa-learn -p /opt/zimbra/conf/salocal.cf --dbpath ${zimbra_home}/amavisd/.spamassassin/ -L --no-sync --spam -f spam.index --shotdots

A quick question on this : is it possible to copy (or move) the ${zimbra_home}/amavisd/.spamassassin/ directory from one server to another ?

My idea, trying to be more precise, is to be able to do the training on _one_ server and then simply deploy the trained data to any other server.

[inigoml]

Originally Posted by Klug

A quick question on this : is it possible to copy (or move) the ${zimbra_home}/amavisd/.spamassassin/ directory from one server to another ?

My idea, trying to be more precise, is to be able to do the training on _one_ server and then simply deploy the trained data to any other server.

Yes, I suppose it will work without any problem.

You could also modify amavisd config for listening in a real ip (not localhost) and bind other postfix servers to this amavisd.

[Klug]

Originally Posted by inigoml

You could also modify amavisd config for listening in a real ip (not localhost) and bind other postfix servers to this amavisd.

The idea is to train a "clean" amavisd with both the "SPAM Archive" and some french spams (collected from several of my own mailboxes) to be able to deploy them by customers setups.

I'm currently training one server against the SPAM Archive, once it's over I'll try to move the .spamassassin folder to another brand new server.

[inigoml]

Originally Posted by dlochart

I am a bit confused. I have been so wrapped up in trying to come up to speed with all this stuff postfix, spam assassin, zimbra etc that I forgot that zimbra also uses DSPAM ???

Yes, It also uses DSPAM, but I've not worked with it before, so I didn't get any action to improve score. However I've worked with spamassassin for years and has been easier for me to improve it.

X-Amavis-Alert and a few X-Spam headers (are X-Spam SpamAssassin headers?)

Yes, they do.

So how does DSPAM fit into all of this and do I need to worry about it?

Zimbra uses both systems for spam catching. You could improve both.

My SPF seemed to not work can someone offer some diagnostic tips?
I followed the WIKI. Nowhere do I see a flag to turn on or off SPF. I only see a .../spamassassin/25_spf.cf file that queries to make sure that the SPF plugin is installed.

Check /opt/zimbra/conf/spamassassin/v310.pre. Here SPF plugin should be loaded (that is, without #). But by default it should be enabled.
You have also to restart amavisd (zmamavisdctl restart)