Spam problems

[mirner]

HI , can some one please help me with spam control ?

I have a lot of Spam and I don’t know what more can I do , I set up the RBL with this options :

zimbraMtaRestriction: check_client_access hash:access
zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non-fqdn_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: reject_rbl_client dnsbl.njabl.org
zimbraMtaRestriction: reject_rbl_client opm.blitzed.org
zimbraMtaRestriction: reject_rbl_client relays.ordb.org
zimbraMtaRestriction: reject_rbl_client cbl.abuseat.org
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client dnsbl.sorbs.net


but still im getting a lot of spam .

Before I was dealing with the simple configuration of Spam assassin and with just putting up the score it was good , now I don’t know where I can change that to improve the system or what else I can do to stop Spam .

thanks in advance.

[phoenix]

How about Tag% & Kill%, you can change them in zimbra admin ui.

[mirner]

More details

HI Bill,

75/33 its what I have

Let me gibe you details about how dspam its working
I think it’s a problem of score , we are training continuesly the spam system by the web application declaring junk mail , but still we are getting the same spams all days .
Please advice



Here same spams:

Received: from localhost (localhost.localdomain [127.0.0.1])
by zimbra.hq.uicc.org (Postfix) with ESMTP id 42D0DD478D0
for <zuberbuhler@uicc.org>; Tue, 7 Nov 2006 10:47:19 +0100 (CET)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Tue Nov 7 10:47:18 2006
X-DSPAM-Confidence: 0.9997
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 4550562670239801715053
X-DSPAM-Factors: 27,
X-Virus-Scanned: amavisd-new at
X-Spam-Score: -2.562
X-Spam-Level:
X-Spam-Status: No, score=-2.562 tagged_above=-10 required=3 tests=[AWL=0.137,
BAYES_00=-2.599, DSPAM_HAM=-0.1]
Received: from zimbra.hq.uicc.org ([127.0.0.1])
by localhost (zimbra.hq.uicc.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 7c-D+OCzDHv1 for <zuberbuhler@uicc.org>;
Tue, 7 Nov 2006 10:47:18 +0100 (CET)
Received: from mailhost2.inet.dkfz-heidelberg.de (unknown [193.174.53.133])
by zimbra.hq.uicc.org (Postfix) with ESMTP id 76E33D478E5
for <zuberbuhler@uicc.org>; Tue, 7 Nov 2006 10:47:16 +0100 (CET)
Received: from dkfzex2.ad.dkfz-heidelberg.de (dkfzex2.inet.dkfz-heidelberg.de [193.174.53.58])
by mailhost2.inet.dkfz-heidelberg.de (8.13.3/8.13.3/smtpout) with ESMTP id kA79qiRC007752
for <zuberbuhler@uicc.org>; Tue, 7 Nov 2006 10:52:44 +0100
X-Mimeole: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: Abwesenheitsnotiz: Draft Communication: STOP CERVICAL CANCER conference
Date: Tue, 7 Nov 2006 10:52:44 +0100
Message-ID: <2866AE9DFC6DE24B9338B6CA00DA6634196D5F@dkfzex2.ad .dkfz-heidelberg.de>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Draft Communication: STOP CERVICAL CANCER conference
Thread-Index: AccBs+j2erYIZWIgRi+2CYYvSiUcpwACeL9wACR35jAAALNqoA ==
From: "Kuethe Gudrun" <G.Kuethe@dkfz-heidelberg.de>
To: "Evelyn Zuberbuhler" <zuberbuhler@uicc.org>

Vielen Dank f=FCr Ihre Nachricht.
Ich bin am 13.11. wieder im B=FCro. Ihre E-Mail wird nicht =
weitergeleitet. Ich werde sie nach meiner R=FCckkehr beantworten.=20

Many thanks for your message.
Your message will not be forwarded. I will reply when I am back in the =
office on November 13.


Received: from localhost (localhost.localdomain [127.0.0.1])
by zimbra.hq.uicc.org (Postfix) with ESMTP id EC43DD478D0
for <baker@uicc.org>; Tue, 7 Nov 2006 10:47:33 +0100 (CET)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Tue Nov 7 10:47:33 2006
X-DSPAM-Confidence: 0.9997
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 4550563570271956240403
X-DSPAM-Factors: 27,
X-Virus-Scanned: amavisd-new at
X-Spam-Score: -3.299
X-Spam-Level:
X-Spam-Status: No, score=-3.299 tagged_above=-10 required=3 tests=[AWL=-0.600,
BAYES_00=-2.599, DSPAM_HAM=-0.1]
Received: from zimbra.hq.uicc.org ([127.0.0.1])
by localhost (zimbra.hq.uicc.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id R23tdswKNQ+U for <baker@uicc.org>;
Tue, 7 Nov 2006 10:47:32 +0100 (CET)
Received: from montana.ymlpnet.com (montana.ymlpnet.com [85.158.212.25])
by zimbra.hq.uicc.org (Postfix) with SMTP id 13642D478E5
for <baker@uicc.org>; Tue, 7 Nov 2006 10:47:32 +0100 (CET)
Received: (qmail 14170 invoked by uid 0); 7 Nov 2006 09:53:11 -0000
Date: Tue, 7 Nov 2006 10:53:11 +0100
To: baker@uicc.org
From: "crepesuzette@gmx.ch" <crepesuzette@gmx.ch>
Subject: The singing DJane Jazzy Lounge - Heldenbar/Universal Cafe
Message-ID: <997ef4fa35b939cd9eef12e92c3b978a@montana.ymlpnet. com>
X-YMLPcode: assajem+99+3000
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="iso-8859-1"

My music: www.myspace.com/kreaviva

I am happy to announce you that I found a possiblity to sing and DJ,
this means Djane Lollipop and Crepesuzette made a sort of a Joint Venture (hihi).

Je suis heureuse de vous dire que je chante et fais DJane
cela veux dire que Djane Lollipop et Crepesuzette ont fait la fusion...(pour rire).

Ja ich bin also nun froh dass ich singen kann und gleichzeitig Dj bin..
das ist eine Art Joint Venture, obwohl es sich ja um die selbe Person handelt.

But I would be so glad not to be alone on stage (if you have my vibe, get in touch):
Mais j'adore partager la scene (si vous avez mon vibe, contactez moi):
Aber ich will immer gerne die Buehne teilen (wenn ihr meinen Vibe moegt und macht, kontaktiert mich):

TOMORROW/MORGEN/DEMAIN:
Nov 8 2006 - Heldenbar Zurich
www.heldenbar.ch
auch Provitreff genannt.

Guests for that event:
Visuals: www.myspace.com/monotom.
Singer: www.myspace.com/stefcrush of the group CRUSH.
DJ (not fully confirmed yet): www.myspace.com/olivierrohrbach

***
Unversal Cafe Inauguration Party:
Nov 15 2006 - 21h - Mercredi
Universal Cafe, 26 bd du Pont-d'Arve, 1205 Geneve
Reservations 022 781 18 81
Djane Lollipop and maybe a little of Crepesuzette.

Nov 25 2006 - 21h - Samstag
Djane Lollipop with Maestro and Guests
Villa Stucki Berne
IN DIESER DISCO SIND ALLE HERZLICH WILLKOMMEN
IHRE MUSIK MITZUNEHMEN.
EVERYBODY'S A DJ.
OLDIES, GROOVES, ROCK, POP, WORLD whatever.

Dec 31 2006
Artists Party in Geneva (also Myspace gathering) Geneva
Universal Cafe
www.myspace.com/iuscream
EVERYBODY'S AN ARTIST

Enjoy Autumn..
Je suis prete a animer vos soirees privees.
I am ready to care for your private parties.
Ich kann bei Euch auch privat auftreten.

I am writing now for the Magazine www.murmures.info.
J'ecris desormais pour le Magazine www.mumures.info.
Ich schreibe nun uebrigens fuer das welsche Magazin www.murmures.info.

Crepesuzette/Lollipop

PS: Oriental Belly Dancing Music: www.myspace.com/lesetoilesdelatlas
Mein Pianist : www.markkoch.ch




_____________________________
Change address / Leave mailing list: http://ymlp.com/u.php?assajem+baker@uicc.org
Hébergé par YourMailingListProvider

[scalper]

I have those problems during the early implementation of my company zcs. There is two simple things that you can do.

First, apply rulesdujour. Refer here.

Secondly, manual train using spam archive by following instructions from here .

You can see major improvements later on. Now, I even dont use external RBLs. I only use SA/DSPAM that came with zimbra, 75/28 kill/tag settings.

Installing razor/dcc also will get you much better results, but I'm not using it . Cheers!

[mirner]

Hi Scalper

HOw do you sugest to feed this messeges to spam special acount in zimbra ?I was thinking to copy all messeges into this special account maildir but im not sure if it would work .. besides I'm not sure how to get the actual directory where maildir is ...

Thanks !.

[scalper]

mirner,

this is a repost, credits to Inigoml.

Download the spam archive

From your spam folder, create a spam index file:
ls > spam.index

And then, as zimbra user::
sa-learn -p /opt/zimbra/conf/salocal.cf --dbpath ${zimbra_home}/amavisd/.spamassassin/ -L --no-sync --spam -f spam.index

That should do it!

[bobby]

mirner, those messages may be unwanted, but they don't really look like spam

[mirner]

Hi Scalper

Im a little bit lost , is possible to help me with a step by step for do it ?

Thanks in advance