[BNM] SpamAssasin

[Pete Dowdell]

Guy Tierney wrote:
> Ok I get most of that but SpamAssasin here is pretty crappy - it totally is
> missing those nasty penny stocks ones (that have a GIF attached with
> squiggly lines on) and generally is pretty poor so we enquired about
> upgrading it. This are the responses from out techies...
>   

That's the next level of armament in the war...and it is very hard to 
filter this new generation of spam, as the content you need to scan is 
embedded in the image, and the rest of the mail is just a container, 
shaped to make it as slippery as possible for the filter.

The main defence against this type of spam is black lists.  In my 
experience I see the an hour or two of life of a new spam source like 
that before it is listed and thereafter canned by SA. 

The only other measure afaik is OCR: this is technically do-able but the 
performance hit on the mail server is huge.  This also introduces a new 
arms race in the same vein as captcha filters as spammers make the 
embedded text hard for OCR processing.

If you can find a good 3rd parth spam filter relay solution, that sounds 
best for you.  This would only require a change to the MX field of your 
domain DNS and some configuration of your mail client to filter the 
forwarded mail - fairly painless stuff.  If you do decide to go this 
way, do report back I would be very interested to hear about your 
experiences.

Pete


> "I've checked what version of spam assassin is on some of our other more
> recently set up plesk servers and on the most recent version of plesk this
> is running spam assassin version 3.0.6 however this is also on a different
> operating system. In the last year we have moved from using freeBSD to
> fedora core 4 because whilst freeBSD is a very robust operating system we
> have found recently that plesk support for different versions of plesk
> requires different versions of the freeBSD operating system because of this
> I wouldn't recommend upgrading the version of plesk because the most recent
> version of plesk has versions for freeBSD 4.11, 5.5, and 6.1 and the version
> your server tomcat is at is 5.3.
> I'm not sure if it is possible to just upgrade the spam assassin component I
> have emailed our software vendors to ask if this is possible if it is not I
> will ask if any of the above versions of plesk 8.1 are compatible with
> freeBSD 5.3.
> --------- 
> I've had a response back from plesk, it's not possible to upgrade spam
> assassin without upgrading plesk as the 2 pieces of software are very
> heavily integrated. I'm waiting a further email to find out from SWSoft
> which specific o/s version of plesk is compatible with the o/s on your
> current server."
>
>
> So my partners are thinking of outsourcing or spam filtering to a company
> that is doing very well on tests but it seems silly when we have the tools
> (although maybe not the knowledge yet) to deliver this in-house.
>
> Does that help explain the situation?
> Gt
>
>
>
>
>
>
> on 2/2/07 1:15 pm, Pete Dowdell at bnm at stridebird.com wrote:
>
>   
>> Guy Tierney wrote:
>>     
>>> I was chatting recently (read autumn) with someone about SpamAssasin and the
>>> plug-ins involved to help it do its job properly as the the product itself
>>> isn't much cop alone.
>>>
>>> We're running Plesk on our Tomcat server so it seems to be an obvious
>>> choice. 
>>>
>>> Can anyone point me in the direction of how to get the best from this
>>> software and or where to get these plug-ins - I may have completely the
>>> wrong end of the stick not being a techie so go easy on me and the tech
>>> speak ;D
>>>   
>>>       
>> You're not holding the stick in the right place at least...! ;)
>>
>> SpamAssasin : spam filtering system that operates when mail is received
>> on a mail server
>> Plesk: web-based control panel for site hosting
>> Tomcat: a JSP application
>>
>> To use spamasssasin you need it enabled on a mail server that handles
>> your mail: either as the destination server or more sophisticatedly as a
>> relay server.  It will label all mail filtered with a spam score, and
>> you then configure your mail server and/or mail client to take the
>> appropriate action according to the additional labelling spamassasin has
>> applied to the message.
>>
>> Sooo, plesk may be able to help you but I doubt it.  Tomcat isn't part
>> of the equation at all.
>>
>> Pete
>>
>> PS...SA is a great system that is remarkably good at labelling spam.
>> YMMV however, depending on configuration of your email hosting.  SA does
>> multiple things to assess messages: black lists, bayes filtering,
>> structure analysis etc.  But on a regular linux-y type environment, it
>> should just work (and well) straight after install without much faff.
>> phaff.  faf. 
>>     
>
>
>   


-- 
------------------------------------------------------------------------
Peter Dowdell
07786 266 440
pete at stridebird.com <mailto:pete at stridebird.com>
stridebird <http://stridebird.com>