Page 1 of 1
Making EFA more strict
Posted: 08 Mar 2016 11:49
by bettajames
Hi there - i've been running EFA for a few months now and it's working well, except i'm getting far too much spam through to my users.
I could do with some tips on what i can do to make the system more strict about what it lets through.
As it is at the moment, it's pretty much as it is "out of the box". I've attached a picture showing one user with his list of emails today - they are ALL spammy, but only a couple of them have been picked up as spam by the system.
Any suggestions?
Re: Making EFA more strict
Posted: 12 Mar 2016 14:35
by shawniverson
You can lower your spam scores in MailScanner.
Code: Select all
Required SpamAssassin Score = 4
High SpamAssassin Score = 7
Lower these values to make EFA more strict.
Re: Making EFA more strict
Posted: 14 Mar 2016 04:16
by pdwalker
Rather than change the scores, I'd try to find out why the system wasn't marking them as spam in the first place.
When I first had my installation running, a lot of my blacklist/spamlist checks weren't actually running because of how my DNS server was configured. Like you, a lot of spam game through as "clean". Once I identified the problem, and had the spam checks operating correctly, it became much less of a problem.
Perhaps you can look at your spam reports for those messages. You could even forward one of those messages to someone else to see how their system scores the message.
Just a thought.
Re: Making EFA more strict
Posted: 24 Mar 2016 16:59
by maxkmv
I use GeoIP filtering and it is VERY VERY efficient.
For example, I assign higher score to emails sent from pretty much everywhere in the world except a few selected countries (like USA, UK, France or Netherlands)..
For me adding a score of 3.00 to Spamassassin causes many spam emails to go to spam folder..
Re: Making EFA more strict
Posted: 25 Mar 2016 04:43
by pdwalker
That's great if you know you'll only have communications from those countries, but for companies that do business internationally, it'll lead to a lot of false positives, do others will have to be more careful about the countries they specify.
How did you enable and configure this filter?
Re: Making EFA more strict
Posted: 08 Apr 2016 17:57
by maxkmv
Sorry for late reply. I agree that you have to be careful and you need to select your list of countries very carefully. However I support around 500 users and the list of countries that we deal with is pretty limited.
First determine the countries you want to increase spam score for. As mentioned before I have figured out the best score for me to be 3.00
List COUNTRY codes:
https://www.unc.edu/~rowlett/units/codes/country.htm
Now open this file with your text editor (I use VI)
/etc/mail/spamassassin/local.cf
at the bottom of the file type:
header RELAYCOUNTRY_BAD X-Relay-countries =~ /^(NG|AF|AX|AL)/
score RELAYCOUNTRY_BAD 3.00
in this example I blocked a few countries (their double letter codes can be found on the weblink above), just separate them with |
The score I assigned to be added to total score is 3.00
Re: Making EFA more strict
Posted: 08 Apr 2016 21:02
by Rob.M.P
Are the tweaks listed in the link below supported with SpamAssasin on EFA?
http://www.xfiles.dk/catching-more-spam ... mAssassin/
Re: Making EFA more strict
Posted: 28 Apr 2016 21:23
by Rob.M.P
Has anyone got any more information on this....reference my previous post?
Re: Making EFA more strict
Posted: 29 Apr 2016 03:05
by pdwalker
Easy enough to check
The following modules should be present in the file init.pre
loadplugin Mail::SpamAssassin::Plugin::RelayCountry
loadplugin IP::Country::Fast
loadplugin Mail::SpamAssassin::Plugin::TextCat
loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject
Now let's see what modules we have installed:
Code: Select all
https://<efabox>/mailscanner/sa_lint.php
...
Apr 29 10:57:07.030 [11739] dbg: plugin: loading Mail::SpamAssassin::Plugin::RelayCountry from @INC
...
Apr 29 10:57:07.083 [11739] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
so the following plugins are not loaded.
- IP::Country::Fast
- Mail::SpamAssassin::Plugin::TextCat
Are they installed on the system?
Code: Select all
[root@efa spamassassin]# locate TextCat
/usr/share/man/man3/Mail::SpamAssassin::Plugin::TextCat.3pm.gz
/usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/TextCat.pm
[root@efa spamassassin]# locate Fast
...
/usr/share/perl5/vendor_perl/IP/Country/Fast
/usr/share/perl5/vendor_perl/IP/Country/Fast.pm
/usr/share/perl5/vendor_perl/IP/Country/Fast/cc.gif
/usr/share/perl5/vendor_perl/IP/Country/Fast/ip.gif
so yes, the modules are available.
So if you include the unloaded two modules, then efa/spamassassin would likely support the tweaks suggested on that page.
Personally. those tweaks don't seem to be all that great to me, but someone else might like them.
Re: Making EFA more strict
Posted: 19 Jul 2016 13:50
by ovizii
I read through those tweaks, they advocate using
ok_locales too. Anyone got more info on that? Apparently en means all Western character sets in general =>
https://spamassassin.apache.org/full/3. ... _Conf.html
What locales would fall inside this and what would not? Any link where I can read up on locales?
What happens if a mail is received that is no within ok_locales? the only thing I could find is this, is there more?
Code: Select all
score CHARSET_FARAWAY_HEADER 3.200