Re: crazy question qmail-scanner x SA scores

John Puttergill <[email protected]> Wed, 15 Mar 2017 08:42:41 +0000
Newsgroups gmane.mail.qmail.scanner
Organization Its Just IT
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--===============7714802331851795326==
Content-Type: multipart/alternative;
	boundary="------------DA7EE6D153B04BA23E0BBB58"

This is a multi-part message in MIME format.
--------------DA7EE6D153B04BA23E0BBB58
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit

As a general point I think that a score of 5.1 to trigger quarantine a 
little low ... it means you are going to have to monitor that quarantine 
account very actively.

I much prefer using sa-reject which places the onus on the sender of the 
e-mail ... but ! use a score of 7.7 as my trigger point.

When you quarantine neither the sender nor the recipient is aware that 
this has taken place.

By using qmail-scanner with settings per domain feature you could 
deliver the mails between say 5.1 and 7.7 to a specific Spam folder in 
the recipients Maildir ... this relieves you of having to monitor your 
quarantine events and any mails that are not delivered are rejected 
during the smtp ... so the sender is aware of the delivery failure ... 
and if the mail is genuine can choose some other method of communicating.



On 14/03/2017 22:23, Rejaine Monteiro wrote:
>
>
> The problem was the sa_quarantine_over parameter .. I think I was 
> interpreting it incorrectly .. as in my case I want for everything 
> that spam classifies above 5 in quarantine, then the value should be 
> 0.1 and not 5, as was before.
> because this line:
>
>   if ($sa_quarantine_over > 0 && ($sa_score - $sa_required_hits) >= 
> $sa_quarantine_over) {
>     &debug("SA: seriously spammy - quarantine and don't deliver");
>
> thanks!!
>
> Em 14-03-2017 18:32, Rejaine Monteiro escreveu:
>>
>>
>>  qmail-scanner seems crazy here...
>>
>>
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner: 
>> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 
>> [email protected] [email protected] 
>> Instantly_erect,_instant_respect 
>> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG 
>> ....
>>
>>
>> Why "Clear" if SA score is 7.7 ?? Why not going to quaratine ( my 
>> $sa_quarantine_over='5'; )
>>
>>
>> qmail-queue.log is:
>>
>>
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like SPAM 
>> (score=7.7 required=5.0)
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan of 
>> dir "/var/spool/qscan/tmp/server14895239985893511" in 1.698798 secs
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of 
>> "/var/spool/qscan/tmp/server14895239985893511"...
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message took 
>> 1.735613 seconds
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into 
>> /var/qmail/bin/qmail-queue...
>> Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner: 
>> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 
>> [email protected] [email protected] 
>> Instantly_erect,_instant_respect 
>> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG 
>> 1489523999.3513-0.server:3508 1489523999.3513-1.server:5515
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf 
>> /var/spool/qscan/tmp/server14895239985893511/ 
>> /var/spool/qscan/working/new/server14895239985893511
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of 1.783561 secs
>>
>> I have several cases of messages with score by SA above 5 that should 
>> be quarantined, but that are being delivered normally ..
>>
>> I'm going crazy here. Any idea?
>>
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org!http://sdm.link/slashdot
>>
>>
>> _______________________________________________
>> Qmail-scanner-general mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
>
> -- 
> Rejaine da Silveira Monteiro
> Suporte-TI
> Tel: (31) 2102-8854
> Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
> www.jamef.com.br
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> Qmail-scanner-general mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general


--------------DA7EE6D153B04BA23E0BBB58
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>As a general point I think that a score of 5.1 to trigger
      quarantine a little low ... it means you are going to have to
      monitor that quarantine account very actively.</p>
    <p>I much prefer using sa-reject which places the onus on the sender
      of the e-mail ... but ! use a score of 7.7 as my trigger point.</p>
    <p>When you quarantine neither the sender nor the recipient is aware
      that this has taken place.</p>
    <p>By using qmail-scanner with settings per domain feature you could
      deliver the mails between say 5.1 and 7.7 to a specific Spam
      folder in the recipients Maildir ... this relieves you of having
      to monitor your quarantine events and any mails that are not
      delivered are rejected during the smtp ... so the sender is aware
      of the delivery failure ... and if the mail is genuine can choose
      some other method of communicating.</p>
    <p><br>
    </p>
    <br>
    <div class="moz-cite-prefix">On 14/03/2017 22:23, Rejaine Monteiro
      wrote:<br>
    </div>
    <blockquote
      cite="mid:[email protected]"
      type="cite">
      <meta content="text/html; charset=windows-1252"
        http-equiv="Content-Type">
      <p><br>
      </p>
      The problem was the sa_quarantine_over parameter .. I think I was
      interpreting it incorrectly .. as in my case I want for everything
      that spam classifies above 5 in quarantine, then the value should
      be 0.1 and not 5, as was before. <br>
      because this line: <br>
      <br>
        if ($sa_quarantine_over &gt; 0 &amp;&amp; ($sa_score -
      $sa_required_hits) &gt;= $sa_quarantine_over) { <br>
          &amp;debug("SA: seriously spammy - quarantine and don't
      deliver"); <br>
      <br>
      thanks!!<br>
      <br>
      <div class="moz-cite-prefix">Em 14-03-2017 18:32, Rejaine Monteiro
        escreveu:<br>
      </div>
      <blockquote
        cite="mid:[email protected]"
        type="cite">
        <meta http-equiv="content-type" content="text/html;
          charset=windows-1252">
        <br>
        <br>
         qmail-scanner seems crazy here... <br>
        <br>
        <br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
        Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
          moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:[email protected]">[email protected]</a>
        <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:[email protected]">[email protected]</a>
        Instantly_erect,_instant_respect
&lt;qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
        .... <br>
        <br>
        <br>
        Why "Clear" if SA score is 7.7 ?? Why not going to quaratine (
        my $sa_quarantine_over='5'; )<br>
        <br>
        <br>
        qmail-queue.log is: <br>
        <br>
        <br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like
        SPAM (score=7.7 required=5.0)<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan
        of dir "/var/spool/qscan/tmp/server14895239985893511" in
        1.698798 secs<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of
        "/var/spool/qscan/tmp/server14895239985893511"...<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message
        took 1.735613 seconds<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into
        /var/qmail/bin/qmail-queue...<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
        Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
          moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:[email protected]">[email protected]</a>
        <a moz-do-not-send="true" class="moz-txt-link-abbreviated"
          href="mailto:[email protected]">[email protected]</a>
        Instantly_erect,_instant_respect
&lt;qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
        1489523999.3513-0.server:3508 1489523999.3513-1.server:5515<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf
        /var/spool/qscan/tmp/server14895239985893511/
        /var/spool/qscan/working/new/server14895239985893511<br>
        Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of
        1.783561 secs<br>
        <br>
        I have several cases of messages with score by SA above 5 that
        should be quarantined, but that are being delivered normally ..
        <br>
        <br>
        I'm going crazy here. Any idea?<br>
        <br>
        <fieldset class="mimeAttachmentHeader"></fieldset>
        <br>
        <pre wrap="">------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://sdm.link/slashdot">http://sdm.link/slashdot</a></pre>
        <br>
        <fieldset class="mimeAttachmentHeader"></fieldset>
        <br>
        <pre wrap="">_______________________________________________
Qmail-scanner-general mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general">https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general</a>
</pre>
      </blockquote>
      <br>
      <pre class="moz-signature" cols="72">-- 
Rejaine da Silveira Monteiro
Suporte-TI
Tel: (31) 2102-8854
Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.jamef.com.br">www.jamef.com.br</a></pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a class="moz-txt-link-freetext" href="http://sdm.link/slashdot">http://sdm.link/slashdot</a></pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
Qmail-scanner-general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general">https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>

--------------DA7EE6D153B04BA23E0BBB58--


--===============7714802331851795326==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7714802331851795326==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general

--===============7714802331851795326==--