Re: crazy question qmail-scanner x SA scores
John Puttergill <[email protected]> Wed, 15 Mar 2017 08:42:41 +0000
| Newsgroups | gmane.mail.qmail.scanner |
|---|---|
| Organization | Its Just IT |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============7714802331851795326==
Content-Type: multipart/alternative;
boundary="------------DA7EE6D153B04BA23E0BBB58"
This is a multi-part message in MIME format.
--------------DA7EE6D153B04BA23E0BBB58
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
As a general point I think that a score of 5.1 to trigger quarantine a
little low ... it means you are going to have to monitor that quarantine
account very actively.
I much prefer using sa-reject which places the onus on the sender of the
e-mail ... but ! use a score of 7.7 as my trigger point.
When you quarantine neither the sender nor the recipient is aware that
this has taken place.
By using qmail-scanner with settings per domain feature you could
deliver the mails between say 5.1 and 7.7 to a specific Spam folder in
the recipients Maildir ... this relieves you of having to monitor your
quarantine events and any mails that are not delivered are rejected
during the smtp ... so the sender is aware of the delivery failure ...
and if the mail is genuine can choose some other method of communicating.
On 14/03/2017 22:23, Rejaine Monteiro wrote:
>
>
> The problem was the sa_quarantine_over parameter .. I think I was
> interpreting it incorrectly .. as in my case I want for everything
> that spam classifies above 5 in quarantine, then the value should be
> 0.1 and not 5, as was before.
> because this line:
>
> if ($sa_quarantine_over > 0 && ($sa_score - $sa_required_hits) >=
> $sa_quarantine_over) {
> &debug("SA: seriously spammy - quarantine and don't deliver");
>
> thanks!!
>
> Em 14-03-2017 18:32, Rejaine Monteiro escreveu:
>>
>>
>> qmail-scanner seems crazy here...
>>
>>
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
>> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914
>> [email protected] [email protected]
>> Instantly_erect,_instant_respect
>> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
>> ....
>>
>>
>> Why "Clear" if SA score is 7.7 ?? Why not going to quaratine ( my
>> $sa_quarantine_over='5'; )
>>
>>
>> qmail-queue.log is:
>>
>>
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like SPAM
>> (score=7.7 required=5.0)
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan of
>> dir "/var/spool/qscan/tmp/server14895239985893511" in 1.698798 secs
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of
>> "/var/spool/qscan/tmp/server14895239985893511"...
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message took
>> 1.735613 seconds
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into
>> /var/qmail/bin/qmail-queue...
>> Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
>> Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914
>> [email protected] [email protected]
>> Instantly_erect,_instant_respect
>> <qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
>> 1489523999.3513-0.server:3508 1489523999.3513-1.server:5515
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf
>> /var/spool/qscan/tmp/server14895239985893511/
>> /var/spool/qscan/working/new/server14895239985893511
>> Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of 1.783561 secs
>>
>> I have several cases of messages with score by SA above 5 that should
>> be quarantined, but that are being delivered normally ..
>>
>> I'm going crazy here. Any idea?
>>
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org!http://sdm.link/slashdot
>>
>>
>> _______________________________________________
>> Qmail-scanner-general mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
>
> --
> Rejaine da Silveira Monteiro
> Suporte-TI
> Tel: (31) 2102-8854
> Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
> www.jamef.com.br
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> Qmail-scanner-general mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
--------------DA7EE6D153B04BA23E0BBB58
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>As a general point I think that a score of 5.1 to trigger
quarantine a little low ... it means you are going to have to
monitor that quarantine account very actively.</p>
<p>I much prefer using sa-reject which places the onus on the sender
of the e-mail ... but ! use a score of 7.7 as my trigger point.</p>
<p>When you quarantine neither the sender nor the recipient is aware
that this has taken place.</p>
<p>By using qmail-scanner with settings per domain feature you could
deliver the mails between say 5.1 and 7.7 to a specific Spam
folder in the recipients Maildir ... this relieves you of having
to monitor your quarantine events and any mails that are not
delivered are rejected during the smtp ... so the sender is aware
of the delivery failure ... and if the mail is genuine can choose
some other method of communicating.</p>
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 14/03/2017 22:23, Rejaine Monteiro
wrote:<br>
</div>
<blockquote
cite="mid:[email protected]"
type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<p><br>
</p>
The problem was the sa_quarantine_over parameter .. I think I was
interpreting it incorrectly .. as in my case I want for everything
that spam classifies above 5 in quarantine, then the value should
be 0.1 and not 5, as was before. <br>
because this line: <br>
<br>
if ($sa_quarantine_over > 0 && ($sa_score -
$sa_required_hits) >= $sa_quarantine_over) { <br>
&debug("SA: seriously spammy - quarantine and don't
deliver"); <br>
<br>
thanks!!<br>
<br>
<div class="moz-cite-prefix">Em 14-03-2017 18:32, Rejaine Monteiro
escreveu:<br>
</div>
<blockquote
cite="mid:[email protected]"
type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<br>
<br>
qmail-scanner seems crazy here... <br>
<br>
<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
Instantly_erect,_instant_respect
<qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
.... <br>
<br>
<br>
Why "Clear" if SA score is 7.7 ?? Why not going to quaratine (
my $sa_quarantine_over='5'; )<br>
<br>
<br>
qmail-queue.log is: <br>
<br>
<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: SA: yup, this smells like
SPAM (score=7.7 required=5.0)<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: spamassassin: finished scan
of dir "/var/spool/qscan/tmp/server14895239985893511" in
1.698798 secs<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: scanloop: finished scan of
"/var/spool/qscan/tmp/server14895239985893511"...<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: ini_sc: scanning message
took 1.735613 seconds<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: q_r: fork off child into
/var/qmail/bin/qmail-queue...<br>
Tue, 14 Mar 2017 17:40:00 BRT:3525: q_r: xstatus=0<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: qmail-scanner:
Clear:RC:0(194.67.222.61):SA:1(7.7/5.0): 1.740696 9914 <a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:[email protected]">[email protected]</a>
Instantly_erect,_instant_respect
<qyr1-q3qRwMXNPUJCgCOwtrdjcUswVS9bDzzxpXOejs.nsuEl60B9RNjQ0A-GTBbeE2CgXdDS2525pG
1489523999.3513-0.server:3508 1489523999.3513-1.server:5515<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: cleanup: /usr/bin/rm -rf
/var/spool/qscan/tmp/server14895239985893511/
/var/spool/qscan/working/new/server14895239985893511<br>
Tue, 14 Mar 2017 17:40:00 BRT:3511: all finished. Total of
1.783561 secs<br>
<br>
I have several cases of messages with score by SA above 5 that
should be quarantined, but that are being delivered normally ..
<br>
<br>
I'm going crazy here. Any idea?<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://sdm.link/slashdot">http://sdm.link/slashdot</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Qmail-scanner-general mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general">https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Rejaine da Silveira Monteiro
Suporte-TI
Tel: (31) 2102-8854
Jamef Encomendas Urgentes - Matriz - Belo Horizonte/MG
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="http://www.jamef.com.br">www.jamef.com.br</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! <a class="moz-txt-link-freetext" href="http://sdm.link/slashdot">http://sdm.link/slashdot</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Qmail-scanner-general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a>
<a class="moz-txt-link-freetext" href="https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general">https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general</a>
</pre>
</blockquote>
<br>
</body>
</html>
--------------DA7EE6D153B04BA23E0BBB58--
--===============7714802331851795326==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7714802331851795326==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Qmail-scanner-general mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general
--===============7714802331851795326==--