Qmail-scanner Patch not rejecting Spam... how to setup?

soarchrist · Unread post by **soarchrist** » Fri Jun 27, 2008 10:45 am

I'm looking to have SA and Qmail-Scanner reject emails if their SA score is higher than 11. I am running a Plesk box with Fedora 7, with the ART packages for a manual install of SA, Qmail-scanner, and Spamdyke.

Ok, first I found qmail-scanner.ini in the /etc/ directory and edited that. I changed the --sa-delete feature to 6 (my SA required hit is 5 I believe) and the --sa-reject to yes.

This didn't solve the problem.

So I then did some research and since I have the the wonderful packages provided by ART, I realized that I already have the qmail-scanner patch! Ver 2.02 if I remember. After researching, I got the sense that the qmail-scanner patch utilizes a separate config and so I edited /var/qmail/bin/qmail-scanner-queue.pl and made the same changes to this file that I made to the qmail-scanner.ini. Reject to Yes, the delete threshold to 6.

Now... my problem is that after restarting the server, I'm still getting emails that are marked as SPAM and have scores greater than 14! What did I miss? Where else should I look? And what the heck am I going to have for lunch today?

Any ideas and/or answers would be wonderfully appreciated. Thanks!

Scott

breun · Unread post by **breun** » Fri Jun 27, 2008 6:49 pm

The normal procedure is: install the packages, edit /etc/qmail-scanner.ini to your liking (set SA_DELETE in this case) and run qmail-scanner-reconfigure. That should do it.

soarchrist · Unread post by **soarchrist** » Sat Jun 28, 2008 12:31 am

thanks Breun... I gave it a try and we'll see by tomorrow morning if I'm getting any spam over my new threshold. I'll report back to confirm for other onlookers and down-the-road searchers for the same topic.

Thanks again.

Oh... and you forgot to advise me on lunch. I ended up with Chinese.

breun · Unread post by **breun** » Sat Jun 28, 2008 5:21 am

Instead of waiting you can also run tail -f /usr/local/psa/var/log/maillog and see what's happening. You should see SPAM-DELETED for messages that score at least required_hits (from SpamAssassin's config) + SA_DELETE (in qmail-scanner's config).

soarchrist · Unread post by **soarchrist** » Sat Jun 28, 2008 9:14 am

Appears to be working! I've received three more spam messages today all with a score lower than 11.

If anyone else is reading/watching this thread... what is a good Spam score required for reject? SA is set to 5 to mark it as ****SPAM****... would it be reasonable to set the Delete(reject in my case) threshold to 3... making anything over 8 get rejected? Or is that a little too much.

Thanks Breun...

Unread post by **scott** » Sat Jun 28, 2008 10:05 am

I tag at 4, and delete at 6

breun · Unread post by **breun** » Sat Jun 28, 2008 10:18 am

Check what legitimate messages are scoring for a while. I like to delete at 6 as well.

soarchrist · Unread post by **soarchrist** » Sat Jun 28, 2008 2:55 pm

You guys rock... have a great weekend.

I didn't mention this in my other post, but I've been running SA with a required hit at 5 for the past 2 months. I have many users on this server, but I alone maintain probably 10 different email addresses and all of them, I haven't seen one ham message come through as spam. So... that tells me, with both of your obvious confirmations, that everything is working very nicely and that I can be comfortable deleting at 6.

Thanks again, gents.

Scott

faris · Unread post by **faris** » Sun Jun 29, 2008 9:39 am

I'm using tag at 4 and delete at 12 by default on our heavily loaded servers.

On our more specialist anti-spam servers we have delete at 8, however.

Faris