Delete spam above certain score?

[lpittman]

I think I saw this somewhere on the forums before, but did some searching and couldn't find it.

I'd like to delete any spam that comes in over 25 or 30 on my system ... how would I go about doing that?

Luke
www.catch22media.com

 

[atomicturtle]

You can do it with qmail-scanner (available in my archive), it has a variable in it called sa_delete, which is the number of points above the spam threshold to delete a message. So assume spam is tagged at 5, setting sa_delete to 20 would delete spam 25 or above. Theres another variable called sa_reject that will change this to reject the message to the sender, rather than delete it.

 

[lpittman]

Originally posted by atomicturtle
You can do it with qmail-scanner (available in my archive), it has a variable in it called sa_delete, which is the number of points above the spam threshold to delete a message. So assume spam is tagged at 5, setting sa_delete to 20 would delete spam 25 or above. Theres another variable called sa_reject that will change this to reject the message to the sender, rather than delete it.

Hey Scott,

Thanks for the info.

I ran 'yum install qmail-scanner' and came up with the following results:

[root@server log]# yum install qmail-scanner
Setting up Install Process
Setting up repositories
Reading repository metadata in from local files
Parsing package install arguments
Resolving Dependencies
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for qmail-scanner to pack into transaction set.
qmail-scanner-2.01-9.rhel 100% |=========================| 69 kB 00:00
---> Package qmail-scanner.noarch 1:2.01-9.rhel4.art set to be updated
--> Running transaction check
--> Processing Dependency: perl-suidperl for package: qmail-scanner
--> Processing Conflict: qmail-scanner conflicts drweb-qmail
--> Processing Dependency: daemontools >= 0.76 for package: qmail-scanner
--> Processing Dependency: tnef for package: qmail-scanner
--> Restarting Dependency Resolution with new changes.
--> Populating transaction set with selected packages. Please wait.
---> Downloading header for perl-suidperl to pack into transaction set.
perl-suidperl-5.8.5-36.RH 100% |=========================| 18 kB 00:00
---> Package perl-suidperl.i386 3:5.8.5-36.RHEL4 set to be updated
---> Downloading header for tnef to pack into transaction set.
tnef-1.2.1-1.rhel4.art.i3 100% |=========================| 3.0 kB 00:00
---> Package tnef.i386 0:1.2.1-1.rhel4.art set to be updated
---> Downloading header for daemontools to pack into transaction set.
daemontools-0.76-1.rhel4. 100% |=========================| 9.3 kB 00:00
---> Package daemontools.i386 0:0.76-1.rhel4.art set to be updated
--> Running transaction check
--> Processing Conflict: qmail-scanner conflicts drweb-qmail
--> Finished Dependency Resolution
Error: qmail-scanner conflicts with drweb-qmail
[root@server log]#

As far as I know I don't even have a DrWeb license so its probably safe to remove it, no? Or can you suggest an alternative?

Thanks again.

Luke Pittman
www.catch22media.com

ps. I hope your on the SWSoft PayRoll ... I would have move away from Plesk awhile ago if it weren't for you.

 

[zeki79]

alternativly you can buy 4psa spam guardian. there you can set all this settings... i use it and i am happy with this solution...

greets
zeki

 

[breun]

Yes, remove all of drweb when installing qmail-scanner. Install ClamAV (clamd) while you're at it.

 

[atomicturtle]

Well I'm not on the sw-soft payroll, but I was a founder of plesk

And yes, qmail-scanner and drweb don't coexist well. Its because we both use the same trick to scan inside of qmail by creating a wrapper around qmail-queue. I was there first though

 

[lpittman]

Thanks Scott!

I knew you were a founder, but was just hoping you still got some kickback from your tremendous contributions.

I've removed DrWeb and installed qmail-scanner and clamav, but I'm still a tad unclear as to what exactly qmail-scanner is doing (and when). Perhaps you could take a second a give me a brief overview of the steps that are taken when an email arrives to when its delivered? Might be a big question, but It'll really help me to understand why/how instead of just 'install this' and 'install that'.

Thanks again.

Luke

 

[breun]

Scott is not the author of qmail-scanner. See http://qmail-scanner.sourceforge.net/ for more information.

 

[lpittman]

Originally posted by breun
Scott is not the author of qmail-scanner. See http://qmail-scanner.sourceforge.net/ for more information.

lol ... yes I'm perfectly aware that Scott is not the auther of qmail-scanner. I did check out the SF site for the project, but found it didn't explain the technical side much.

I am hoping for a basic, easy to understand explaination, thats all ...

If he (or anyone else) doesn't want to, let them respond. lol ...

 

[breun]

Basically it's like Scott said: a wrapper script (Perl) around qmail-queue. Instead of an email going straight to qmail-queue it is first processed by the spam and virus scanners on your system. If the mail wasn't dropped in the process it will go to qmail-queue.orig (the renamed original qmail-queue) after that.

 

[lpittman]

Thanks Breun.

So what 'calls' these scripts? Is there a file somewhere that says "ok, when an email arrives, run "superscript", then "coolscripter", then "hax0r", then deliver it to "mailbox"?

Luke

 

[breun]

Plesk's MTA is (a patched version of) qmail which consists of a number of small programs (see the contents of /var/qmail/bin). qmail is listening on port 25 (SMTP) for incoming e-mails. Once an email is received it is processed by various components of qmail and ends up in the queue (through qmail-queue).

qmail-scanner puts an extra script in the chain: it replaces qmail-queue by a script that calls the virus and spam scanners and outputs the result to qmail-queue.orig (=qmail-queue in an installation without qmail-scanner).

 

[lpittman]

Thanks so much - great information - now I'm starting to understand it.

If you don't mind ...

What defines the order of these "various components"?

Also it looks to me like qmail-scanner calls spamassassin as well as plesk/qmail, no? Am I mis-interpreting the qmail-scanner.ini files spam assassin settings?

Luke

 

[breun]

If you want to understand the complete inner workings of qmail I can't help you. But the source is available for you to read.

SpamAssassin is called by qmail-scanner which places its wrapper script in the qmail chain. I uninstall psa-spamassassin on my servers, so I don't have the SpamAssassin integration (and GUI) in Plesk.

 

[lpittman]

lol ... I'll get right on reading that.

Thanks for the info so far.

I thought psa-spamassassin was simply a GUI to the normal spamassassin, not a 'swsoft build' of spamassassin, isn't it?

I do all my settings directly in the conf file anyway ... perhaps I should just pull it out as well.

If I do this, can Watchdog still monitor the service?

Thanks again

Luke

 

[lpittman]

Originally posted by breun
If you want to understand the complete inner workings of qmail I can't help you. But the source is available for you to read.

SpamAssassin is called by qmail-scanner which places its wrapper script in the qmail chain. I uninstall psa-spamassassin on my servers, so I don't have the SpamAssassin integration (and GUI) in Plesk.

I've uninstalled psa-spamassassin, but how do I enable Arts copy of spamassassin to scan all mail?

 

[breun]

I guess Watchdog will still monitor the service, but I'm not sure as I don't use Watchdog.

Install qmail-scanner, make sure your virus and spam filters are up and running and then run qmail-scanner-reconfigure to make sure they're all included in qmail-scanner's wrapper script.

You might want to visit ART's forum if you have questions about the ART packages.

 

[wardjame]

Just to clarify. There is no way to accomplish something like this with the spamassassin install that comes from swsoft? I'd much rather just make some config changes than start removing and reinstalling software.

 

[gee_fin]

Hi,

I installed the qmail scanner (seems to have dropped into 'qmail-envelope-scanner', if you could you point me to the config file to edit for setting the threshold to delete mail it would be most appreciated Would be a very very useful feature!

Cheers,
Graeme.

 

[breun]

I installed the qmail scanner

From ART's repo?

(seems to have dropped into 'qmail-envelope-scanner',

I have no idea what you mean.

if you could you point me to the config file to edit for setting the threshold to delete mail it would be most appreciated Would be a very very useful feature!

I you're using ART's qmail-scanner and spamassassin packages, you can edit the value of SA_DELETE in /etc/qmail-scanner.ini. Check the comments in that config file for more info on how these variables influence the behavior of qmail-scanner. After editing /etc/qmail-scanner.ini you need to run qmail-scanner-reconfigure to pick up the changes.