Active Spam Killer

Luke · Post by **Luke** » Mon Oct 09, 2006 3:27 pm

Hope this isn't a stupid question, but prepared for the brickbats if that be the case...

Spam and junk are a growing problem for users. SpamAssasin used to be a workable solution, but more and more is getting through. Can I install an tool like "Active Spam Killer" on my websites? We use this tool where I work and it has reduced spam to a trickle.

Luke · Post by **Luke** » Mon Oct 09, 2006 3:34 pm

This probably should have gone under webhosting assistance - please feel free to move, and my apologies

Luke · Post by **Luke** » Mon Oct 09, 2006 4:30 pm

It's embarrassing to (at least partially) answer your own question, but it looks like the Boxtrapper utility included with Cpanel will accomplish this. Anyone use it? If so, got any tips (I'm searching, so I may answer this question as well) on how users can update their white/ignore/black lists?

Luke · Post by **Luke** » Thu Oct 12, 2006 3:45 pm

Since I seem to be the only one talking to me, here's some additional info:

Boxtrapper worked fine for 24 hours or so, until it went into some endless loop that hammered my server into submission. Had to kill it. Back to Spamassassin which is a less than ideal solution.

Post by **porcupine** » Thu Oct 12, 2006 4:37 pm

Luke wrote:Since I seem to be the only one talking to me, here's some additional info:

Boxtrapper worked fine for 24 hours or so, until it went into some endless loop that hammered my server into submission. Had to kill it. Back to Spamassassin which is a less than ideal solution.

Indeed, unfortunately our forums are less active then one might hope (hard to force user participation, and staff intervention always goes over email/helpdesk/im after all).

Luke · Post by **Luke** » Thu Oct 12, 2006 4:47 pm

Only problem I actually read the guidelines. The one for the help desk says "Try our help desk for urgent support", key word there being urgent. This wasn't urgent (although when it went belly up it was - thanks to you guys for a fast resolution, although I still wish I could get boxtrapper to work!)

Post by **porcupine** » Thu Oct 12, 2006 4:56 pm

Luke wrote:Only problem I actually read the guidelines. The one for the help desk says "Try our help desk for urgent support", key word there being urgent. This wasn't urgent (although when it went belly up it was - thanks to you guys for a fast resolution, although I still wish I could get boxtrapper to work!)

Ack, Can you point me to the guideline/text that indicates the helpdesk is for urgent support only? That needs to be corrected (as the helpdesk can be used for any support needs, the pager is the only "emergency only" support method we have after all).

gands · Post by **gands** » Thu Oct 12, 2006 7:05 pm

I highly discourage use of boxtrapper or any device like it because it automatically sends a reply to confirm that an email address is real. That's a big problem because spam emails usually have forged From headers, which means the victims of the forgery get backed up email accounts from 'message not delivered' and 'confirm your email address' auto-replies. In fact, the only time I would allow an autoresponder is if the recipient is in a white list.

Besides, boxtrapper is a really draconian way of dealing with spam. A really good solution would be to implement SPF into the email server. I don't mean just a txt entry in the DNS, but a true spf entry in it. This would greatly help determine between spam and genuine email.

Luke · Post by **Luke** » Fri Oct 13, 2006 9:17 am

http://www.prioritycolo.com/support

I agree that BoxTrapper (or Active Spam Killer or any of the other similar tools) are less than ideal. However, it works better than any other solution I've seen. Yes, I get email verification notices where someone has spoofed my email for SPAM at work. However, I get very few of those compared to the volume of crap that I wade through on a daily basis in my personal email.

My work address is plastered all over the world because of the nature of my business. On average, 3-5 spam emails a week slip though, and I get approximately the same number of invalid verification requests.

Contrast that with the 90-100 SPAM messages I get on my personal email each day. Even with Spam Assassin set to 7.0 more than a dozen leak through each day. With that volume, if a valid email gets erronously shunted as SPAM, odds are I'll never see it.

DEATH TO SPAMMERS!

Luke

Luke · Post by **Luke** » Fri Oct 13, 2006 9:26 am

"A really good solution would be to implement SPF into the email server. I don't mean just a txt entry in the DNS, but a true spf entry in it. This would greatly help determine between spam and genuine email."

Can I be a guinea pig?

Post by **porcupine** » Fri Oct 13, 2006 10:17 am

Luke wrote:"A really good solution would be to implement SPF into the email server. I don't mean just a txt entry in the DNS, but a true spf entry in it. This would greatly help determine between spam and genuine email."

Can I be a guinea pig?

First of all, thanks for the heads up on that wording (never got changed from when the new site was designed, and should have been), I'm getting that tied up now.

Unfortunately (last I looked) while implamenting SPF records into the DNS with CPanel is a trivial matter, they have not put out a exim port specifically setup to read/obey SPF records persay.

For cutting down spam, a few suggestions.

#1 - Lower to score, perhaps from 7.0 to 5.0 (remember, while you shouldn't have to, im fairly certain it accepts decimals). From my experience, 5.0 is a fairly normal base value for SpamAssassin.

#2 - you can outline specific elevated (or decreased, or even negative [tagging as friendly]) scores for various tests at the bottom of the Cpanel SpamAssassin configuration. If you get lots of SPAM emails that have a definite pattern, check the email headers for the spamassassin fields, and see what checks it triggered on, and simply give them higher values then they normally have (especially if you know them to be checks that will be unique to spam).

Luke · Post by **Luke** » Fri Oct 13, 2006 10:27 am

Thanks, Myles

I do want to lower the score, but indications are that messages tagged as SPAM are being deleted because I told Spamassassin to do it and then changed my mind. I'm reluctant to lower the score until I can look at the tagged messages, at least for awhile.

Luke

Post by **porcupine** » Fri Oct 13, 2006 10:41 am

Luke wrote:Thanks, Myles

I do want to lower the score, but indications are that messages tagged as SPAM are being deleted because I told Spamassassin to do it and then changed my mind. I'm reluctant to lower the score until I can look at the tagged messages, at least for awhile.

Luke

Then the logical solution there is to retain the score where it presently sits, and simply inspect spam that gets through, and individually tweak the settings to have more harsh values (or monitor falsely tagged spam, and lighten the score individually on the rules it triggers).

Luke · Post by **Luke** » Fri Oct 13, 2006 10:48 am

I apologize for not explaining my problem clearly.

Take a look at the "spamassassin deleting spam" topic under reseller assistance. I screwed up by clicking the "delete spam" option, and I don't want to lower the score because I can't see what's getting tagged anymore.

Sorry I'm dragging this out so long and wasting everyone's time, but if I can get spamassassin working like it was before I tried boxtrapper, I'm in good shape!

Thanks again, and sorry for the nagging.

Luke

Post by **porcupine** » Fri Oct 13, 2006 3:39 pm

Luke wrote:I apologize for not explaining my problem clearly.

Take a look at the "spamassassin deleting spam" topic under reseller assistance. I screwed up by clicking the "delete spam" option, and I don't want to lower the score because I can't see what's getting tagged anymore.

Sorry I'm dragging this out so long and wasting everyone's time, but if I can get spamassassin working like it was before I tried boxtrapper, I'm in good shape!

Thanks again, and sorry for the nagging.

Luke

Ahh I understand, and no worries, thats what support is for (not nagging, but getting to the bottom of things).

Priority Colo Inc.

Active Spam Killer

Active Spam Killer

OOPS