BLACKLISTED spam quarantined

BLACKLISTED spam is quarantined (I guess 0 is less than the
cutoff level
of 4)
Don't know if I noticed this before.
Using sql based blacklist.
(I think I read you can assign numbers to wblist.wb instead
of 'W' or
'B')


X-Spam-Score: 0
X-Spam-Level:
************************************************************
****
X-Spam-Status: Yes, score=x tag=-999 tag2=4 kill=4
BLACKLISTED tests=[]


In amavisd.conf:

$final_spam_destiny=D_BOUNCE;

In sql policy:

 select  spam_quarantine_cutoff_level from policy where
policy_name='fdma.com'; 
+------------------------------+
| spam_quarantine_cutoff_level |
+------------------------------+
|                            4 |
+------------------------------+
 select * from wblist;
+-----+-----+----+
| rid | sid | wb |
+-----+-----+----+
|   1 |   1 | W  |
|   1 |   2 | W  |
|   1 |   3 | B  |
|   1 |   4 | B  |
|   1 |   5 | W  |
|   2 |   6 | W  |
|   2 |   7 | B  |
|   2 |   8 | B  |
+-----+-----+----+
select * from mailaddr;
+----+----------+----------------------------+
| id | priority | email                      |
+----+----------+----------------------------+
|  1 |        5 | listserver.hackertrap.net |
|  2 |        7 | notspammersecnap.net       |
|  3 |        5 | paypal.com                  |
|  4 |        7 | evilspammersecnap.com     |
|  5 |        7 | pentestssecnap.net        |
|  6 |        9 | wifeaol.com               |
|  7 |        9 | brotherinlawgmail.com     |
|  8 |        5 | lists.tehcsupport.com      |
+----+----------+----------------------------+


-- 
Michael Scheidell, CTO
561-999-5000, ext 1131
SECNAP Network Security Corporation
Keep up to date with latest information on IT security: Real
time
security alerts: http://www.secnap.com/news

 

------------------------------------------------------------
-------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the
chance to share your
opinions on IT & business topics through brief surveys
-- and earn cash
http://www.techsay.com/default.
php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Michael wrote:

> BLACKLISTED spam is quarantined (I guess 0 is less than
the cutoff level
> of 4)
> Don't know if I noticed this before.
> Using sql based blacklist.
> (I think I read you can assign numbers to wblist.wb
instead of 'W' or
> 'B')

for soft wbl, yes you can

> X-Spam-Score: 0
> X-Spam-Level:
>
************************************************************
****
> X-Spam-Status: Yes, score=x tag=-999 tag2=4 kill=4
BLACKLISTED tests=[]

The score is actually x (not relevant?), BLACKLISTED is
higher than any
possible kill_level. For mail that is delivered, the score
would
read "X-Spam-Score: -", but it looks like in the
quarantined message
it says "X-Spam-Score: 0" and it appears that is
the number that is
compared to spam_quarantine_cutoff_level. So I see what you
mean. The
expected behavior would be that given BLACKLISTED is higher
than any
possible kill_level, we would assume BLACKLISTED would also
be higher
than any possible spam_quarantine_cutoff_level, but this is
not the
case. I set spam_quarantine_cutoff_level = -1; (not much
different
than setting $spam_quarantine_to = undef;) and BLACKLISTED
mail was
no longer quarantined. It looks like the use of soft
blacklisting is
a way to push the score above spam_quarantine_cutoff_level,
so your
idea to use it will discard this mail, if that is your goal.

> In amavisd.conf:

> $final_spam_destiny=D_BOUNCE;

> In sql policy:

>  select  spam_quarantine_cutoff_level from policy where
> policy_name='fdma.com'; 
> +------------------------------+
> | spam_quarantine_cutoff_level |
> +------------------------------+
> |                            4 |
> +------------------------------+

>  select * from wblist;
> +-----+-----+----+
> | rid | sid | wb |
> +-----+-----+----+
> |   1 |   1 | W  |
> |   1 |   2 | W  |
> |   1 |   3 | B  |
> |   1 |   4 | B  |
> |   1 |   5 | W  |
> |   2 |   6 | W  |
> |   2 |   7 | B  |
> |   2 |   8 | B  |
> +-----+-----+----+
> select * from mailaddr;
> +----+----------+----------------------------+
> | id | priority | email                      |
> +----+----------+----------------------------+
> |  1 |        5 | listserver.hackertrap.net |
> |  2 |        7 | notspammersecnap.net       |
> |  3 |        5 | paypal.com                  |
> |  4 |        7 | evilspammersecnap.com     |
> |  5 |        7 | pentestssecnap.net        |
> |  6 |        9 | wifeaol.com               |
> |  7 |        9 | brotherinlawgmail.com     |
> |  8 |        5 | lists.tehcsupport.com      |
> +----+----------+----------------------------+

Gary V


------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/

Gary,

> The score is actually x (not relevant?), BLACKLISTED is
higher than any
> possible kill_level. For mail that is delivered, the
score would
> read "X-Spam-Score: -", but it looks like
in the quarantined message
> it says "X-Spam-Score: 0" and it appears
that is the number that is
> compared to spam_quarantine_cutoff_level. So I see what
you mean. The
> expected behavior would be that given BLACKLISTED is
higher than any
> possible kill_level, we would assume BLACKLISTED would
also be higher
> than any possible spam_quarantine_cutoff_level, but
this is not the
> case. I set spam_quarantine_cutoff_level = -1; (not
much different
> than setting $spam_quarantine_to = undef;) and
BLACKLISTED mail was
> no longer quarantined. It looks like the use of soft
blacklisting is
> a way to push the score above
spam_quarantine_cutoff_level, so your
> idea to use it will discard this mail, if that is your
goal.

You are right, there is an inconsistency in quarantining
code
which takes into account only score points, but ignores
hard white/black-listing. I'm aware of it, keep dragging
this
to-do entry from version to version, but I'm not sure if I
really
want to make blacklisting higher than
spam_quarantine_cutoff_level
for the purpose of turning off quarantining.

  Mark

------------------------------------------------------------
-------------
Using Tomcat but need to do more? Need to support web
services, security?
Get stuff done quickly with pre-integrated technology to
make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on
Apache Geronimo
http://sel.as-us.falkag.net/
sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-userlists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user

AMaViS-FAQ:http://www.amav
is.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/ho
wto/