Re: [tlug] antispam tricks

["Mauro Sauco" <sauco@example.com>]

On 2006/11/15@??:24, <Botond Botyanszki> wrote:
  Botond> I'm using spamassassin-3.1 on debian sarge, but still not
  Botond> satisfied with the result. Now that I get ~300 identified spam
  Botond> per day on my domain, the 98-99% efficiency yields a couple of
  Botond> spam mails reaching my inbox.  I have come to the conclusion
  Botond> that I need to do some more serious configuration to my mail
  Botond> server.
  Botond> 
  Botond> Here is what I need: * With the rate of spam doubling every
  Botond> 2-3 months I'll get to the level where my server won't be able
  Botond> to keep up with the load because SA is a real resource hog, so
  Botond> some antispam measures should be taken at IP level.  I need a
  Botond> script or some SA or exim extension that will blacklist that
  Botond> IP (add a REJECT rule to iptables) if a mail is identified as
  Botond> spam.  It must be safe and well tested and can expire old
  Botond> entries as well.  I know that Godwin was using some static
  Botond> country based blacklisting method, but I don't want that much
  Botond> prejudice.

I think that "Penalty Box (PB) trapping" as called by ASSP is what you
want.

ASSP proxy solved all my problems. Takes NO TIME to install, it is a
proxy so no modifications needed to your current system (just make smtp
liten on a different port), and needs practically NO MAINTENANCE.

    * Fully transparent Training mode for implementation testing
    * Bayesian Analysis
    * Automatic Bayesian corpus training
    * Automatic Whitelisting
    * Redlist to control what addresses can and can not be added to Whitelist
    * Allow spam to bypass certain filters per recipient
    * RegEx based filters
    * Penalty Box (PB) trapping
    * RBL (Real-time Black-hole Listing, aka DNSBL)
    * Multi-level SPF (aka Sender Policy Framework)
    * SRS fix-up (aka Sender Rewriting Scheme)
    * Delaying (aka Greylisting)
    * Sender & recipient validation
    * Multi-level attachment blocking
    * Multiple RFC validation mechanisms
    * Low maintenance once setup
    * Analysis interface to determine exactly why a message was blocked
    * Ability to send copies of all spam to specified address 
    * Optional configuration web based interface
    * Can run from a chroot jail (recomended)
    * A lot more ...

http://www.asspsmtp.org/wiki/Welcome


//mauro//