Alain Terriault wrote:

Hi,

What is todays most effective combination to filter spam ?

On my old Redhat 3 system I used Sendmail and Spamassasin .. it was good, but with the current setup we are getting way to much spam.

Looking around I found new players, well some I did not know then and they are very interesting..

MailScanner .. http://www.mailscanner.info/ Sagator .. http://www.salstar.sk/sagator/ Smf .. http://smfs.sourceforge.net/index.html dspam .. http://dspam.nuclearelephant.com/index.shtml

I am tempted to go with smfs because it is familiar .. but, mailscanner seems popular

I've been very happy using the RBLs with Sendmail. In sendmail.mc add:

dnl # dnl # dnsbl - DNS based Blackhole List/Black List/Rejection list dnl # See http://www.sendmail.org/m4/features.html#dnsbl dnl # FEATURE(`dnsbl', `bl.spamcop.net', `"Spam blocked see: http://spamcop.net/bl.shtml?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `cbl.abuseat.org', `"Spam blocked see: http://cbl.abuseat.org/lookup.cgi?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `sbl.spamhaus.org', `"Spam blocked see: http://spamhaus.org/query/bl?ip=%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl', `list.dsbl.org', `"Spam blocked see: http://dsbl.org/listing?%22$&%7Bclient_addr%7D%27)dnl FEATURE(`dnsbl',`dnsbl.sorbs.net',`"554 Spam blocked " $&{client_addr} " found in dnsbl.sorbs.net"')dnl dnl #

Scott Silva wrote:

on 6-4-2008 1:53 PM Alain Terriault spake the following: I really like MailScanner. You can add it to your current system with very little effort, and add virus scanning very easily. You will still need to spend time training and maybe write an occasional spamassassin rule, but that is just the nature of the game anymore. Spam changes constantly, and you have to change with it.

+1 on MailScanner. Easy to install and configure, self-updating. I also use Rules du Jour to update spamassassin.

Craig White wrote:

On Wed, 2008-06-04 at 16:53 -0400, Alain Terriault wrote:

...

Hi,

What is todays most effective combination to filter spam ?

On my old Redhat 3 system I used Sendmail and Spamassasin .. it was good, but with the current setup we are getting way to much spam.

Looking around I found new players, well some I did not know then and they are very interesting..

MailScanner .. http://www.mailscanner.info/ Sagator .. http://www.salstar.sk/sagator/ Smf .. http://smfs.sourceforge.net/index.html dspam .. http://dspam.nuclearelephant.com/index.shtml

I am tempted to go with smfs because it is familiar .. but, mailscanner seems popular

---

I use MailScanner but it still uses spamassassin.

I use postfix and greylisting and block e-mails that coming from hosts that don't resolve by reverse dns or for that matter don't have valid hostnames. I also use some rbl's.

Those things alone and greylisting knock down most of it so spamassassin has a much lighter load and MailScanner is awesome.

Same here - I use a 3 phase approach to pre-filtering spam. I use postfix restrictions (requiring a FQDN helo hostname blocks ~30% on my server), DNSBL's (zen.spamhaus.org, dnsbl-1.uceprotect.net, psbl.surriel.com, bl.spamcop.net) and greylisting which in combination blocks >99% of all spam _before_ it enters the server and needs any costly post-filtering by SpamAssassin/ClamAV etc. It's an extremely effective solution for me (YMMV).

Ned

On Wed, 4 Jun 2008, Alain Terriault wrote:

What is todays most effective combination to filter spam ?

We use a three-way combination (on a CentOS 5 base), in this order:

1. sbl-xbl.spamhaus.org 2. clamav-milter 3. spamass-milter (milter-ized spamassassin)

Our server only handles about 50 user accounts, so it's not an industrial-strength setup by any means -- though our uptime is well above our internal SLA, and most of our employees have a fairly active e-mail life. :-)

All bounces happen during the SMTP transaction, so there's no backscatter problem.

In a typical week, spamhaus will block ca. 60% of inbound traffic, spamassassin 10%, and ClamAV 2-3%. We end up delivering only about 25% of the messages we receive from the Internet.

We use rpmforge packages for everything.

Hi,

On Thu, 2008-06-05 at 00:23 -0500, Les Mikesell wrote:

Alain Terriault wrote:

...

What is todays most effective combination to filter spam ?

On my old Redhat 3 system I used Sendmail and Spamassasin .. it was good, but with the current setup we are getting way to much spam.

Looking around I found new players, well some I did not know then and they are very interesting..

MailScanner .. http://www.mailscanner.info/ Sagator .. http://www.salstar.sk/sagator/ Smf .. http://smfs.sourceforge.net/index.html dspam .. http://dspam.nuclearelephant.com/index.shtml

I am tempted to go with smfs because it is familiar .. but, mailscanner seems popular

Another good choice is MimeDefang (http://www.mimedefang.org/). There are rpms of it and clamav in the rpmforge repo.

I use a combination of Postfix with rbl, spamassassin, clamav and amavisd. It filters about 95-98% of my spam. I also have a spamcop account to report the spam that gets through.

Regards,

Michel

On Wed, 2008-06-04 at 16:53 -0400, Alain Terriault wrote:

Hi,

What is todays most effective combination to filter spam ?

On my old Redhat 3 system I used Sendmail and Spamassasin .. it was good, but with the current setup we are getting way to much spam.

Looking around I found new players, well some I did not know then and they are very interesting..

MailScanner .. http://www.mailscanner.info/ Sagator .. http://www.salstar.sk/sagator/ Smf .. http://smfs.sourceforge.net/index.html dspam .. http://dspam.nuclearelephant.com/index.shtml

I am tempted to go with smfs because it is familiar .. but, mailscanner seems popular

thanks, alain

I would recommend using Postfix along with Amavisd-new which in turn would invoke Spamassassin for spam filtering. You can also use an anti virus program like Clam AV with it to filter for viruses also. I have experienced excellent performance using this combination with lesser utilization of system resources as compared to sendmail.

As suggested by many others, you must also configure a couple of RBLs which will actually reject a major part of the incoming spam / junk mail and leave very little for subsequent filtering.

-- Manish

On Sun, 08 Jun 2008 15:39:31 -0400 Mark Weaver mdw1982@mdw1982.com wrote:

I.e. if a business in Pennsylvania only does business in the lower 48 there isn't any need to accept port 25 traffic from Asia, Europe, Latin America, etc...

Until "something comes up" and your users and/or customers are sunk.

I'm the "IT department" for a small company that does local classified ads. No news, just classified ads -- cars, boats, quilts, that kind of thing. Local interest only? There are paying customers who subscribe to the online edition of this paper from many countries around the world, from Ireland to Malaysia.

I would really hesitate to block email by geographic location alone; you never know where your customers are going to come from. Even if it's a locally performed service like plumbing or siding installation -- perhaps someone is moving to your area and doing some advance planning and you could miss the opportunity to provide a quote or information and gain a customer.

I agree with previous poster RE: Postini, we have clients that use the service and it's fantastic.

I use Postfix / Amavisd - Clam-AV / SpamAssassin + SARE rulesets (with DCC, Pyzor, Razor) locally and ater the initial setup it's excellent.

I've also done just Postfix / Amavisd - Clam-AV / SpamAssassin + SARE and used Greylisting for other clients as well and that's been unbelievable. Greylisting as a method to reduce spam is the heat!

In both of the above setups are spread across 3 machines in a multi-tiered architecture. Use your DMZ to pre-filter, with Postgrey, header checks, body checks, then allow to next hop where you can spam-check, virus check, then allow to local intranet mail server for local delivery / IMAP.

But if you want to farm it out - use Postini.

-Peter

2008/6/8 Jason Pyeron jpyeron@pdinc.us:

...

-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Frank Cox Sent: Sunday, June 08, 2008 4:04 PM To: CentOS mailing list Subject: Re: [CentOS] sendmail and spam

On Sun, 08 Jun 2008 15:39:31 -0400 Mark Weaver mdw1982@mdw1982.com wrote:

...

I.e. if a business in Pennsylvania only does business in the lower 48 there isn't any need to accept port 25 traffic from Asia, Europe, Latin America, etc...

We have foreign language emails from foreign countries, so this and other assumptions about content are a big no-no.

...

Until "something comes up" and your users and/or customers are sunk.

Ditto.

We are using Postini. It is a spam filtering service from Google at 3$ per email address (aliases are free) per year. We have no load they are promising the API will be re-enabled in the upcoming weeks.

We have only had 2 messages with a false positive and one with a false negative. Mail volume is around 10,000 messages per day. Latency is next to zero.

Sorry for the advert, but its what we are using.

Jason

--

•                                                           -
  

• Jason Pyeron PD Inc. http://www.pdinc.us -
• Principal Consultant 10 West 24th Street #100 -
• +1 (443) 269-1555 x333 Baltimore, Maryland 21218 -

•                                                           -
  

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, purge the message from your system and notify the sender immediately. Any other use of the email by you is prohibited.

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos