Re: [AMaViS-user] Question about Amavisd-New and spam delivery/quarantining...

Glenn wrote:

> Ok. I'm running Amavisd-New 2.3.3.. just upgraded to SQL lookups & all
> the good nifty stuff.

> $sa_tag_level_deflt = 5.0; # add spam info headers if at, or above that
> level
> $sa_tag2_level_deflt = 6.3; # add 'spam detected' headers at that level
> $sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions
> $sa_dsn_cutoff_level = 30.0;

If you are using SQL, these default settings will only be used for
recipients you have not yet added to SQL, or for those assigned a
policy where the corresponding SQL fields are NULL.

> Now, I know that, in Theory (that wonderful place where almost anything
> is possible, which is right next door to Practice!), doing the
> $sa_dsn_cutoff_level should drop any spam that scores over 30, yet I
> still get spam delivery for that spam that scores over 30 as well as it
> going into the nifty user-level quarantine that was set up with
> Squirrelmail's Amavisdnewsql plugin.

I'm not at all familiar squirrelmail or the plugin, but I can see you
have a misconception of dsn_cutoff_level. This setting only has meaning
when $final_spam_destiny is D_BOUNCE. This setting determines at what
spam level amavisd-new will no longer notify the sender that the mail
they sent is considered spam. This may help you get a better view:
http://www200.pair.com/mecham/spam/a...-settings.html

> So, right now, I currently have set the following (just bits & pieces,
> unless someone really wants to see my whole .conf file..):

> $final_virus_destiny = D_DISCARD;
> $final_banned_destiny = D_BOUNCE;
> $final_spam_destiny = D_PASS; # subject to $sa_dsn_cutoff_level
> $final_bad_header_destiny = D_PASS;

> So, if I change $final_spam_destiny = D_DISCARD, does this mean that any
> spam that's scored from 1.0-29.9 will be delivered, or will it be
> dropped as well?

If you have a spam quarantine configured, and you set
$final_spam_destiny to something other than D_PASS, mail that scores at
or above kill_level_deflt will be quarantined and not delivered. If
you set it to D_PASS it will be quarantined *and* delivered. The
policy you have assigned to the recipient in the 'users' table will
have a value in the spam_kill_level field. This number determines at
what level a decisive action (like quarantining) takes place.

> If it's delivered, how do I make it so it *only* goes
> in the quarantine, and not delivered to the user's inbox?

Use anything other than D_PASS.

> And, are these
> good levels to use? What do other people use or recommend?

> I guess what I'm roundabout-asking how to make sure I'm doing is:

> 1) Any email with a level of 5 or greater--have info headers added.
> 2) Any email with a level of 6.3 or higher--be tagged as spam.
> 3) Any email with a level of 6.4-29.9 be quarantined.
> 4) Any email with a level of 30.0> be discarded.

Looks fairly reasonable to me, but the way you have it, all mail
tagged as spam would be quarantined. The 6.4 you show here would
actually be 6.3. If you set $final_spam_destiny to something other
than D_PASS, the recipients will never see any mail tagged as spam.
If you want a recipient to see mail tagged as spam, it has to be
passed to a recipient, so you would need to increase the gap between
6.3 and 6.3. As a side note, I find no reason not to place info
headers on all mail, spam or not:

$sa_tag_level_deflt = -999.0;
$sa_tag2_level_deflt = 6.3; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 8.0; # triggers spam evasive actions

> #'s 1 and 2 are working. 3 and 4 are the ones I need some help with.

> Thanks in advance!

To discard spam over a certain spam level, you can use:
$sa_quarantine_cutoff_level = 30;

(or @spam_quarantine_cutoff_level_maps)

You can also add this field to the 'policy' table and configure it on
a per-policy basis:

ALTER TABLE `policy` ADD `spam_quarantine_cutoff_level` FLOAT default NULL AFTER `spam_dsn_cutoff_level` ;

Since this is a quarantine_cutoff setting, I would guess it
only works if you have a place for quarantined items to go.
I also have no idea if it can be used when quarantining to
an SQL database, or whether it would function with your
squirrelmail plugin.

Testing and debugging would be in order.

> Best,
> --Glenn

Gary V



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=...486&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/