[svlug] Spam IS up !

[Drew Bertola]

Don Marti wrote:
> begin Drew Bertola quotation of Fri, Dec 08, 2006 at 09:40:36PM -0800:
>
>   
>> Dovecot seems to do everything well, at least, I haven't found anything
>> dovecot is particularly bad at.
>>     
>
> Anyone using it with offlineimap?  The Holy Grail for
> me would be Maildir with the same .muttrc on the mail
> server and the client systems.
>   

OK, offlineimap I haven't tried.  I should, though.

I also don't use maildir just because of the sheer number of file
handles.  For me, the great upside to maildir would be the ability to
rsync only new emails, rather than the constantly changing mbox'es. 

> I prefer Maildir because it makes spam filter training
> very simple.  grep -l for anything that's in the spam
> folder but doesn't have the spam filter's detected
> header -- the user, not procmail must have put it
> there, so train on it.  Same with the inbox and
> messages that are marked as spam.
>   

I'm now using greylisting via greylist-milter.  It's really been
effective at lowering my system loads.  I don't do any heavier filtering
until the server authenticates itself as a proper mail server, and then
it gets whitelisted for a week or two.  My logs show several servers
(more likely compromised boxes acting as mail bots) with 100-500 mails
rejected by greylist-milter every day.  It adds up to about 4000-5000
that don't even make it onto my system.

Then clamav (not many blocked, but a good safety net) followed by
spamass-milter which only rejects w/ a high score.

Now I get about 40-50 personal spam, of which 75% get properly
classified by spamassassin (via procmail) and the rest get caught by
bogofilter.  Procmail stuffs these into ~/mail/spam_ass and
~/mail/spam_bogo.  I then have a script that will train one from the
other.  If I have a falsenegative, I drag it to ~/mail/falsenegatives to
"learn" the text, and the very rare falsepositive goes to it's own mbox
to be "unlearned" by both bogofilter and spamassassin.  Once done, the
script disposes of the mail (so, I need to copy falsepositives to my
inbox, as well).

It's been very effective, but it takes a good week to get it all trained
up.  I wouldn't expect my mother to go through the whole regime, though.

--
Drew