Inquiry: Server Level SPAM filtering

[SendTrash]

My organization is currently exploring options to filter SPAM at the server level, rather than through procmail (aka delivery). Is anyone currently doing this? What tools are you using?

What we want to possibly see happen is to have a filter than identitifies incoming email and checks if its spam or not. If it is spam, we would like to modify the message header or message title to indicate its spam. Is this possible?

Currently we are using SpamAssassin, but in order to enable it, users have to opt-in the service by placing a .procmailrc file with the filter defined.

 

[Nothinman]

Couldn't you set it up globally with a global /etc/procmailrc file?

 

[SendTrash]

Is there any way to mark spam on the message title itself? I have been reading up on SpamAssassin and simliar tools, but they just id spam in the message headers.

When people use webmail, they don't see those markings

 

[Nothinman]

The headers are added so that filters can be added to filter on the client side depending on what's in the headers, spamassassin just scores the message and lets you decide what is too high of a score. I believe some webmail clients like IMP3 have some level of filtering, but I prefer to do server side filtering with sieve since I use Cyrus IMAPd.

 

[nealr]

I use orfilter.
link
I think it does what you want. I have mine configured so all mail gets delivered, and mail suspected as spam changes the message title to SPAM: then the message title. I personally filter my mail to a spam folder, but you can do a lot with it.
It's also freeware and there's a great support forum.
any more q's just PM me.

 

[SendTrash]

Originally posted by: nealr
I use orfilter.
link
I think it does what you want. I have mine configured so all mail gets delivered, and mail suspected as spam changes the message title to SPAM: then the message title. I personally filter my mail to a spam folder, but you can do a lot with it.
It's also freeware and there's a great support forum.
any more q's just PM me.

This is what I am looking for.. but a glance at the website I see that it is for windows systems... anything like this on UNIX? a nice, all together package?

Also, does anyone know how big corporates like IBM and such deal with spam?

 

[edmicman]

doesn't spamassassin run at the server level too? it runs on our linux server and adds spam header flags to the message. i'm almost sure you can customize it to append something to the subject too....i'd have to look it up though.

 

[Need4Speed]

spamassassin is the way to go...been running it for over a year now, and it catches almost everything. 2.60 release is much better at correctly identifying legit mass mail too.

 

[SendTrash]

yeah, been seeing SpamAssassin around so many places... is there no other competive product?

 

[SendTrash]

anyone read this article?

Six approaches to eliminating unwanted e-mail

I am intriguted by the Bayesian filters, plus by the report that SpamAssassin isn't as hot as people think it is... now I hope someone developed a server level filter that uses bayesian analysis

 

[sciencewhiz]

First of all, Bayesian analysis is availible in SpamAssasin. So is blacklists. That IBM article didn't use either of those when testing SpamAssasin.

Second, a Bayesian filter with no means of updating itself is of no more use then SpamAssasin. Thus, you must continue to train the filter. The problem becomes who trains it? Does the server admin train it, using his personal e-mails? Then it will be trained towards the type of e-mails the server admin gets. What about a random sample of all user's e-mail. That might work until you read somebody's love letter. If you just ask people to forward you spam that gets through, you end up tilting the filter, since it needs both good and bad e-mail.

Personally, I think that a filter like SpamAssasin is best for the server. If the users want better protection, they can install something on their PCs. Mozilla mail/thunderbird has bayesian spam filter built in, and I know there are several others.

 

[SendTrash]

yeah, my mistake. I didn't catch it that they didn't have all the features of SpamAssassin enabled.

 

[Need4Speed]

all i can say is that for the year that i have been using SA, it has worked as the author(s) claim. The key lies in the continual training of the filters. Maybe if they guy that wrote that IBM article had taken the time to properly set up SA and train it, then his results might have been better...I can guarantee you that they would have been. There isnt a filter on the planet that you can just plop into place and expect it to work miracles.

 

[SendTrash]

Need4Speed:

but how do you train your filters? sciencewhiz brought up a good point. Does the sys admin train the filters using his/her own personal emails? have users send you spam?

 

[Need4Speed]

since i admin the mail server, i use a my own spam to train the filter on a weekly basis. you also need to feed the spam filter non-spam mails, it will help it distinguish between whats spam and what is not spam. most of my users have shell access, so they can train the filter themselves. If your users do not have shell access, just have them send you the spam that gets through. You might also encourage them to send you non-confidential non-spam mail.