In that article a few errors were spotted...
In the section Bayesian Learning, I presented a
script for Bayesian learning method. For mbox format the correct
parameters are:
/usr/bin/sa-learn --spam -p /var/amavis/.spamassassin/user_prefs --mbox
/usr/bin/sa-learn --ham -p /var/amavis/.spamassassin/user_prefs --mbox
In the section Additional Notes, there is a paragraph
regarding MkS_Vir instalation and configuration.
For a test run, mksd should be called with a group vscan. This is
essential as all your mails will hang in the queue forever.
In other words, a line that reads:
# mksd -u mks -g mks scan 4
should be changed to:
# mksd -u mks -g mks,vscan 4
The script presented later on is OK.
Credits for spotting that go to: Krzysztof Stryjek.
I have also received an emial regarding SpamAssassin configuration. I will
quote it here as it goes.
I was reading quickly through your september article [0] and noticed
that you mention that in order to whitelist local messages you need a
rule in your SA config that looks like:
header LOCAL_RCVD Received =~ /\S+\.domain\.com\s+\(.*\[.*\]\)/
score LOCAL_RCVD -50
where domain.com is your local domain. This is a bad idea, since all a
spammer has to get those -50 is to give 'whatever.domain.com' when doing
the EHLO/HELO. You need to check for the domain in the reverse lookup
part of the received: header, like this:
header LOCAL_RCVD Received =~ /from.*\(\S+\.domain\.com\s+\[.*\]\)/
score LOCAL_RCVD -50
or, in case you don't have reverse dns set up for your local addresses,
then you need to look at the third field:
header LOCAL_RCVD Received =~ /from.*\(.*\[192\.168\.\d+\.\d+\]\)/
score LOCAL_RCVD -50
I noticed a rule just like the one that appears in your article being
"exploited" yesterday, so I guess that it is not that uncommon.
Credits for spotting that go to: Alberto Brealey G.
Thanks for everyone's feedback!
