Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » Better ways to catch image spam?
  •  
jhtinc

Messages: 87
Karma: 8
Send a private message to this user
I've noticed that in current KMS builds, about the only sort of spam that consistently makes it through now is image-based spam. The headline is consistently spammy, but there's no body text, just a 180-300k image file that contains the message. Training is ineffective, so the vast majority of them still make the inbox.

I know Spamassassin is the engine we have in KMS for this - any strides towards fighting this so far in Spamassassin through rules (and if so, can those get into a coming-soon KMS build)? Blacklists don't have much impact - I suspect because most of them are sent by the botnets and pop up and down enough to stay a step ahead.
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
If the attachments are between 180 and 300 kB, no rules or training are going to catch them. Kerio does not do spam filtering on messages over 128 kB, and the size threshold is not possible to adjust.
  •  
Pavel Dobry (Kerio)

Messages: 5245
Karma: 251
Send a private message to this user
TorW wrote on Mon, 06 July 2009 16:40

If the attachments are between 180 and 300 kB, no rules or training are going to catch them. Kerio does not do spam filtering on messages over 128 kB, and the size threshold is not possible to adjust.


Only SpamAssasin's tests are not applied on big messages. Custom spam rules, DNS blacklists, SPF and Caller-ID checks are applied in all cases.
  •  
jhtinc

Messages: 87
Karma: 8
Send a private message to this user
Can we make large file scanning an option, or does Spamassassin itself prevent this? That's pretty much the only real way to sneak spam through consistently, so it's worth some means to fix - as more and more spammers exploit this loophole Spamassassin itself runs the risk of becoming useless over time.
  •  
RPC_Admin

Messages: 128
Karma: 0
Send a private message to this user
I will second jhtinc's comments on this. I agree the image spam is the latest spam horizon and if Kerio had some way to reduce this, I would be happy.
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
jhtinc wrote on Mon, 06 July 2009 18:28

Can we make large file scanning an option, or does Spamassassin itself prevent this?


The 128 kB limit is set by KMS. SpamAssassin's default is 512 kB, but it's possible to configure the threshold to what you want in a stock SpamAssassin setup.

And as Kerio_pdobry states (I was a little quick off the bat): only the SpamAssassin part of the filtering is subject to the 128k threshold.

The best thing you can do at the moment is to file a feature request to support to have the filtering threshold configurable.
  •  
mindtool

Messages: 2
Karma: 0
Send a private message to this user
This can be changed under the SpamAssassin section of the mailserver.cnf - MessageSizeLimit option.

Cheers.
Previous Topic: Cross-domain groups
Next Topic: Raid Configuration vs. Performance User Experience
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Wed Nov 22 04:58:11 CET 2017

Total time taken to generate the page: 0.00425 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.