Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » SpamAssassin giving high AWL since 2010
  •  
shtaffa

Messages: 41
Karma: 0
Send a private message to this user
I am aware of the bug in KMS regarding spam and 2010. I have installed the patch.

However, since then, I have two users who seem to be getting unusually high AWL scores on messages they send. So high in fact that their messages are still being marked as spam.

Before I applied the patch, it seemed that these users messages were being incorrectly marked as spam more frequently than others.

I can only assume that SpamAssassin now thinks that they are chronic spammers and is assigning them the high AWL score.

How do I fix this? I've already had to wipe out my SpamAssassin history once due to some bumblehead not understanding what the spam button did. I don't want to have to do it again. I don't want to put in a rule for these senders email addresses in case an actual spammer gets a hold of the addresses and starts sending us spam. It would be nice to have some way to modify the information that SpamAssassin is using.

Help!
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
Since KMS lacks the usual SA tools you can't prune the AWL database. Normally, it's pruned regularly to avoid it becoming too large and bog down the server. I don't know if KMS does this by itself, but it isn't documented anywhere.

You can get around the issue by whitelisting the senders, but not just on the envelope-from address. Use SpamAssassin's "whitelist_from_rcvd" to whitelist the sender based on address and sending server:

In local.cf:
whitelist_from_rcvd user<_at_>example.com  example.com


This will whitelist user<_at_>example.com, but only if the mail was sent from a host in the example.com domain (thus not trigging on faked from-addresses). Restart KMS when you're done. You probably also want to set "trusted_networks" in local.cf to get this to work properly.
  •  
shtaffa

Messages: 41
Karma: 0
Send a private message to this user
I'll try that tonight. People will get cranky if I restart the mail server on them now.

Thanks.
  •  
shtaffa

Messages: 41
Karma: 0
Send a private message to this user
I have made the changes to the local.cf and they didn't seem to make a difference. Not sure if I did them right though.

There are 6 possible email addresses that one of the users could be sending emails from. I have added a separate whitelist_from_rcvd line for each of them. I have also set trusted_networks to 192.168..

The person that I'm able to work with right now for testing is still getting a AWL score of almost 5. Looking at other users in the company, they are getting an AWL score of less than 1.

Any other suggestions?
  •  
TorW

Messages: 769
Karma: 9
Send a private message to this user
The AWL score will stay the same, but you will see another test in the message header if this works: USER_IN_WHITELIST and a score of -100. Remember that you need the second argument (hostname) if you use whitelist_from_rcvd. If you don't know the hostname mail is coming from, you must use the simpler whitelist_from and leave out the second argument. The latter will unconditionally whitelist the sender address, so be careful.
  •  
shtaffa

Messages: 41
Karma: 0
Send a private message to this user
Hmmmm. It didn't work then. I don't see anything in the headers referring to USER_IN_WHITELIST.

Maybe I'll just open up a Kerio support ticket. They broke it, they can fix it.
Previous Topic: how do i expand zipped archived email in the store?
Next Topic: Official Palm Pre support?
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Sat Nov 18 09:40:18 CET 2017

Total time taken to generate the page: 0.00484 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.