How is Spam Assassin working ?

[Tazmania]

Can anyone give me a closer explanation how it works. I see that I only can enable and disable it, but I dont know what exactly it recongnize as SPAM.

Thanks,
Taz

[jason]

SpamAssassin uses a ton of rules to determine if a message might be spam. The rules range from hotmail and yahoo addresses that didn't originate from hotmail or yahoo servers to obnoxious large text in html messages, to finding the phrase "if you have received this in error" or "to be removed" in the body. Each condition has a score depending on how likely it is that a spamer as opposed to an ordinary person would use that technique. The score for all of the hits are added together and if the score reaches the threshold for spam (I believe the default is 5), the message is flagged as spam (a few headers are inserted into the message, but the most obvious is that the subject line contains "***SPAM***"). You can then set your mail client to move spam to a separate folder or to delete it automatically. See http://www.spamassassin.org for more details and to see the full list of tests that SA performs.

Although CP only allows you to turn it on or off, you can set some SA options by modifying configuration files in your account. See this thread for info about doing that.

There were some problems with SA when it was first installed which has caused many around here to be wary of it, but I've been running it with a customized config for a few months now and have not noticed any problems. Virtually all of the spam I get is flagged and I've only seen one false positive since I enabled it.

--Jason

[lookout]

Just saw mike7727 mentioned
another good thread on this topic in a parallel thread today.

[schemery]

Ok, I tried to setup a directory:
/home/schemery/mail/mss/.spamassassin

Then a file user_prefs.

Now I want to block everything but only allow certain addresses through.

so I set:
whitelist_from foo@domain.com

blacklist_from *@*.*

But it does not seem to work.

Do I need anything else? Do I have the user_prefs file in the right place?

I want some of my pop accounts to not be filtered and others to be filtered. So I don't want to do any blacklists to be global.

thanks
-kev

[jason]

SpamAssassin, AFIK, is account-wide. So anything you do effects your entire domain. You can't set it up on a specific address, which it looks like you are trying to do (it would be a nice feature to have it set up this way, hint, hint...).

SpamAssassin user prefs are stored in /home/USERNAME/.spamassassin/user_prefs

Also, SpamAssassin doesn't actually block mail, it only flags it as Spam, so blocklisting everyone except certain addresses won't prevent you from getting mail. It will just cause you to get all of your mail with ***SPAM*** added to the subject line.

--Jason

[Vin DSL]

Originally posted by jason
SpamAssassin uses a ton of rules to determine if a message might be spam...

Are you sure about that? I thought it used Bayesian analysis - basically 15 words that 99.9% of all spam contains. It weights these words and computes the probability of mail being spam, blah, blah, blah...

[Vin DSL]

Never mind... I see where you're coming from. Their web site spells out how SpamAssassin weights these words. Interesting! I'm surprised they would publish this info!

[jason]

Originally posted by Vin DSL
Interesting! I'm surprised they would publish this info!

Its an open source project, so its not like they can hide their logic from the spammers anyway. Might as well make it easy for laypeople to understand the program, too.

Regardless of how public the info is, its still catching most of my spam in my JPC accounts. I wish I could run it on my school account...

--Jason

[Vin DSL]

Originally posted by jason
Regardless of how public the info is, its still catching most of my spam in my JPC accounts.

I agree! 'We' turned it on a few months ago, to give it a try, and never turned it off. 'Our' whole group is happy with it...