Re: [exim] Spamassassin

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: W B Hacker
Dátum:  
Címzett: exim users
Tárgy: Re: [exim] Spamassassin
Peter Kirk wrote:
>> Started new thread :-)
>>
>> Spamassassin is not using greylisting database,
>
>> It never uses and will never use.
>>
>
>     >I noticed that spamassassin is using all the cpu as when I stop
> it, the server returns
>     >to normal.

>
>> Are you passing ALL mail through spamassassin, even 1MB ...20MB?
>> I never pass any mail larger than 256K through spamassassin.
>
>> -- 
>> Best regards,
>> Odhiambo WASHINGTON,
>> Nairobi,KE
>> +254733744121/+254722743223
>> _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
>> "Clothes make the man.  Naked people have little or no influence on
> society."
>>             -- Mark Twain

>
>
>
> I don't scan anything over 256K either and have turned off the auto
> whitelist but still having the problem
>


Do you use 'require verify = recipient'

If not, suggest you read up on it and apply it, as it will buy you
'time' to add even better tools.

No point in scanning traffic from dictionery-attack zombots.

Next step is to better qualify arrivals within Exim, so that they never
need to reach SA at all.

Most zombots can be blown off with a combination of rDNS checks, HELO
FQDN checks, and a small 'delay' or two. They are terribly impatient..

These need not be 'hard edged' tests!

A small set of 'warn' verb loading values into acl_c thence to acl_m
variables as 'scores' can be tested against a threshold and/or added to
'spamint'.

It helps to run, for example, ClamAV *before* SA, and hard-reject, as it
is a lighter system load as very, very rarely false-alarms.

At that point you can begin to 'strip' SA by optioning-off of its tests
in interpreted perl that have already made faster and cheaper within
Exim's compiled 'C'.

Ideally, a slimmed-down SA nneds a mere fraction of the resources to
complete its scan, and will only be asked to look at around 10 to 20% of
arriving traffic.

Exim will have shed the worst of the garbage beforehand.

*Many* ways to get to that point...

- but you'll need to select what fits your environment, step at a time -
and test, test, test...

Do not just adopt acl snippets that work for others without through
testing, as there are many possible interactions.

HTH,

Bill