dspam implementation?

[Scott DeLeury]

I've been playing with dspam a little bit, and it seems to have some reallly powerful capabilities.

I've run across articles on how to chain dspam to SA so that dspam utilizes SA's findings, as well as some "per-user" dspam web console php scripts.

Would be great to see the whole clamav, SA, DSpam (with web console), exim 4.x combination for directadmin as I think that could really cut things down to nil as far as spam goes.

Pipe-dream and alot of work more than likely, but no matter what I do, I still get some amount of spam in on a daily basis...I know nothing will ever cut it off completely, but you can always hope :)

[jlasman]

I'm going out to buy the book (if the stores are open today), and will study DSPAM.

But putting into the SpamBlocker3 release would hold up the release too long, so it's not going to be in the final release.

Why not add it as a request to the SpamBlocker4 forum :) ?

Jeff

[Scott DeLeury]

Will do Jeff, though I think your best reading for what will need to be done in the DA case is going to be on the net, and piecing together some of the available articles.

I can dig up some links for you if you want.

[jlasman]

Please always help. I'm just one guy and I spend most of my time making a living :) .

Jeff

[NSteffens]

I've also been reading up on DSPAM. There is a how-to on this forum:

http://www.directadmin.com/forum/showthread.php?s=&threadid=15902

It also includes CLAM-AV and AMAVIS... But I really can't separate 'good' solution from the bad ... There is so much info ;(...

[xemaps]

Exim and SA work good together, so why use dspam ?

[jlasman]

No decision has been made yet on implementing DSpam.

But to answer your question, SA doesn't work well for a lot of us; it uses too many resources.

Jeff

[Icheb]

I've seen dspam being used by some friends (yeah, those nerd guys everyone knows ;)), it works quite nicely, and is way faster than SA. However I don't think it would be easy to implement in DA...

[jlasman]

The book wasn't available in local stores, and I haven't bought it yet.

Since I want to bring out SpamBlocker3 as soon as possible, I'm not going to include dspam in it.

Jeff

[Maniak]

Hi,

Reading about DSPAM...

Could this article (http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050124/msg00099.html) help ?

Also found this pack (http://cdelfosse.free.fr/pub/exim4-dspam.tgz) from a french blog "You will find here the archive that allow you to configure exim4 with dspam, and a pretty good dpsam configuration.

French Blog (http://cdelfosse.free.fr/blog/index.php?2005/01/23/79-exim4-dspam)

[jlasman]

Sure it helps. What it doesn't do is automatically install DSPAM, which is yet another program. Let me see a show of hands; how many people want to run yet another daemon on their servers?

Anyone?

Talk...

Jeff

[NSteffens]

As far as I see, (but remember, I''m *not* an expert!), I'm now running spamassassin.

Your spamblocker (version 2) takes care of about half our spam (we don't have as much spam as a lot of you guys who are really hosting, just a few domains hosted), Spamassassin tags about a quarter and the last quarter isn't being tagged.

If DSPAM tags more or takes care of more I wouldn't mind. But I still would like the availlability of choosing how spam (if tagged) should be handled, still delivered, a spam box or black hole....

In short, I wouldn't mind an extra daemon if it does the job ;)...

[Maniak]

Hi Jeff,

I am looking forward to having Spamblocker + DSPAM and remove spamassassin from our boxes.

Furthermore a lot of people admit that DSPAM system reach a pretty great level of spams detection and is not so greedy as spamassassin.

I'd also like to keep ClamAV scanning for viruses and malwares due to the high numbers of Windows users.

So count my vote for Spamblocker + ClamAV + DSPAM.

If a plugin would be released and able to manage this, I would probably buy it to manage on some servers, as long as the price is fair.

Gregory

[vandal]

Same here,

Spamblocker blocks a huge number of spam as a first line of defense but many still trickle through, spam assassin normally gets about quarter that are left after that and at the same time running up my server load.

If dspam does indeed use less resources and does work better and still provides the option to turn it on and off per account that would work just dandy for me.

[Maniak]

Jeff,

I guess this is the easiest article and most precise one.

It keeps SA scanning, and it feeds DSPAM learning from the spam.

Just after running ...


# groupadd dspam
# useradd -s /bin/false -m -c "DSpam" -g dspam dspam
# usermod -G mail dspam
# cd /usr/local/src
# wget http://dspam.nuclearelephant.com/sources/dspam-3.6.8.tar.gz
# tar xvfz dspam-3.6.8.tar.gz
# cd dspam-3.6.8
# ./configure --prefix=/usr/local/encap/dspam-3.6.8 --sysconfdir=/etc --enable-spam-delivery
# make
# make install


Article :

http://dspamwiki.expass.de/Installation/Exim/SpamAssassin

[jlasman]

Thanks.

I'll look at that when I have a chance.

But it won't be the default for SpamBlocker3, because to replace SpamAssassin with dpsm will require agreement with, and timing with, DirectAdmin staff.

Jeff

[Lhadatt]

Has anyone gotten dspam to work? I've played around with it for a bit tonight using that article linked by Maniak, but perhaps I'm a bit rusty on this stuff. Exim is saying the program could not be executed:

2007-01-29 00:41:02 1HBQCM-000054-Jx == blahblah@blah.com R=dspam_router T=dspam_spam check defer (-24): Transport filter process failed (1)

This may be due to something screwball I've done in the exim.conf or dspam install. Would anyone who has this working mind posting their configs and install procedure? Thanks!

[pucky]

Oh but there is something far superior to Dspam or any other implamentation that we are currently in final testing with.

It blows away SA + Mailscanner, spamd and all those horrible cpu intense solutons that everyone has been implamenting. I cant reveal what it is at this time but its in the works of being offered as an installation on your server (FreeBSD right now) followed by a plugin that we are working on. The plugin is a few months away but those we prefer a manual installation will get the plugin for free when we have completed it and tested it. The plugins will give full spam control, whitelisting, blacklisting, option to filter your mail via RBL, URIBL, Virus control, PTR, HELO blacklisting, SRS signing Bayesian, Delaying, scoring, spoofing and dictionary attacks are a thing of the past, plus much more that can be controlled at the user level as well as the admin level. In addition, a no processing option is available for those who want ZERO spam filtering. Some of our users want no spam processing at all (CRAZY) but the option will be available for those who want it!

Thanks

[Lhadatt]

Well, sign me up for testing when you get around to CentOS. :)

[h2d]

we are a few months down the track has anything come of this Pucky.
Be very interested to know what you have going on?

[Duboux]

anything with anti virus, and a good spamfilter success, and low recourses is welcome :D

[TMMM]

Is there any update on your development pucky?

[jlasman]

Before anyone accuses me of hijacking a thread, let me point out that Scott, the original poster, decided to put this thread into the SpamBlocker3 subforum, which makes this post fair game ;) .

I ran a test on the catch rates of the latest (private beta) version of SpamBlocker3 over the past few days and I find that I'm finally getting good on blocking spam. For example, switching to zen.spamhaus.org has almost tripled the catch rate without increasing any known false-positives.

Here are some specs from one of my servers (note this is from a private beta, not yet available):
all email blocked by blocklists: 05-21-2007: 5046
all email blocked by blocklists: 05-22-2007: 5350
all email blocked by blocklists: 05-23-2007: 6116
and
all rejected/delivered email: 05-21-2007: 48622 / 9839 | 79% rejected
all rejected/delivered email: 05-22-2007: 38656 / 9252 | 76% rejected
all rejected/delivered email: 05-23-2007: 40412 / 8481 | 79% rejected
And perhaps even more important, on my personal addresses spam is now less than a third of what it was with previous versions of SpamBlocker3.

I have one more set of changes to test, and I think by Monday we should know what we want to use.

I can honestly see SpamBlocker3 going live in a week or or, and I hope that since it's included in DA, admins will give it a chance.

Jeff

[h2d]

Before anyone accuses me of hijacking a thread, let me point out that Scott, the original poster, decided to put this thread into the SpamBlocker3 subforum, which makes this post fair game ;) .

I ran a test on the catch rates of the latest (private beta) version of SpamBlocker3 over the past few days and I find that I'm finally getting good on blocking spam. For example, switching to zen.spamhaus.org has almost tripled the catch rate without increasing any known false-positives.

Here are some specs from one of my servers (note this is from a private beta, not yet available):

and

And perhaps even more important, on my personal addresses spam is now less than a third of what it was with previous versions of SpamBlocker3.

I have one more set of changes to test, and I think by Monday we should know what we want to use.

I can honestly see SpamBlocker3 going live in a week or or, and I hope that since it's included in DA, admins will give it a chance.

Jeff


nice work jeff
look forward to the release.

[sky]

Looking forward to that Jeff :)

[TMMM]

Ditto, I am more than ready to switch off of SA.
Good work.

[Ravnox]

I'm throwing in my vote for DSPAM for SpamBlocker 4 too. It is HIGHLY efficient if it is trained properly.

Here's the statistic for my own accounts for the curious:

Overall accuracy (since last reset) 98.363% (SPAM messages caught + Good messages delivered) / Total number of messages

Spam identification (since last reset) 95.491% (Spam catch rate only)

Spam ratio (of total processed) 35.039% Total SPAM messages (both caught & missed) / Total number of messages

I have been using it for 6 months now and I train it religiously. It makes a huge difference. You get a nice web panel to manage the quarantine email.

Other workers at my job have an overall accuracy between 94% to 98%.

[jlasman]

I'm still a bit confused about DSPAM.

How does it integrate with exim.conf?

Jeff

[Ravnox]

How does it integrate with exim.conf?

Sadly, I have no experience with Exim and DSPAM. The little I know(since I wasn't the one to do the setup) is with Postfix and DSPAM.

Our current setup is that we have a DSPAM+Postfix server. Mail goes through there first and is then relay to our final mail server. DSPAM act as a filter and will hold in quarantine the SPAM. (Which can be accessed through a web interface) There is nothing preventing you from having DSPAM on the same server. We used different server because it was easier for testing.

If you want, I could send you our DSPAM and PostFix config files. Maybe it would point you in the right direction? I don't have enough experience with Exim but maybe I'll have a look at it myself once I have some spare time.

[jlasman]

Please feel free to send a zip file to the email address in my siglines, but if you do please reference this thread thusly:

http://www.directadmin.com/forum/showthread.php?p=105965#post105965

so out of the hundreds of emails we get every day I can figure out what it's about.

I can't promise it'll be helpful, but I'll look.

Jeff