> -----Original Message----- > From: Kloosterman, Henk Jan [mailto:[EMAIL PROTECTED] > Sent: Thursday, June 12, 2003 6:12 PM > To: '[EMAIL PROTECTED]' > Subject: [SAtalk] Need some tips on setup of a "medium" network > > 1. I have a lot of email -adresses from users that are long > gone, but they > recive (a lot) of spam. > I planned to automatically report there incoming mail to > Razor, and if they > recieve mail that is not marked by SA or Razor, then let them > be "learned" > as spam. Is this the right thing to do? > > 2. Sold I forward the (perhaps) spam as is to all the > users?(So that they > can create their own rules) Or should I modify the mails: > Make the spam > attachment, and/or make annotation to it? ( I have the tools for that) > > 3. Should I let it up to the users to create the rules? Or should the > system-admins make them for the users? > > 4. How should I said up the learn facility's? Make a spam and > no-spam (ham) > folder for each user, or should I create a public folder > where the user can > put in thier ham/spam? And then how can I make sure that I > also learn some > "normal" mails? Just pick a mailbox? > > Henk-Jan Kloosterman
Hi, I have a few thoughts that I'm willing to share.... 1. I have not yet really worked on the issue of former employees with old non-existent accounts, but I would hesitate to automatically forward incoming mail to razor. How many of those messages are valid, mailing lists, etc. I don't think that it would be a good idea to start submitting valid mailing list emails to something like razor or DCC. All of the FAQs that I have read strongly urge you to hand verify each message that you submit. At the moment I'm using several old accounts as a test to see how well the system is working and to gather messages that don't score very high. I have created a dummy account and added several old email addresses as aliases, this way I have an account that gets a lot more spam than I do. It has been very helpful to see how much spam gets caught and how much makes it through. 2. At the moment I'm just forwarded the mail as is and will most likely leave like this. People won't complain about what they can't see. If they don't want to take advantage of SA, then they won't see any different in their mail. 3. I'm still working on a good way to roll out the rule without user intervention, if you can do this I think it would be great, of course you'll probably have to remove it from some people's mailboxes, but that should be less work than setting everyone else up. 4. This probably would depend on if you have per user bayes or site-wide. I'm running site-wide bayes, so I setup two public folders, Verified Spam and Verified Non Spam. The Non Spam folder is visible but the only people that can view the contents are two IT members. Users can drag and drop messages in the folder, but no one can view any of the messages. This method also seems to leave the headers more intact than any of the other methods I looked at. I do not let users submit their own spam, I have seen people submit internal emails, emails from clients, etc. as spam. I require them to attach the messages in a new email and send it on to me, so it can be reviewed before it is submitted to be learned. For "real" messages, I have been asking anyone who is testing the rules (I'm just starting to roll this out to the end users) to submit 10-30 real messages, I figure if I can get 500+ people to do this, then I'll be set on my ham data. If you are going to just pick a mailbox, it would probably work better to grab several mailboxes to get a better variety of messages. To learn the messages, I created a user on the SA relay box and setup pine to access the public folders via IMAP, I save the messages to a pine folder and then run sa-learn on that mbox file. So far it seems to be working pretty well. HTH, Matt ------------------------------------------------------- This SF.NET email is sponsored by: eBay Great deals on office technology -- on eBay now! Click here: http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
