sane reject score

[Wiethoff, Helge]

Hello,

we have been using rspamd for about 6 months and reject emails with a score of
15 points or more.
Personally, this value seems quite high to me. I have not yet seen any desirable
mail with a score > 10. Do any of you use a value < 15 and saw false-positives?
I think 11 points are quite practical for me. How do you see it?

Cheers
Helge

[Alex JOST]

We've been using rspamd with 'reject = 12' for months without any
(known) false-positives.

--
Alex JOST

[David Mehler]

Hello,

Where do you set this reject option?

Thanks.
Dave.

> --
> You received this message because you are subscribed to the Google Groups
> "rspamd" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to rspamd+un...@googlegroups.com.
> Visit this group at https://groups.google.com/group/rspamd.
>

[Sophie Loe]

Hi,


Mine are in :

# cat /etc/rspamd/local.d/metrics.conf
actions {
reject = 12;
add header = 5;
greylist = 25;
}

But the file name is depreciated so should probably be in


# cat /etc/rspamd/local.d/actions.conf
actions {
reject = 12;
add header = 5;
greylist = 25;
}

Although the docs state metrics as valid, so I’m unsure.
https://rspamd.com/doc/configuration/metrics.html



Sophie

[Alexander Moisseev]

On 5/25/2018 8:39 PM, Sophie Loe wrote:
> Hi,
>
>
> Mine are in :
>
> # cat /etc/rspamd/local.d/metrics.conf
> actions {
> reject = 12;
> add header = 5;
> greylist = 25;
> }
>
> But the file name is depreciated so should probably be in
>
>
> # cat /etc/rspamd/local.d/actions.conf

Yes, it should be in /etc/rspamd/local.d/actions.conf

> actions {
Remove extra section name

> reject = 12;
> add header = 5;

It is a syntax error. Correct threshold name is "add_header".

> greylist = 25;
The order of action threshold should be `no action < greylist < add header < rewrite subject < reject`

> }
>

[Sophie Loe]

Thanks. Tried this, and also moving actions into actions.conf and it would not start:


# rspamadm configtest|more
unknown element in actions section: add

# cat actions.conf
reject = 12;
add_header = 5;
greylist = null;

# cat metrics.conf
symbol "MX_INVALID" {
score = 1.0;
description = "No connectable MX";
one_shot = "true";
}
symbol "MX_MISSING" {
score = 2.0;
description = "No MX record";
one_shot = "true";
}
symbol "MX_GOOD" {
score = -0.5;
description = "MX was ok";
one_shot = "true";
}








> On 25 May 2018, at 20:29, Alexander Moisseev <alexander...@gmail.com> wrote:
>
> On 5/25/2018 9:20 PM, Sophie Lo wrote:
>> greylist = 25;
>> I am using this to disable gray listing . Does this work?
> Use `greylist = null;` or disable greylisting module.

[Wiethoff, Helge]

Hi,

thanks @all for sharing your infos :-) I will give it a try with 12.

Bye
Helge

[Sophie Lo]

Hi,

Why does 'add_header = 5' not add a header when this happens?
X-Spamd-Result: default: False [6.90 / 12.00];

I changed 'add header' to 'add_header'.

-- 
You received this message because you are subscribed to the Google Groups "rspamd" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rspamd+un...@googlegroups.com.
Visit this group at https://groups.google.com/group/rspamd.

Best, Sophie
Sent from a mobile. Excuse my brevity.

[Sophie Loe]

Hi,


I took a stab in the dark and moved my metrics to actions. Thus,


# cat actions.conf
actions {

reject = 12;
add_header = 5;

greylist = 25;
}

metrics {

symbol "MX_INVALID" {
score = 1.0;
description = "No connectable MX";
one_shot = "true"; }
symbol "MX_MISSING" {
score = 2.0;
description = "No MX record";
one_shot = "true"; }
symbol "MX_GOOD" {
score = -0.5;
description = "MX was ok";
one_shot = "true"; }
}

Had no errors and emails are processed. This is what was needed, wasn't it?

[Sophie Loe]

I believe I also want to gave rewrite subject in my actions.

Is this correct? How will the Subject be written?
Old Subject = Bird food going cheep
New Subject = SPAM :Bird food going cheep

actions {
reject = 12;
add_header = 5;

rewrite_subject = 5;
greylist = null;

[Sophie Loe]

Tried and the rewrite did nothing. Subject untouched with " rewrite_subject = 5; "

Subject: Travel In Style with Spring Vacation-Ready Shades
X-Spamd-Result: default: False [8.70 / 15.00];
ASN(0.00)[asn:47377, ipnet:94.109.0.0/16, country:BE];
ARC_NA(0.00)[];
MV_CASE(0.50)[];
RCPT_COUNT_ONE(0.00)[1];
FORGED_SENDER(0.30)[];
RCVD_TLS_ALL(0.00)[];
FROM_HAS_DN(0.00)[];
MID_RHS_NOT_FQDN(0.50)[];
HEADER_FORGED_MDN(2.00)[];
RSPAMD_URIBL(4.50)[aliyuncs.com];
FROM_NEQ_ENVFROM(0.00)[kbr...@bjgbkj.com,sop...@klunky.org];
TO_DN_ALL(0.00)[];
DATE_IN_PAST(1.00)[];
RAMBLER_URIBL(0.00)[aliyuncs.com.uribl.rambler.ru];
RCVD_COUNT_ZERO(0.00)[0];
MIME_GOOD(-0.10)[multipart/alternative,text/plain]
X-Spam: Yes

[Ralph Meyer]

You have to configure something like

subject = "***SPAM*** %s"

[Sophie Loe]

Thanks Ralph.

My config is wrong anyhow. I cannot get the new actions.conf working so moved it back to metrics.conf to get this working again.

Thanks for the subject = syntax. Worked perfectly:
Subject: ***SPAM*** Travel In Style with Spring Vacation-Ready Shades

> On 27 May 2018, at 21:00, 'Ralph Meyer' via rspamd <rsp...@googlegroups.com> wrote:
>
> You have to configure something like
>
> subject = "***SPAM*** %s"
>

[Sophie Lo]

Morning all,

Any ideas why this was not rejected?

X-Spamd-Result: default: False [26.24 / 12.00];

I have this :
actions {
reject = 12;

[Sophie Loe]

Hi, 

I tried another config, but still not working:

The reject remains at 15 ( no idea where this 15 was configurated), and rewrite subject never happened. I don’t know any more. 

# cat actions.conf 

actions {

    reject = 12;

    add_header = 5;

    rewrite_subject = 6;

    subject = "***SPAM*** %s"

    greylist = null; 

}

X-Spamd-Result: default: False [11.20 / 15.00];

RCVD_COUNT_ZERO(0.00)[0];

RCVD_TLS_ALL(0.00)[];

RCPT_COUNT_ONE(0.00)[1];

TO_DN_ALL(0.00)[];

DATE_IN_PAST(1.00)[];

ASN(0.00)[asn:47377, ipnet:94.109.0.0/16, country:BE];

MIME_GOOD(-0.10)[multipart/alternative,text/plain];

MSBL_EBL(7.50)[lloydrob...@outlook.com,bab7d6648d6516b1a036a005f662ba56f9a63424];

HAS_REPLYTO(0.00)[lloydrob...@outlook.com];

ARC_NA(0.00)[];

MV_CASE(0.50)[];

FROM_NEQ_ENVFROM(0.00)[,sop...@klunky.org];

HEADER_FORGED_MDN(2.00)[];

FORGED_SENDER(0.30)[]

X-Spam: Yes

Do later releases ignore locally authenticated users? Did a release disable this, because I have skip_* = false inside milter_headers.conf:

skip_local = false;

skip_authenticated = false

Best, S.

[Sophie Loe]

Hi,

 

After adding the missing ; back in my local.d/actions below, the reject value remained at 15:

# cat local.d/actions.conf 

actions {

    reject = 12;

    add_header = 5;

    rewrite_subject = 6;

    subject = "***SPAM*** %s";

    greylist = null; 

}  

I saw in /etc/rspamd/actions.conf the reject was set to 15. Changing this to 13 gave me this correct result:

X-Spamd-Result: default: False [2.49 / 13.00];

Why does /etc/rspamd/actions.conf have an effect, but /etc/rspamd/local.d/actions.conf have no effect anymore?

[Alexander Moisseev]

On 29.05.2018 17:51, Sophie Loe wrote:
> Hi,
> After adding the missing ; back in my local.d/actions below, the reject value remained at 15:
> # cat local.d/actions.conf
> actions {
> reject = 12;
> add_header = 5;
> rewrite_subject = 6;
> subject = "***SPAM*** %s";
> greylist = null;
> }
>
> I saw in /etc/rspamd/actions.conf the reject was set to 15. Changing this to 13 gave me this correct result:
>
> X-Spamd-Result: default: False [2.49 / 13.00];
>
> Why does /etc/rspamd/actions.conf have an effect, but /etc/rspamd/local.d/actions.conf have no effect anymore?
>

Always check your configuration with `rspamadm configtest` after editing.
Doesn't it throw an error like this?

# rspamadm configtest
unknown element in actions section: actions
nested section: actions { actions { ... } }, it is likely a configuration error
syntax OK

As I've already told you, you need to remove "action{}" section from local.d/actions.conf:

[Sophie Loe]

My mistake. Apologies.

My actions file now reads:

# cat actions.conf
#actions {

reject = 12;
add_header = 5;
rewrite_subject = 6;
subject = "***SPAM*** %s";
greylist = null;

#}

metrics {
symbol "MX_INVALID" {
score = 1.0;
description = "No connectable MX";
one_shot = "true"; }
symbol "MX_MISSING" {
score = 2.0;
description = "No MX record";
one_shot = "true"; }
symbol "MX_GOOD" {
score = -0.5;
description = "MX was ok";
one_shot = "true"; }
}

# rspamadm configtest
unknown element in actions section: metrics
symbol 'RBL_SPAMHAUS_CSS' has its score defined but there is no corresponding rule registered
symbol 'RBL_SPAMHAUS_XBL' has its score defined but there is no corresponding rule registered
symbol 'RBL_SPAMHAUS_PBL' has its score defined but there is no corresponding rule registered
symbol 'RBL_SPAMHAUS_DROP' has its score defined but there is no corresponding rule registered
symbol 'RBL_SPAMHAUS_SBL' has its score defined but there is no corresponding rule registered
symbol 'RBL_SPAMHAUS' has its score defined but there is no corresponding rule registered
syntax OK

This is now recognised:
X-Spamd-Result: default: False [11.00 / 12.00];

But of course my metrics no longer work. Now that metrics.conf is no longer valid, where should we put define metrics?

[Alexander Moisseev]

metrics.conf is deprecated but still works. For now you can keep it in local.d/metrics.conf

[Sophie Loe]

But this is the problem. Where do I put my settings, now?
Where do these go in the new set up: ?