Print Page | Close Window

Advanced configuration

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6659
Printed Date: 05 February 2025 at 5:58pm


Topic: Advanced configuration
Posted By: sirrar
Subject: Advanced configuration
Date Posted: 21 April 2009 at 4:30am
Hi
 
I need to receive some mail which has been scanned by another spamfilter before entering spamfilter.
I have configured the filter before spamfilter to tag subject and deliver. I have then in Spamfilter configured it to look for the keywords i use in the tag so that spamfilter can quarantine the mail (so that I only have one end user quarantine.) Here comes the problem. When the filter before spamfilter have tagged the subejct and delivered it, spamfilter finds the keyword and qurantines it - as it should. But the IP from the filter then gets listed in the SFDB even though I have deselected SFDB for that domain in spamfilter...
And the IP of the filter in front of spamfilter also gets listed in a limbo.
 
How to whitelist the ip from the filter in front of spamfilter - and still be able to quarantine tagged mails from the filter?
 
From the log:
04-21-09 10:11:34:393 -- (15344) Found Keywords: [Subject:SPAM:_]
04-21-09 10:11:34:393 -- (15344) EMail from mailto:xxx@xxx.xx - xxx@xxx.xx to  mailto:yyy@yyy.yy - yyy@yyy.yy matches content filter rules - rejected.
04-21-09 10:11:34:409 -- (15344) Starting quarantine procedures
04-21-09 10:11:34:440 -- (15344) Created thread (16144) to add email to quarantine
04-21-09 10:11:34:440 -- (15344) Starting bayesian procedures
04-21-09 10:11:34:471 -- (15344) Blacklist cache - Updated limbo counter for xxx.xxx.xxx.xxx
04-21-09 10:11:34:502 -- (16144) EMail from mailto:xxx@xxx.xx - xxx@xxx.xx  to  mailto:yyy@yyy.yy - yyy@yyy.yy was received and quarantined. Size: 18 KB, 18432 bytes
04-21-09 10:11:34:909 -- (15344) SFDB - Added xxx.xxx.xxx.xxx - Response: Error=0


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA


Replies:
Posted By: LogSat
Date Posted: 21 April 2009 at 7:23pm
sirrar,

From the log entries above, we see that the possible issue is that your first spamfilter (xxx.xxx.xxx.xxx) is being added to the blacklist cache (which will eventually cause that IP to be blocked by your 2nd SpamFilter). We do have a solution for this - please see the following option in the SpamFilter.ini file:

;Add any IPs (separated by commas - no wildcards) that you do not wish to be automatically added to the Honeypot IP blacklist. This setting also prevents those IPs to be added to the IP cache blacklist
DoNotAddIPToHoneypot=

Even with the setting above the IP xxx.xxx.xxx.xxx will still be added to our SFDB. However please note that a single SpamFilter server reporting an IP address will never casue an IP to be actually blacklisted in the SFDB. So even though you're reporting your 1st SpamFilter's IP to the SFDB, this is only a small contribution to the SFDB and is very, very unlikely that this will blacklist it, as you would really have to be spamming as to receive reports from other SpamFilter users as well.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: sirrar
Date Posted: 22 April 2009 at 7:02am
Thankyour very much for the solution. Added the 1st spamfilter ip to spamfilter.ini section
DoNotAddIPToHoneypot. And the first spamfilter is now able to deliver messages. I was beginning to be unable because the ip was blocked. see below attached log:
 
04-22-09 12:53:06:339 -- (14272) Connection from: xxx.xxx.xxx.xxx  -  Originating country : Denmark
04-22-09 12:53:06:339 -- (14272) IP is in local blacklist cache. Disconnecting: xxx.xxx.xxx.xxx
04-22-09 12:53:06:402 -- (14272) No Data Received
04-22-09 12:53:06:402 -- (14272) Disconnect
 
So again. Thankyo very much. You are always the best.


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA

Posted By: sirrar
Date Posted: 22 April 2009 at 7:08am
Here is another question.
The next problem is the SPF. I'm of course able to disable SPF for the domains. But ex. in Exchange you are able to define perimeter IP's which then should not be used to check against SPF. So exchange will not look at the first ip it receives the mail from, but the ip the perimter server received the mail from. Can spamfilter in anyway support something like this?
 
04-22-09 13:03:06:351 -- (9124) Connection from: xxx.xxx.xxx.xxx  -  Originating country : Denmark
04-22-09 13:03:06:554 -- (9124) Received MAIL FROM: < mailto:yyy@yyy.yy - yyy@yyy.yy > SIZE=2963
04-22-09 13:03:06:585 -- (9124) Received RCPT TO: mailto:xxx@xxx.xx - xxx@xxx.xx
04-22-09 13:03:06:585 -- (9124) found SPF record for shaw.ca: v=spf1 mx ip4:64.59.134.0/25 ip4:24.71.223.0/25 ip4:204.209.208.40 ip4:204.209.208.41 ~all
04-22-09 13:03:06:601 -- (9124) SPF query result: softfail
04-22-09 13:03:06:617 -- (9124) - SPF analysis for shaw.ca done: - softfail
04-22-09 13:03:06:617 -- (9124) failed SPF test (softfail) - Disconnecting xxx.xxx.xxx.xxx
04-22-09 13:03:06:632 -- (9124) xxx.xxx.xxx.xxx - Mail from:  mailto:yyy@yyy.yy - yyy@yyy.yy To:  mailto:xxx@xxx.xx - xxx@xxx.xx will be rejected
 


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA

Posted By: LogSat
Date Posted: 22 April 2009 at 3:47pm
SpamFilter is designed to be placed at your network's gateway, and requires to "see" the original IP address of the sender. This is because a large part of SpamFilter's test act upon the sender's IP, like our SFDB filter, the MAPS RBL, SPF, etc. If SpamFilter is unable to see that IP address, all of the IP-based tests will either fail to detect spam, or worse, will block legitimate emails.

If SpamFilter is unable to see the original IP address, then all IP-based tests, not just the SPF filter, should be disabled to avoid issues.

SpamFilter will not support the definition of a "perimeter" IP as in Exchange due to the following. Suppose you do have another server accepting emails before SpamFilter. If the email received and forwarded by your perimeter server is spam, and is then forwarded to SpamFilter, SpamFilter will reject it as it usually happens during the SMTP session from your server. Since SpamFilter will reject the email with an SMTP error code, your perimeter SMTP server will need to send an NDR undeliverable email back to the sender (unless your perimeter server is acting as a proxy/gateway, maintaing on open connection to the "real" sender while forwarding the email to SpamFilter...). If however your perimeter SMTP server sends an actual NDR email back out to the internet for every spam email that SpamFilter rejects, you yourself will effectively become a spammer, as you'll likely be sending huge amounts of NDR emails back to often innocent users who had their emails spoofed by spammers, or filling postmater's mailboxes with NDR notifications...

One of SpamFilter's strengths compared to most of our competitors is the very fact that no NDRs are usually ever sent from your network for spam emails, yet the senders, if they are legitimate, still do receive an NDR email as SpamFilter rejects spam during the open SMTP session, thus forcing the ***remote server*** to send an NDR email back to the sender. We are very hesitant to alter this behavior.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: sirrar
Date Posted: 23 April 2009 at 5:49am
Thankyou for yoru reply.
I have a possible bug to report.
As you know, when my first filter finds a possible spam, it tags the subject with: SPAM:_ and passes it on to spamfilter in which I have configured to look for keyword SPAM:_ so that the e-mail gets in the user quarantine. But I have just received a e-mail in my inbox (not spamfilter user quarantine) with subject: SPAM:_ (so tagged from the first filter)  I looked in the log and noticed that the e-mail was with multiple recipients. Does the keyword filter not work with multiple recipients?
I have just reproduced the "bug". Both recipients should be in the same domain (ex: mailto:ddd@xxx.xx - ddd@xxx.xx and mailto:eee@xxx.xx - eee@xxx.xx ). Then scanning for keywords doesent work.
Please write me back if you want my log. I will not post it here because I would have to replace a lot.
I would also be able to forward the mail to you...
 
BTW: Running Spamfilter v.4.1.2.808


-------------
Best regards...
Torsten Egebirk MCTIP: EA/SA - MCSE - MCSA - CCA - CCNA

Posted By: LogSat
Date Posted: 23 April 2009 at 10:30pm
sirrar,

YEs, please zip and forward us the logfile, also including the from/to addresses in the email so we may locate it in the log. IF the zip is over 5MB in size, I'll provide you a PM with the FTP login for our FTP site.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window