Re: Cyrus - Rspamd - Sieve

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 

It’s not necessary to run this directly after users move.

I’ve also got a comment on github for a useful script which could work or could be changed to use only a copy without run directly.

 

 

I use SpamAssassin with this script:

#!/bin/bash
 
/usr/local/bin/inotifywait -e create -qm --format %w\ %f /var/spool/imap/user/*/{Not-,}Spam /var/spool/imap/user/*/Spam1{0,5} | while read DIR FILE; do
 if [ ${DIR: -9} = 'Not-Spam/' ]
    then OP=ham
    else OP=spam
 fi
 spamc -L $OP < $DIR$FILE
 stdbuf -o0 echo `date` Learn as $OP $DIR$FILE >> /var/log/sa-learn.log
done

Any time a user moves an email to to Spam folder, it is learnt as spam, and anytime a message is explicitly moved to the Not-Spam folder, the message is learnt as ham.I see now in the logs, that the files cyrus.index.NEW and cyrus.cache.NEW are also learnt as spam.

 

 

Also I understand it when all users actions will be used for trainings which can damage our ratings.
So when this could be done over sieve it would be user specific and we could like on dovecot say for this users we trust can be used for training.

 

We use rspamd as milter on a container, so we need to put first detected mails which are moved for training into specific folders so we can run after time a training of these mails.

Best Regards

Von: Ian Batten via Info <info@xxxxxxxxxxxxxxxxxx>
Antworten an: Info <info@xxxxxxxxxxxxxxxxxx>
Datum: Montag, 1. Februar 2021 um 10:49
An: Info <info@xxxxxxxxxxxxxxxxxx>
Betreff: Re: Cyrus - Rspamd - Sieve

 

Is it worth doing at all?

 

I run rspamd outside Cyrus: it’s a Postfix milter, Cyrus gets an lmtp feed but has no interaction with rspamd.

 

Periodically I have trawled my user’s spam folders and “learned” from them, but it seems to make very little difference to spam performance.  

 

This is a very small site, and I am extremely aggressively enforcing correct behaviour at the SMTP level, but rspamd seems to do a very good job just in its default state without asking users to classify.

 

I’m also nervous about using the user’s spam folders because those are often the result of client-side Bayesian filtering, which is somewhat error-prone, so the chances of ham (or at least bacn) ending up in there is non-zero.  Users are also very bad at classifying spam so using their main inbox as a source of ham is unwise.

 

Rspamd is _very_ good, and increasingly I just leave it to do its thing.  With rspamd and clamav’s phishing patterns I doubt I see a piece of phishing email getting through to me more than once a month, and my users report similarly.  I have a lot of bacn which is correctly marks as spam-ish, and I similarly see very little outright spam.

 

Before wading in an doing a complex learn/mode thing, just run rspamd unsupervised for a month and see how it does on its own.  I think you’ll be very pleased.

 

ian

 

On 01/02/2021, 09:35, "Vladislav Kurz" <vladislav.kurz@xxxxxxxxxxx> wrote:

 

Hello,

 

Is it necessary to run the spam learning immediately after the user moves the

mail to spam/ham folder?

 

Isn't it enough to find new files in those folders, once (or a few times) a day

and run sa-learn directly on them?

 

--

Best regards

Vladislav Kurz

 

Dne neděle 31. ledna 2021 20:35:58 CET, David Faller napsal(a):

Thanks for your answer,

The Handling which you mean I undeestand.

Is there no easier way like to send a copy of moved Mail to a specific

Mailbox like spam@xxxxxxxxxx?

Also for cyrus Notifikation Events there are no templates for orientation

where to Start.

So at this point I can't collect needed Information like

to create a shell script.

For a notification event we would also need the response from it and would

need time to test and collect Informations

Cyrus sieve does baldly not support events like on movement to copy.

 

We Don't use special hashed spool, we leaved it by default under

var/lib/spool/cyrus/././

Also no special character are used, only we use

"/" aß separator instead a dot in our imap configuration.

You said we need to determinate the file  to feed for sa-learn, better would

be to store These message files to.2 seperated folders  or a seperated imap

Mailbox for learning.

So I think in Future there are also no other Plans for cyrus which could

bring up this easier?

I would like to try my luck with event notifications

 

Over the Event notification we would get the file Name and path as response

which we can use in a Script for a copy and handling Script?

A Sample would be really helpful to work with it you know?

 

 

 

 

 

 

> Am 31.01.2021 um 14:26 schrieb Luca Olivetti <luca@xxxxxxxxx>:

>

> El 31/1/21 a les 14:18, Luca Olivetti ha escrit:

>

>

>>>   "oldMailboxID":

>>>   "imap://john@xxxxxxxxxxx@imap.example.org/INBOX;UIDVALIDITY=142468368

>>>   2",

>> This is the source folder, if it is (e.g.) INBOX.spam, map the uri to the

>> file (combining it with the "uidset" field, which can be a list, so

>> you'll have to iterate over all messages) and pass it to "sa_learn

>> --ham" (since the user is moving  it out of the spam folder).

> Note that the file depends on your setup (where the spool is, hashed imap

> spool or not, etc.).

>

> In my case, the file would be /mnt/lun_correo/spool/j/john/uid.

>

> Other gotchas is the encoding of special chars in mailbox names, etc., I

> just copied code from imapurl.c.

>

> Bye

> --

> Luca Olivetti

> Wetron Automation Technology http://www.wetron.es/

> Tel. +34 93 5883004 (Ext.3010)  Fax +34 93 5883007

 

------------------------------------------

Cyrus: Info

Permalink:

adbdc01 Delivery options:

 

 

 

 

 

------------------------------------------

Cyrus: Info

 

[Index of Archives]     [Cyrus SASL]     [Squirrel Mail]     [Asterisk PBX]     [Video For Linux]     [Photo]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux