Re: [SA-milter] Spam evading milter

[J4K]

On 07/12/2011 10:21 AM, J4K wrote:
> On 07/11/2011 10:14 PM, Adam Katz wrote:
>> On 07/11/2011 07:39 AM, J4K wrote:
>>> How could a message that scored greater than 10 on the SA backend, be
>>> scored lower on the milter, or perhaps not even processed?
>> It's probably too large (>500kB) and was thus given a free pass.  If
>> that is the case, you can alter spamass-milter to call spamc with a
>> higher max_size argument, like:
>>
>> spamass-milter ... -- --max-size -s 1050000
>>
>> as noted on the spamass-milter and spamc man pages.  (That's in bytes,
>> fudged just above 1MB since spammers like to just barely exceed the max
>> scan size threshold.)  You should pick something that correlates to
>> however much idle time is on your spam filtering server(s), e.g. if your
>> load average is typically near zero, go nuts (3MB should do for a very
>> large max size), but if you're already around one or higher, only bump
>> it slightly.
>>
>> The default is either 500000 or 512000 bytes (the man page is ambiguous).
>>
>>
>>
>> _______________________________________________
>> Spamass-milt-list mailing list
>> address@hidden
>> https://lists.nongnu.org/mailman/listinfo/spamass-milt-list
> Hi Adam,
>
>     Thank-you. I had not seen this option because there is no such .conf
> file nor man page on Debian Squeeze.  I had suspected a size limit, but
> could not find the setting, and had not thought of passing options back
> to spamc.
>
> I added it:
>
> # /usr/sbin/spamass-milter -P /var/run/spamass/spamass.pid -f -p
> /var/spool/postfix/spamass/spamass.sock -u nobody -M -r 9 -i 127.0.0.1
> -- -s 1050000
>
> Many thanks and regards, S.
>
> _______________________________________________
> Spamass-milt-list mailing list
> address@hidden
> https://lists.nongnu.org/mailman/listinfo/spamass-milt-list
I looked at the file sizes of those that sneaked through, and saw that
these are about 2kB in size.
I don't think this is it.  Is there someone else that I could look for?

Regards, S