How do I setup Apache SpamAssassin?

[talon39]

Im not trying to do anything fancy, just setup spam assassin and understand the settings. I started by going into Cpanel and enabling spam assasin. I saw the spam box feature and think I understand what that's for. I don't want the spam sent to another account so I left it disabled.
Next I looked at the spam assassin configuration settings.
Blacklist_from- I understand this
Required_hits- Im pretty sure this means the number of identical messages received before they start getting marked as spam.
Rewrite_subject- I assume I want this set to 1, how could it stop spam set to 0?
Score- Im completely baffled by this setting
Subject_tag- I understand what this does.
Whitelist_from- I understand what this is for

To try and understand the rest, I went to the spamassassin.org website and took a look at the wikki. This left me even more confused, I was unable to find any information on the above. I have always had trouble getting useful info from Wikkis, so this is probably my own fault.
Next I checked the Cpanel documentation on this site. It failed to explain anything about the score setting.
Next I searched this forum for spam assassin score. After reading the results, I am even more confused. I still dont know how to use the feature or exactly what it does. If someone could fill in the holes in my knowledge of the basic settings, I would apreciate it.
Thanks

 

[PWSowner]

Required_hits:

SCORING OPTIONS

required_score n.nn (default: 5)
Set the score required before a mail is considered spam. n.nn can be an integer or a real number. 5.0 is the default setting, and is quite aggressive; it would be suitable for a single-user setup, but if you're an ISP installing SpamAssassin, you should probably set the default to be more conservative, like 8.0 or 10.0. It is not recommended to automatically delete or discard messages marked as spam, as your users will complain, but if you choose to do so, only delete messages with an exceptionally high score such as 15.0 or higher. This option was previously known as required_hits and that name is still accepted, but is deprecated.

Taken from:
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html

All the basics are there.

 

[talon39]

Required_hits:

SCORING OPTIONS

required_score n.nn (default: 5)
Set the score required before a mail is considered spam. n.nn can be an integer or a real number. 5.0 is the default setting, and is quite aggressive; it would be suitable for a single-user setup, but if you're an ISP installing SpamAssassin, you should probably set the default to be more conservative, like 8.0 or 10.0. It is not recommended to automatically delete or discard messages marked as spam, as your users will complain, but if you choose to do so, only delete messages with an exceptionally high score such as 15.0 or higher. This option was previously known as required_hits and that name is still accepted, but is deprecated.

Taken from:
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Conf.html

All the basics are there.

Yes I read all that on the configuration page within Cpanel. In my version the option you are referring to is called "required_hits". Unfortunately that is not the option I am referring to or having trouble understanding. The options that have me baffled are a little ways below that option(required_hits) in the version im using.
There are five fields im confused by are called "score". The explanaition for these fields is as follows:

Assign scores (the number of points for a hit) to a given test. Scores can be positive or negative real numbers or integers. "SYM-BOLIC_TEST_NAME" is the symbolic name used by SpamAssassin for that test; for example, '€™FROM_ENDS_IN_NU'S’. If only one valid score is listed, then that score is always used for a test. If four valid scores are listed, then the score that is used depends on how SpamAssassin is being used. The first score is used when both Bayes and network tests are disabled. The second score is used when Bayes is disabled, but network tests are enabled. The third score is used when Bayes is enabled and network tests are disabled. The fourth score is used when Bayes is enabled and net-work tests are enabled. Setting a rule’s score to 0 will disable that rule from running.

Im sure that explanation makes perfect sense if you already know how to use it, however it confuses the heck out of me. Could someone dumb it down for me. What would I put in these 5 fields for example and why? how would it affect the incoming email?

 

[PWSowner]

That's just for adding your own customized scoring. I don't use it.

I suggest to our clients to just leave that part the way it is unless they know what they are doing.

 

[talon39]

Thanks,
I think I have it setup correctly. I set the Required_hits score to 8.
I ran a few tests with words like viagra, but it doesn't tag them.
I looked in the file 20_drugs.cf to see what words are there.
I tried "dose" in the body and all kinds of offensive words, but it doesn't tag it as spam.
rewrite_subject is set to "1". Am I missing something? Is is spamassassin broke?

 

[ccccanada]

You are misunderstanding something thats why you are confused about the score.

Required_hits- Im pretty sure this means the number of identical messages received before they start getting marked as spam.

That is wrong.

Required hits are made up of hundreds of different tests.
Every time the incoming email fails one of those tests a Score is assigned to the email.

Each one of these Scores could be anywhere from 0.1 to 10.0 and the combined total of all these scores will give a combined Number. What the required hits does is set the number above which the email gets marked as spam.

Here is a link to the tests that are performed and the default scores each of these tests have.
http://spamassassin.apache.org/tests_3_0_x.html

The score boxes in spam assassin config are there so you can change the default scoring that spam assassin does.

So for instance the default score for the test named "MORTGAGE_RATES" is 0.689 but you are annoyed at any emails trying to give you motage rates you can change this score by entering the following into one of the score boxes. "MORTGAGE_RATES 4" now it will assign a score of 4.0 or whatever number you have used.

Hope this helps.

 

[talon39]

Thank You ccccanada that was Immensely helpful!

 

[talon39]

Still cant get it to tag any spam.

I added DRUG_ED_ONLINE 8.0 to the first score field. I left the rest of the score fields blank. If I understand what I am reading, adding DRUG_ED_ONLINE 8.0 to the score field while my Required_hits is also set to 8.0 will cause the words "Fast Viagra Delivery" to flag the message as spam every time.
It doesn't work.
Am I doing it wrong. How can I test this to see if it's working?

Current settings are exactly as follows:
Spam Assassin: Enabled
Spam Box: Disabled
required_hits: 8.0
rewrite_subject: 1
score: DRUG_ED_ONLINE 8.0
score:
score:
score:
score:
subject_tag:*****SPAM*****
blacklist_from: (are all blank)
whitelist_from: (are all blank)

With this setup I expected the phrase "Fast Viagra Delivery" would get tagged as spam every time. It doesn't.

This is from the message header of a message with "Fast Viagra Delivery" in both the subject and body. The message was not tagged as spam.

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
web.estellarhosting.com
X-Spam-Level: ***
X-Spam-Status: No, hits=4.0 required=8.0 tests=FROM_ENDS_IN_NUMS,NO_REAL_NAME,
SUBJ_VIAGRA autolearn=no version=2.63

 

[ccccanada]

you should have the score for the test SUBJ_VIAGRA set to 8 to delete this message.

Always look at the following section in a header and it will tell you the test this email failed.

X-Spam-Status: No, hits=4.0 required=8.0 tests=FROM_ENDS_IN_NUMS,NO_REAL_NAME,SUBJ_VIAGRA autolearn=no version=2.63

In this case the email failed the tests "FROM_ENDS_IN_NUMS,NO_REAL_NAME,SUBJ_VIAGRA"

If you would set the test score for SUBJ_VIAGRA to 8 this email would have been deleted.