Spam Assassin removed???? (Resolved)

[zanass]

Why was spam assassin removed in Cpanel? on atleast node 81, 87. and thanks for letting us know.

Greg V

[zanass]

This issue has been resolved...

On some/all softlayer servers Spam Assassin what causing alot of issues so H9 has begun using ASSP spam program. I also asked if ASSP was temporary he replied with:

"Hi,

ASSP is here to stay. It blocks 99.9% of spam and uses way less CPU then spamd.

Just to give you an idea:

Messages Processed | 30527 | 416797
Messages Passed | 1557 | 18449
Messages Rejected | 28970 | 398348

Daily | Overall

On that node (81) there has been 416k emails and 18k of them were deemed good.

No false positives.


Regards,
Ben Gabler
Operations Manager"

Thanks
Greg V

Sorry for the lack of announcement on ASSP. I was actually testing it some VPS's and came up with a really good configuration for our servers and was going to announce it once it was on ALL nodes.

But yes, it does use way less CPU and has much better results. It's not that spamassassin was causing issues but it wasn't blocking enough spam AND it doesn't scan outgoing email.

That' right, ASSP scans outgoing email. Say goodbye to blacklisting issues once and for all!

If you want to modify what ASSP does for your domain(s) simply login to cPanel and click the ASSP icon under the Mail area.

[zanass]

Originally Posted by H9Ben

If you want to modify what ASSP does for your domain(s) simply login to cPanel and click the ASSP icon under the Mail area.

But it looks like the default config is working great. Yippi no more blacklisting.

Greg V

[Gman]

Ben,

When do you think it will be rolled out to the other servers?

Thanks so much...

[zanass]

Hello Ben, is there any way for you to set up something in the H9 "Knowledge base" for ASSP?

Thanks
Greg V

[Gene]

Originally Posted by H9Ben

... That' right, ASSP scans outgoing email. Say goodbye to blacklisting issues once and for all! ......

Ironically shortly after ASSP was put on node58 it was blacklisted.

Here is part of what CBL reported:

ATTENTION: At the time of detection, this IP was infected with, or NATting for a computer infected with a high volume spam sending trojan - it is participating or facilitating a botnet sending spam or spreading virus/spam trojans.

ATTENTION: If you simply repeatedly remove this IP address from the CBL without correcting the problem, the CBL WILL eventually stop letting you delist it and you will have to contact us directly.

This detection is of the DarkMailer/YellSOFT DirectMailer Trojan.
------------------------------------------------------------

Note: ticket was opened and H9 still working on it.

Hi,

That was actually before assp was installed. Node58 has had blacklisting issues but we're migrating it out to Softlayer as we speak.

Will be completed tomorrow and no more issues

[idwebca]

Originally Posted by H9Ben

Hi,

That was actually before assp was installed. Node58 has had blacklisting issues but we're migrating it out to Softlayer as we speak.

Will be completed tomorrow and no more issues

Ben,
Where I can go check to see if my client nodes are blacklisted or not?

[zanass]

Originally Posted by idwebca

Ben,
Where I can go check to see if my client nodes are blacklisted or not?

I use this ---> Email Blacklist Check - See if your server is blacklisted

Just enter the ip address/s of your node.

Greg V