Membasmi spam images menggunakan FuzzyOcr.

Jika anda memakai versi Spamassassin dibawah 3.1.4, buang tanda pagar dan set nilainya ke 1.0:
focr_pre314 1.0

Set focr_base_score to 2 :
focr_base_score 2

untuk men test sample images set focr_autodisable_score ke 50:
focr_autodisable_score 50

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b# spamassassin --lint
[11615] warn: config: created user preferences file: /root/.spamassassin/user_prefs
[11615] warn: Subroutine new redefined at /etc/spamassassin/FuzzyOcr.pm line 116.
[11615] warn: Subroutine parse_config redefined at /etc/spamassassin/FuzzyOcr.pm line 126.
[11615] warn: Subroutine dummy_check redefined at /etc/spamassassin/FuzzyOcr.pm line 223.
[11615] warn: Subroutine fuzzyocr_check redefined at /etc/spamassassin/FuzzyOcr.pm line 227.
[11615] warn: Subroutine load_global_words redefined at /etc/spamassassin/FuzzyOcr.pm line 237.
[11615] warn: Subroutine load_personal_words redefined at /etc/spamassassin/FuzzyOcr.pm line 255.
[11615] warn: Subroutine parse_scansets redefined at /etc/spamassassin/FuzzyOcr.pm line 278.
[11615] warn: Subroutine max redefined at /etc/spamassassin/FuzzyOcr.pm line 285.
[11615] warn: Subroutine reorder redefined at /etc/spamassassin/FuzzyOcr.pm line 293.
[11615] warn: Subroutine pipe_io redefined at /etc/spamassassin/FuzzyOcr.pm line 298.
[11615] warn: Subroutine handle_error redefined at /etc/spamassassin/FuzzyOcr.pm line 410.
[11615] warn: Subroutine logfile redefined at /etc/spamassassin/FuzzyOcr.pm line 416.
[11615] warn: Subroutine check_image_hash_db redefined at /etc/spamassassin/FuzzyOcr.pm line 435.
[11615] warn: Subroutine add_image_hash_db redefined at /etc/spamassassin/FuzzyOcr.pm line 475.
[11615] warn: Subroutine calc_image_hash redefined at /etc/spamassassin/FuzzyOcr.pm line 497.
[11615] warn: Subroutine debuglog redefined at /etc/spamassassin/FuzzyOcr.pm line 537.
[11615] warn: Subroutine wrong_ctype redefined at /etc/spamassassin/FuzzyOcr.pm line 543.
[11615] warn: Subroutine corrupt_img redefined at /etc/spamassassin/FuzzyOcr.pm line 562.
[11615] warn: Subroutine known_img_hash redefined at /etc/spamassassin/FuzzyOcr.pm line 587.
[11615] warn: Subroutine check_fuzzy_ocr redefined at /etc/spamassassin/FuzzyOcr.pm line 602.mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b# cd samples

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b/samples# spamassassin -t < animated-gif.eml
spamassassin -t < corrupted-gif.eml
Content analysis details: (14.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 FUZZY_OCR_WRONG_CTYPE BODY: Mail contains an image with wrong
content-type set
Image has format "GIF" but content-type is
"image/jpeg"
2.5 FUZZY_OCR_CORRUPT_IMG BODY: Mail contains a corrupted image
Corrupt image: GIF-LIB error: Image is
defective, decoding aborted.
10 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 1 lines
"alert" in 1 lines
"stock" in 2 lines
"investor" in 1 lines
"company" in 1 lines
"trade" in 1 lines
"target" in 1 lines
"service" in 1 lines
"recommendation" in 1 lines
(10 word occurrences found)

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b/samples# spamassassin -t < jpeg.eml
Content analysis details: (8.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.8 SUB_HELLO Subject starts with "Hello"
2.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
0.0 HTML_MESSAGE BODY: HTML included in message
4.0 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"viagra" in 2 lines
"cialis" in 1 lines
"levitra" in 1 lines
(4 word occurrences found)

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b/samples# spamassassin -t < png.eml
Content analysis details: (35.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.8 EXTRA_MPART_TYPE Header has extraneous Content-type:...type= entry
2.0 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date
0.0 HTML_MESSAGE BODY: HTML included in message
3.0 LONGWORDS Long string of long words
3.4 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
26 FUZZY_OCR BODY: Mail contains an image with common spam text inside
Words found:
"alert" in 2 lines
"news" in 2 lines
"symbol" in 1 lines
"alert" in 2 lines
"stock" in 1 lines
"investor" in 3 lines
"company" in 2 lines
"buy" in 1 lines
"price" in 2 lines
"trade" in 2 lines
"target" in 2 lines
"service" in 2 lines
"recommendation" in 1 lines
"levitra" in 1 lines
"software" in 2 lines
(26 word occurrences found)

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b/samples# vi /etc/spamassassin/FuzzyOcr.cf
Nah kita rubah kembali nilai focr_autodisable_score 50 menjadi 3.5 dan ini harus sama dengan nilai $sa_kill_level_deflt pada file amavisd.conf anda

mail-server-bcu:/home/gtoms/FuzzyOcr-2.3b/samples# amavisd-new reload

Saat ini FuzzyOCR sudah berjalan dan kalau anda jalankan #top maka anda bisa lihat gocr muncul jika ada email berisi images dan bisa menghabiskan resources cpu kita, makanya kalau mau memakai plugin ini usahakan pada mesin dengan spesifikasi tinggi. Selesai sudah, dari pemantauan spam images langsung berkurang drastis, kadang hanya 1 spam images dalam satu hari yang lolos.

Sumber : http://www200.pair.com/mecham/spam/image_spam.html

@2006 henry@gultom.or.id

• Migrasi Mailserver
• Migrasi Radius Server
• Images Spam
• Upgrade Primary DNS Server
• Upgrade Secondary DNS Server