[no subject]

[Gavin McDonald]

Hello to all users, contributors and Committers!

The Travel Assistance Committee (TAC) are pleased to announce that
travel assistance applications for Community over Code EU 2024 are now
open!

We will be supporting Community over Code EU, Bratislava, Slovakia,
June 3th - 5th, 2024.

TAC exists to help those that would like to attend Community over Code
events, but are unable to do so for financial reasons. For more info
on this years applications and qualifying criteria, please visit the
TAC website at < https://tac.apache.org/ >. Applications are already
open on https://tac-apply.apache.org/, so don't delay!

The Apache Travel Assistance Committee will only be accepting
applications from those people that are able to attend the full event.

Important: Applications close on Friday, March 1st, 2024.

Applicants have until the the closing date above to submit their
applications (which should contain as much supporting material as
required to efficiently and accurately process their request), this
will enable TAC to announce successful applications shortly
afterwards.

As usual, TAC expects to deal with a range of applications from a
diverse range of backgrounds; therefore, we encourage (as always)
anyone thinking about sending in an application to do so ASAP.

For those that will need a Visa to enter the Country - we advise you apply
now so that you have enough time in case of interview delays. So do not
wait until you know if you have been accepted or not.

We look forward to greeting many of you in Bratislava, Slovakia in June,
2024!

Kind Regards,

Gavin

(On behalf of the Travel Assistance Committee)

[no subject]

[Pedro David Marco]

 Good question...  probably an interesting new feature for SA: dividing and 
deal with attached emails (and nested emails that look like a chat) in a one by 
one basis...
Pete.
   >On Tuesday, April 26, 2022, 02:36:25 PM GMT+2, Matus UHLAR - fantomas 
 wrote:  
 >Hello,

>is it possible to match message headers in rfc822 atttachments?

>from what I know, "header" rules only apply to mail headers and mimeheader 
>only apply to mime headers.

>body and rawbody afaik only search in bodies of messages or included messages.

>I have asked some time ago but no success:

>https://marc.info/?l=spamassassin-users&m=132282473328809&w=2

>is this possible now or do we need out-of SA solution for this?

>-- 
>Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
>Warning: I wish NOT to receive e-mail advertising to this address.
>Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
>Fighting for peace is like fucking for virginity...


  

[no subject]

[Matus UHLAR - fantomas]

Hello,

is it possible to match message headers in rfc822 atttachments?

from what I know, "header" rules only apply to mail headers and mimeheader 
only apply to mime headers.


body and rawbody afaik only search in bodies of messages or included 
messages.


I have asked some time ago but no success:

https://marc.info/?l=spamassassin-users&m=132282473328809&w=2

is this possible now or do we need out-of SA solution for this?

--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fighting for peace is like fucking for virginity...

[no subject]

[Marc Roos]

 

How can I mark emails as being spam originating from an ip range owned 
by xserver.ua?



% Abuse contact for '176.103.48.0 - 176.103.63.255' is 
'ab...@xserver.ua'

inetnum:176.103.48.0 - 176.103.63.255
netname:XServer-IP-Network-6
country:UA
org:ORG-IV2-RIPE
admin-c:IV25-RIPE
tech-c: IV25-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: MNT-IV25
mnt-routes: MNT-IV25
mnt-routes: ITL-MNT
mnt-domains:MNT-IV25
created:2011-12-09T13:10:04Z
last-modified:  2017-05-24T13:24:15Z
source: RIPE # Filtered
sponsoring-org: ORG-ML410-RIPE

organisation:   ORG-IV2-RIPE
org-name:   PE Ivanov Vitaliy Sergeevich
org-type:   OTHER
address:42-A Tobolskaya street, office 230, Kharkov, Ukraine
phone:  +380 57 728 12 67
abuse-c:AR19840-RIPE
mnt-ref:MNT-IV25
mnt-by: MNT-IV25
created:2009-06-16T15:24:59Z
last-modified:  2017-05-12T08:36:23Z
source: RIPE # Filtered

person: Ivanov Vitaliy
address:42-A Tobolskaya street, office 230, Kharkov, Ukraine
phone:  +380 57 728 12 67
nic-hdl:IV25-RIPE
mnt-by: MNT-IV25
created:2009-06-16T15:19:31Z
last-modified:  2017-05-12T08:37:26Z
source: RIPE # Filtered

% Information related to '176.103.48.0/20AS48031'

route:  176.103.48.0/20
descr:  XSERVER
origin: AS48031
mnt-by: MNT-IV25
created:2012-03-02T11:27:45Z
last-modified:  2012-03-02T11:27:45Z
source: RIPE

[no subject]

[RW]

test

[no subject]

[Kacper Guzik]

Hello, when I'm using postsrsd with spamassassin SPF checks all e-mail have
SPF_FAIL=0.001

I'm trying with use_newest_received_spf_header 1 but this same issue

spamassassin have problem with reconize SPF for mail's with SRS headers

Jan 10 09:15:24 mail3 amavis[5068]: (05068-01-3) SA dbg: spf: checking
EnvelopeFrom (helo=X XXX, ip=XXX,
envfrom=srs0=pqle=ef=networkmasters.pl=piotr.rosciszew...@mail3.pl)

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 30.08.2014 um 00:35 schrieb Karsten Bräckelmann:
> On Fri, 2014-08-29 at 12:02 +0200, Reindl Harald wrote:
>> Am 29.08.2014 um 04:03 schrieb Karsten Bräckelmann:
> 
>>> Now, moving forward: I've had a look at the message diffs. Quite
>>> interesting, and I honestly want to figure out what's happening.
>>
>> it looks really like spamass-milter is responsible
>>
>> in the second version below it whines it can't extract
>> the score to decide if it's above reject and so it
>> really looks like the milter heavily relies on headers
> 
> Yay for case in-sensitive parsing...
> 
>> found that out much later last night by plaing with headers in general
>>
>> spamass-milter[14891]: Could not extract score from > Tag-Level=5.0, Block-Level=10>
>>
>> add_header all Status _YESNO_, score=_SCORE_, tag-level=_REQD_, 
>> block-level=10
>> add_header all Status _YESNO_, Score=_SCORE_, Tag-Level=_REQD_, 
>> Block-Level=10
> 
> If you use the SA default Status header, or at least the prefix
> containing score and required, is header rewriting retained by the
> milter without the Flag header?
> 
>   add_header all Status "_YESNO_, score=_SCORE_ required=_REQD_ ..."

yes, that's what i tried to express

"score=" instead of "Score=" is liked by the milter
well, no big deal, i would have preferred it "score" or "Yes/No" also starzing 
lowercase :-)

> Given that log line, a likely explanation simply is that the milter
> needs to determine the spam status, to decide which SA generated headers
> to apply to the message. Your choice of custom Status header is not what
> the milter expects, and thus needs to resort to the simple Flag header.
> 
> (Note the comma after yes/no, but no comma between score and required.)

it's really only s versus S in score, tried it out before my post

>>> First of all, minus all those different datetime strings, IDs and
>>> ordering, the real differences are
>>>
>>>   -Subject: [SPAM] Test^M
>>>   -X-Spam-Flag: Yes^M
>>>
>>>   +Subject: Test^M
>>>
>>> So it appears that only the sample with add_header spam Flag has the
>>> Subject re-written.
>>
>> correct
>>
>>> However, there's something else going on. When re-writing the Subject
>>> header, SA adds an X-Spam-Prev-Subject header with the original. Which
>>> is clearly missing.
>>
>> the version is killed in smtp_header_checks which is also
>> the reason that i started to play around with headers
>>
>> nobody but me has a reason to know exact versions of running software
> 
> Previous-Subject, not Version.

i saw that somewhere in the debug options and wondered too

but i referred to the SA version header because doc says you
can't remove it and so i explained why it's not there

> I mentioned this specifically, because the absence of the Previous
> Subject header with Subject rewrite clearly shows, SA generated headers
> are not unconditionally added to the message, but single headers are
> cherry picked.
> 
> IOW, header rewriting does work without the Flag header. It is the glue
> that decides whether to inherit the rewritten header, and outright
> ignores the Previous Subject header.

yep - as said: the intention of my post to that topic was only
to make public how i fixed it before someone in the future
wastes his time with outdated google hits mentioning no
longer existing options which are not the reason in that
case

well, now i know that the milter relies on SA generated headers
which was totally unexpected and i work with a lot of server
software for many years - give me my daily WTF :-)

>>> Thus, something else has a severe impact on which headers are added or
>>> modified. In *both* cases, there is at least one SA generated header
>>> missing and/or SA modified header not preserved



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Fri, 2014-08-29 at 12:02 +0200, Reindl Harald wrote:
> Am 29.08.2014 um 04:03 schrieb Karsten Bräckelmann:

> > Now, moving forward: I've had a look at the message diffs. Quite
> > interesting, and I honestly want to figure out what's happening.
> 
> it looks really like spamass-milter is responsible
> 
> in the second version below it whines it can't extract
> the score to decide if it's above reject and so it
> really looks like the milter heavily relies on headers

Yay for case in-sensitive parsing...

> found that out much later last night by plaing with headers in general
> 
> spamass-milter[14891]: Could not extract score from  Tag-Level=5.0, Block-Level=10>
> 
> add_header all Status _YESNO_, score=_SCORE_, tag-level=_REQD_, block-level=10
> add_header all Status _YESNO_, Score=_SCORE_, Tag-Level=_REQD_, Block-Level=10

If you use the SA default Status header, or at least the prefix
containing score and required, is header rewriting retained by the
milter without the Flag header?

  add_header all Status "_YESNO_, score=_SCORE_ required=_REQD_ ..."

Given that log line, a likely explanation simply is that the milter
needs to determine the spam status, to decide which SA generated headers
to apply to the message. Your choice of custom Status header is not what
the milter expects, and thus needs to resort to the simple Flag header.

(Note the comma after yes/no, but no comma between score and required.)


> > First of all, minus all those different datetime strings, IDs and
> > ordering, the real differences are
> > 
> >   -Subject: [SPAM] Test^M
> >   -X-Spam-Flag: Yes^M
> > 
> >   +Subject: Test^M
> > 
> > So it appears that only the sample with add_header spam Flag has the
> > Subject re-written.
> 
> correct
> 
> > However, there's something else going on. When re-writing the Subject
> > header, SA adds an X-Spam-Prev-Subject header with the original. Which
> > is clearly missing.
> 
> the version is killed in smtp_header_checks which is also
> the reason that i started to play around with headers
> 
> nobody but me has a reason to know exact versions of running software

Previous-Subject, not Version.

I mentioned this specifically, because the absence of the Previous
Subject header with Subject rewrite clearly shows, SA generated headers
are not unconditionally added to the message, but single headers are
cherry picked.

IOW, header rewriting does work without the Flag header. It is the glue
that decides whether to inherit the rewritten header, and outright
ignores the Previous Subject header.


> > Thus, something else has a severe impact on which headers are added or
> > modified. In *both* cases, there is at least one SA generated header
> > missing and/or SA modified header not preserved.

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 29.08.2014 um 04:26 schrieb Karsten Bräckelmann:
> On Fri, 2014-08-29 at 02:15 +0200, Reindl Harald wrote:
>> look at the attached zp-archive [...]
> 
> Since I already had a closer look at the contents including your local
> cf, and I am here to offer help and didn't mean no harm, some comments
> regarding the SA config.

thanks

>> # resolves a bug with milter always triggering a wrong informational header
>> score UNPARSEABLE_RELAY 0
> 
> See the RH bug you filed and its upstream report. Do you still need
> that? This would be the first instance of continued triggering of that
> test I ever encountered.

well, since there was no software update in the
meantime i fear yes, however it don't harm

>> # disable most builtin DNSBL/DNSWL to not collide with webinterface settings
>> score __RCVD_IN_SORBS 0
>> score __RCVD_IN_ZEN 0
>> score __RCVD_IN_DNSWL 0
> 
> Rules starting with double-underline are non-scoring sub-rules.
> Assigning a zero score doesn't disable them like it does with regular
> rules. In the case of RBL sub-rules like the above, it does not prevent
> DNS queries. It is better to
> 
>   meta __FOO 0
> 
> overwrite the sub-rule, rather than set a score that doesn't exist.

thanks for the information, i will change that

i verfified that it does *really* skip all of them because as
i had only all sub-rules listed it still fired the request

>> # unconditional sender whitelists
>> whitelist_from *@apache.org
>> whitelist_from *@bipa.co.at
>> whitelist_from *@centos.org
>> whitelist_from *@dovecot.org
>   [...]

uhm i am not terrible happy to not have stripped
that block from the config :-(

> Unconditional whitelisting generally is a bad idea and might 
> appear in forged addresses.

i know - i would love the same logic for senders as for MORE_SPAM_TO
and ALL_SPAM_TO to and at the end even combine it From/To

for mailing-lists you need a big hammer to be present if URIs are
blacklisted or in case of security discussions refer to exploits
which is not possible on the device i am about to replace which
leads anytime something is on the zero-hour-intent-list appears
in a message to override whitelists - like the name of the SA
config file if some client wraps it in link headers

something like that would be me final goal

"from s...@a.tld to s...@b.tld -100"
"from @a.tld to s...@b.tld -20"
"from @a.tld to s...@b.tld -2"

which would give a way to implement dropdowns in the admin backend for
different trust levels without need to know the underlying scores which
could be adjusted transparent since it may make sense to do so in the
context of tag-score/block-score

in general after going online and analyze things my intention will be
"no whitelists at all active" but only after some time where i can make
sure from logs there are no false positives which are more bad than
slipped spam but have known working options if needed

> If possible, it is strongly suggested to use whitelist_from_auth, or at
> least whitelist_from_rcvd (which requires *_networks be set correctly)

oh - fine, that pretty easy, the config is generated from
a webUI based script - the networks are correct now, that
was only a temporary thing in the other thread to study
behavior with hand-written craft before write backends
and find out that i can't implement it later as expected

"whitelist_from_rcvd" i already had in mind, but since
only my personal domain is live i rely at forging by
myself for testing things out



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 29.08.2014 um 04:03 schrieb Karsten Bräckelmann:
> On Fri, 2014-08-29 at 02:15 +0200, Reindl Harald wrote:
>> look at the attached zp-archive and both messages
>> produced with the same content before you pretend
>> others lying damned - to make it easier i even
>> added a config-diff
> 
> But no message diff. ;)
> 
>> and now what?
>>
>> maybe you should accept that even new users are
>> no idiots and know what they are talking about
> 
> Please accept my apologies. It appears something else is going on here,
> and you in fact did not lie.

accepted

> I'd like to add, though, that I do *not* assume new users to be idiots.
> Plus, I generally spend quite some time on helping others fixing their
> problems, including new users, as you certainly have noticed.

that's why i was really angry because from the other guy which told me
multiple times that i should go to the sa-milter list and refered
to 8 years old howtos which are wrong and outdated i had expetced
that, not from you which was the first constructive

my only intention to reply again to that thread was "hey, i found
it by myself and if someone else has the same problem now he finds
a soultion froma recent year"

> Now, moving forward: I've had a look at the message diffs. Quite
> interesting, and I honestly want to figure out what's happening.

it looks really like spamass-milter is responsible

in the second version below it whines it can't extract
the score to decide if it's above reject and so it
really looks like the milter heavily relies on headers

found that out much later last night by plaing with headers in general

spamass-milter[14891]: Could not extract score from 

add_header all Status _YESNO_, score=_SCORE_, tag-level=_REQD_, block-level=10
add_header all Status _YESNO_, Score=_SCORE_, Tag-Level=_REQD_, Block-Level=10

> First of all, minus all those different datetime strings, IDs and
> ordering, the real differences are
> 
>   -Subject: [SPAM] Test^M
>   -X-Spam-Flag: Yes^M
> 
>   +Subject: Test^M
> 
> So it appears that only the sample with add_header spam Flag has the
> Subject re-written.

correct

> However, there's something else going on. When re-writing the Subject
> header, SA adds an X-Spam-Prev-Subject header with the original. Which
> is clearly missing.

the version is killed in smtp_header_checks which is also
the reason that i started to play around with headers

nobody but me has a reason to know exact versions of running software

> Thus, something else has a severe impact on which headers are added or
> modified. In *both* cases, there is at least one SA generated header
> missing and/or SA modified header not preserved.

/^X-Spam-Checker-Version/  IGNORE

> Definitely involved: Postfix, spamass-milter, SA. And probably some
> other tool rewriting the message / reflowing headers, as per some
> previous posts (and the X-Spam-Report header majorly inconvenienced by
> re-flowing headers).

the re-flowing is pretty sure DBMail or more like the gmime library used
for split and reconstruct messages in their mime parts to store them
seperated and de-duplicated in the database - that's valid and per RFC
OK but not nice to read :-)

> Regarding SA and the features in question: There is no different
> behavior between calling the plain spamassassin script and using
> spamc/d. There is absolutely nothing in SA itself that could explain the
> discrepancy in Subject rewriting, nor the missing X-Spam-Prev-Subject
> header.

as said: pretty sure the milter, but i am happy that it
works now

> My best bet would be on the SA invoking glue, not accepting or
> overwriting headers as received by SA. Which tool that actually is, I
> don't know. But I'd be interested to hear about it, if you find out. 
> 
> (The additional empty line between message headers and body in the case
> without X-Spam-Flag header most likely is just copy-n-paste body. Or
> possibly another artifact of some tool munging messages.)



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Fri, 2014-08-29 at 02:15 +0200, Reindl Harald wrote:
> look at the attached zp-archive [...]

Since I already had a closer look at the contents including your local
cf, and I am here to offer help and didn't mean no harm, some comments
regarding the SA config.


> # resolves a bug with milter always triggering a wrong informational header
> score UNPARSEABLE_RELAY 0

See the RH bug you filed and its upstream report. Do you still need
that? This would be the first instance of continued triggering of that
test I ever encountered.


> # disable most builtin DNSBL/DNSWL to not collide with webinterface settings
> score __RCVD_IN_SORBS 0
> score __RCVD_IN_ZEN 0
> score __RCVD_IN_DNSWL 0

Rules starting with double-underline are non-scoring sub-rules.
Assigning a zero score doesn't disable them like it does with regular
rules. In the case of RBL sub-rules like the above, it does not prevent
DNS queries. It is better to

  meta __FOO 0

overwrite the sub-rule, rather than set a score that doesn't exist.


> # unconditional sender whitelists
> whitelist_from *@apache.org
> whitelist_from *@bipa.co.at
> whitelist_from *@centos.org
> whitelist_from *@dovecot.org
  [...]

Unconditional whitelisting generally is a bad idea and might appear in
forged addresses.

If possible, it is strongly suggested to use whitelist_from_auth, or at
least whitelist_from_rcvd (which requires *_networks be set correctly).


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Fri, 2014-08-29 at 02:15 +0200, Reindl Harald wrote:
> look at the attached zp-archive and both messages
> produced with the same content before you pretend
> others lying damned - to make it easier i even
> added a config-diff

But no message diff. ;)

> and now what?
> 
> maybe you should accept that even new users are
> no idiots and know what they are talking about

Please accept my apologies. It appears something else is going on here,
and you in fact did not lie.

I'd like to add, though, that I do *not* assume new users to be idiots.
Plus, I generally spend quite some time on helping others fixing their
problems, including new users, as you certainly have noticed.


Now, moving forward: I've had a look at the message diffs. Quite
interesting, and I honestly want to figure out what's happening.

First of all, minus all those different datetime strings, IDs and
ordering, the real differences are

  -Subject: [SPAM] Test^M
  -X-Spam-Flag: Yes^M

  +Subject: Test^M

So it appears that only the sample with add_header spam Flag has the
Subject re-written.

However, there's something else going on. When re-writing the Subject
header, SA adds an X-Spam-Prev-Subject header with the original. Which
is clearly missing.

Thus, something else has a severe impact on which headers are added or
modified. In *both* cases, there is at least one SA generated header
missing and/or SA modified header not preserved.

Definitely involved: Postfix, spamass-milter, SA. And probably some
other tool rewriting the message / reflowing headers, as per some
previous posts (and the X-Spam-Report header majorly inconvenienced by
re-flowing headers).

Regarding SA and the features in question: There is no different
behavior between calling the plain spamassassin script and using
spamc/d. There is absolutely nothing in SA itself that could explain the
discrepancy in Subject rewriting, nor the missing X-Spam-Prev-Subject
header.

My best bet would be on the SA invoking glue, not accepting or
overwriting headers as received by SA. Which tool that actually is, I
don't know. But I'd be interested to hear about it, if you find out.


(The additional empty line between message headers and body in the case
without X-Spam-Flag header most likely is just copy-n-paste body. Or
possibly another artifact of some tool munging messages.)


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[David B Funk]

On Fri, 29 Aug 2014, Reindl Harald wrote:



Am 25.08.2014 um 11:37 schrieb Reindl Harald:

header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
but the subject does not get [SPAM] tagging with the config
below - not sure what i am missing

spamassassin-3.4.0-7.fc20.x86_64
spamass-milter-0.3.2-11.fc20.x86_64

spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- -s 
1048576
perl -T -w /usr/bin/spamd -c -H --max-children=25 --min-children=10 
--min-spare=5 --max-spare=15
__

"/var/lib/spamass-milter/spamassassin/user_prefs" is empty
"/etc/mail/spamassassin/local.cf" is configured below


[snip..]

report_safe 0
skip_rbl_checks 1

clear_headers
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_
rewrite_header Subject [SPAM]


besides the permissions problem after the nightly "sa-update" the reason
was simply "clear_headers" without "add_header spam Flag _YESNO" which
is entirely unexpected behavior

why does the software changing the subject based on a decision made
by itself need a header written by itself as base for the next decision
to change the subject?


One thing to keep in mind here, you're using a milter and it does things 
differently than when spamassassin is used as a filter.


With a milter it gets a copy of the incoming message, passes it on to SA,
it gets the results back from SA and then it makes decisions about how to
change the original message which is still in your MTA. So the milter makes
explicit calls into the MTA saying 'add this header' or 'replace  that header
with this other data'. So it's up to your milter to decide what changes it
makes to the resultant message, it could -totally- ignore what SA has done
and produce its own outout.

Bottom line, you need to look at the code of the milter to see what headers
get added/changed in the resulting message output, the SA configs don't have
complete control.

--
Dave Funk  University of Iowa
College of Engineering
319/335-5751   FAX: 319/384-0549   1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include 
Better is not better, 'standard' is better. B{

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 29.08.2014 um 02:15 schrieb Reindl Harald:
> Am 29.08.2014 um 02:01 schrieb Karsten Bräckelmann:
>> On Fri, 2014-08-29 at 01:23 +0200, Reindl Harald wrote:
 Besides, your own reply to my first post to this thread on Mon also
 shows this claim to be false. The output of the command I asked you to
 run clearly shows clear_headers in your config being in effect and a
 rewritten Subject
>>>
>>> i verfied that 20 times in my environment
>>>
>>> removing the line "add_header spam Flag _YESNO_" and no tagging
>>> maybe the combination of spamass-milter and SA but it's fact
>>
>> So far I attributed most of your arguing to being stubborn and
>> opinionated. Not any longer.
>>
>> Now you're outright lying
> 
> look at the attached zp-archive and both messages
> produced with the same content before you pretend
> others lying damned - to make it easier i even
> added a config-diff
> 
> * current config with the header
> * frommailer with the SA machine as destination
> * spam content
> * click send
> * fine [SPAM] in the subject
> * remove "add_header spam Flag _YESNO_" from the config
> * reload SA
> * press send again in the webform
> * no [SPAM] in the subject
> 
> and now what?
> 
> maybe you should accept that even new users are
> no idiots and know what they are talking about

and here you have the damend logs even containing the original subject
of postfix's header_checks - so don't call others names before you
have a matching test setup and can *prove* what you claim

Aug 29 02:08:24 mail-gw postfix/smtpd[23354]: connect from 
testserver.rhsoft.net[84.113.92.77]
Aug 29 02:08:24 mail-gw postfix/smtpd[23354]: 3hkh3X2YJNz1w: 
client=testserver.rhsoft.net[84.113.92.77]
Aug 29 02:08:24 mail-gw postfix/cleanup[24041]: 3hkh3X2YJNz1w: info: header 
Subject: Test from
testserver.rhsoft.net[84.113.92.77]; from= 
to= proto=ESMTP
helo=
Aug 29 02:08:24 mail-gw postfix/cleanup[24041]: 3hkh3X2YJNz1w:
message-id=<5d0902b99004e92eccfc834833cfbdf9a2e51f251409270...@testserver.rhsoft.net>
Aug 29 02:08:24 mail-gw spamd[21151]: spamd: processing message
<5d0902b99004e92eccfc834833cfbdf9a2e51f251409270...@testserver.rhsoft.net> for 
sa-milt:189
Aug 29 02:08:25 mail-gw spamd[21151]: spamd: identified spam (5.1/5.0) for 
sa-milt:189 in 1.0 seconds, 4784 bytes.
Aug 29 02:08:25 mail-gw spamd[21151]: spamd: result: Y 5 -
ADVANCE_FEE_4_NEW,ADVANCE_FEE_4_NEW_MONEY,ADVANCE_FEE_5_NEW,ADVANCE_FEE_5_NEW_MONEY,BAYES_99,BAYES_999,CUST_DNSBL_2,CUST_DNSBL_5,CUST_DNSWL_7,DEAR_SOMETHING,LOTS_OF_MONEY,RP_MATCHES_RCVD,T_MONEY_PERCENT,URG_BIZ
scantime=1.0,size=4784,user=sa-milt,uid=189,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=32286,mid=<5d0902b99004e92eccfc834833cfbdf9a2e51f251409270...@testserver.rhsoft.net>,bayes=1.00,autolearn=disabled
Aug 29 02:08:25 mail-gw postfix/qmgr[22472]: 3hkh3X2YJNz1w: 
from=, size=4597,
nrcpt=1 (queue active)
Aug 29 02:08:25 mail-gw postfix/smtpd[23354]: disconnect from 
testserver.rhsoft.net[84.113.92.77]
Aug 29 02:08:25 mail-gw postfix/smtp[23363]: 3hkh3X2YJNz1w: 
to=,
relay=mail.thelounge.net[10.0.0.15]:10027, delay=1.2, delays=1.1/0/0.04/0.02, 
dsn=2.0.0, status=sent (250 2.0.0 Ok:
queued as 3hkh3Y3RF0z23)
Aug 29 02:08:25 mail-gw postfix/qmgr[22472]: 3hkh3X2YJNz1w: removed
Aug 29 02:08:38 mail-gw postfix/anvil[23356]: statistics: max connection rate 
1/1800s for (smtpd:168.100.1.4) at
Aug 29 01:58:38
Aug 29 02:08:38 mail-gw postfix/anvil[23356]: statistics: max connection count 
1 for (smtpd:168.100.1.4) at Aug 29
01:58:38
Aug 29 02:08:38 mail-gw postfix/anvil[23356]: statistics: max recipient rate 
1/1800s for (smtpd:168.100.1.4) at Aug
29 01:58:38
Aug 29 02:08:38 mail-gw postfix/anvil[23356]: statistics: max cache size 3 at 
Aug 29 02:08:24
Aug 29 02:09:40 mail-gw spamd[21068]: spamd: server hit by SIGHUP, restarting
Aug 29 02:09:40 mail-gw spamd[21068]: spamd: server socket closed, type 
IO::Socket::IP
Aug 29 02:09:42 mail-gw spamd[21068]: spamd: server started on IO::Socket::IP 
[127.0.0.1]:10027 (running version 3.4.0)
Aug 29 02:09:42 mail-gw spamd[21068]: spamd: server pid: 21068
Aug 29 02:09:44 mail-gw postfix/postscreen[22610]: CONNECT from 
[84.113.92.77]:64250 to [10.0.0.19]:25
Aug 29 02:09:44 mail-gw postfix/postscreen[22610]: PASS OLD [84.113.92.77]:64250
Aug 29 02:09:44 mail-gw postfix/smtpd[23354]: connect from 
testserver.rhsoft.net[84.113.92.77]
Aug 29 02:09:44 mail-gw postfix/smtpd[23354]: 3hkh540hvnz1w: 
client=testserver.rhsoft.net[84.113.92.77]
Aug 29 02:09:44 mail-gw postfix/cleanup[24086]: 3hkh540hvnz1w: info: header 
Subject: Test from
testserver.rhsoft.net[84.113.92.77]; from= 
to= proto=ESMTP
helo=
Aug 29 02:09:44 mail-gw postfix/cleanup[24086]: 3hkh540hvnz1w:
message-id=
Aug 29 02:09:44 mail-gw spamd[24069]: spamd: processing message
 for 
sa-milt:189
Aug 29 02:09:44 mail-gw spamd[24069]: spamd: identified spam (5.1/5.0) for 
sa-milt:189 in 0.3 seconds, 4784 bytes.
Aug 29 02:09:44 mail-gw spamd[24069]: spamd: result: Y 5 -
ADVANCE_FEE_4_NEW,ADVANCE_F

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Fri, 2014-08-29 at 01:23 +0200, Reindl Harald wrote:
> Am 29.08.2014 um 01:20 schrieb Karsten Bräckelmann:
> > On Fri, 2014-08-29 at 00:30 +0200, Reindl Harald wrote:
> > > besides the permissions problem after the nightly "sa-update" the reason
> > > was simply "clear_headers" without "add_header spam Flag _YESNO" which
> > > is entirely unexpected behavior
> > 
> > No, that is not the cause.
> > 
> > $ echo -e "Subject: Foo\n" | ./spamassassin | grep Subject
> > Subject: [SPAM] Foo
> > X-Spam-Prev-Subject: Foo
> > 
> > $ cat rules/99_DEVEL.cf
> > required_score -999# regardless of score, classify spam
> ># to enforce header rewriting
> > clear_headers
> > rewrite_header Subject [SPAM]
> > 
> > Besides, your own reply to my first post to this thread on Mon also
> > shows this claim to be false. The output of the command I asked you to
> > run clearly shows clear_headers in your config being in effect and a
> > rewritten Subject
> 
> i verfied that 20 times in my environment
> 
> removing the line "add_header spam Flag _YESNO_" and no tagging
> maybe the combination of spamass-milter and SA but it's fact

So far I attributed most of your arguing to being stubborn and
opinionated. Not any longer.

Now you're outright lying.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 29.08.2014 um 01:20 schrieb Karsten Bräckelmann:
> On Fri, 2014-08-29 at 00:30 +0200, Reindl Harald wrote:
>> besides the permissions problem after the nightly "sa-update" the reason
>> was simply "clear_headers" without "add_header spam Flag _YESNO" which
>> is entirely unexpected behavior
> 
> No, that is not the cause.
> 
> $ echo -e "Subject: Foo\n" | ./spamassassin | grep Subject
> Subject: [SPAM] Foo
> X-Spam-Prev-Subject: Foo
> 
> $ cat rules/99_DEVEL.cf
> required_score -999# regardless of score, classify spam
># to enforce header rewriting
> clear_headers
> rewrite_header Subject [SPAM]
> 
> Besides, your own reply to my first post to this thread on Mon also
> shows this claim to be false. The output of the command I asked you to
> run clearly shows clear_headers in your config being in effect and a
> rewritten Subject

i verfied that 20 times in my environment

removing the line "add_header spam Flag _YESNO_" and no tagging
maybe the combination of spamass-milter and SA but it's fact



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Fri, 2014-08-29 at 00:30 +0200, Reindl Harald wrote:
> besides the permissions problem after the nightly "sa-update" the reason
> was simply "clear_headers" without "add_header spam Flag _YESNO" which
> is entirely unexpected behavior

No, that is not the cause.

$ echo -e "Subject: Foo\n" | ./spamassassin | grep Subject
Subject: [SPAM] Foo
X-Spam-Prev-Subject: Foo

$ cat rules/99_DEVEL.cf
required_score -999# regardless of score, classify spam
   # to enforce header rewriting
clear_headers
rewrite_header Subject [SPAM]


Besides, your own reply to my first post to this thread on Mon also
shows this claim to be false. The output of the command I asked you to
run clearly shows clear_headers in your config being in effect and a
rewritten Subject.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 11:37 schrieb Reindl Harald:
> header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
> but the subject does not get [SPAM] tagging with the config
> below - not sure what i am missing
> 
> spamassassin-3.4.0-7.fc20.x86_64
> spamass-milter-0.3.2-11.fc20.x86_64
> 
> spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- 
> -s 1048576
> perl -T -w /usr/bin/spamd -c -H --max-children=25 --min-children=10 
> --min-spare=5 --max-spare=15
> __
> 
> "/var/lib/spamass-milter/spamassassin/user_prefs" is empty
> "/etc/mail/spamassassin/local.cf" is configured below
> 
> use_bayes 1
> bayes_use_hapaxes 1
> bayes_expiry_max_db_size 30
> bayes_auto_expire 1
> bayes_auto_learn 0
> bayes_learn_during_report 0
> report_safe 0
> skip_rbl_checks 1
> 
> clear_headers
> add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_
> rewrite_header Subject [SPAM]

besides the permissions problem after the nightly "sa-update" the reason
was simply "clear_headers" without "add_header spam Flag _YESNO" which
is entirely unexpected behavior

why does the software changing the subject based on a decision made
by itself need a header written by itself as base for the next decision
to change the subject?



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 20:03 schrieb Karsten Bräckelmann:
> On Mon, 2014-08-25 at 19:43 +0200, Reindl Harald wrote:
>> Am 25.08.2014 um 19:13 schrieb Karsten Bräckelmann:
> 
>>> No tests at all. I doubt the milter generated all those missing headers
>>> including From and Date, instead of a Received one only. So it seems the
>>> restricted sa-milt user has no read permissions on the SA config.
>>>
>>> As that user, have a close look at the -D debug output.
>>>
>>> spamassassin -D --lint
>>
>> bingo - only a snippet below
>> thank you so much for setp in that thread
> 
>> the files inside exept one have correct permissions (0644)
>> but "/var/lib/spamassassin/3.004000/updates_spamassassin_org" not
> 
>> i guess i will setup a cronjob to make sure the permissions
>> below "/var/lib/spamassassin/" are 755 and 644 for any item
> 
> A dedicated cron job doesn't make sense. You should add that to the
> existing cron job that runs sa-update and conditionally restarts spamd.
> Changing permissions has to be done before restarting spamd.

agreed - set it in the systemd-units is preferable
that's what i love about systemd - have your own units override distributions 
ones

PermissionsStartOnly=true
ExecStartPre=-/usr/local/bin/sa-permissions.sh
ExecStart=/usr/sbin/spamass-milter -p /run/spamass-milter/spamass-milter.sock 
-g sa-milt -r 7.5 -- -s 1048576

PermissionsStartOnly=true
ExecStartPre=-/usr/local/bin/sa-permissions.sh
ExecStart=/usr/bin/spamd $SPAMDOPTIONS

> Alternatively, ensure the respective users for spamd, sa-update and the
> milter are identical, or at least share a common group

i guess having 0755 for folders and 0644 for files should be sane and safe
spamd itself seems to run as root, most likely because bind on port 783

well, added to the todo-list try a port above 1024 and start the process
directly with systemd as the sa-milt user

root  1688  0.8  1.8 286596 73144 ?Ss   20:12   0:01 /usr/bin/perl 
-T -w /usr/bin/spamd -c -H
--max-children=25 --min-children=10 --min-spare=5 --max-spare=15
tcp0  0 127.0.0.1:783   0.0.0.0:*   LISTEN  
1688/perl
_

however, it still don't change the subject and if i would not have seen
that once before found out how to set the reject-score i would say
a problem in the milter, but looking at the yum.log no updates in
that area

well, not that dramatical important but i am perfectionist



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Mon, 2014-08-25 at 19:43 +0200, Reindl Harald wrote:
> Am 25.08.2014 um 19:13 schrieb Karsten Bräckelmann:

> > No tests at all. I doubt the milter generated all those missing headers
> > including From and Date, instead of a Received one only. So it seems the
> > restricted sa-milt user has no read permissions on the SA config.
> > 
> > As that user, have a close look at the -D debug output.
> > 
> > spamassassin -D --lint
> 
> bingo - only a snippet below
> thank you so much for setp in that thread


> the files inside exept one have correct permissions (0644)
> but "/var/lib/spamassassin/3.004000/updates_spamassassin_org" not

> i guess i will setup a cronjob to make sure the permissions
> below "/var/lib/spamassassin/" are 755 and 644 for any item

A dedicated cron job doesn't make sense. You should add that to the
existing cron job that runs sa-update and conditionally restarts spamd.
Changing permissions has to be done before restarting spamd.

Alternatively, ensure the respective users for spamd, sa-update and the
milter are identical, or at least share a common group.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 19:13 schrieb Karsten Bräckelmann:
> On Mon, 2014-08-25 at 18:55 +0200, Reindl Harald wrote:
>> Am 25.08.2014 um 18:00 schrieb Karsten Bräckelmann:
>> X-Spam-Status: Yes, score=3.7 required=1.0 tests=MISSING_DATE,MISSING_FROM,
>> MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,NO_RELAYS
>> Subject: [SPAM] Foo
>> X-Spam-Prev-Subject: Foo
> 
> Exactly as expected. Subject tagging works.

yes

>> [root@mail-gw:~]$ su - sa-milt
>> [sa-milt@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
>> --cf="required_score 1"
> 
>> X-Spam-Status: No, score=0.0 required=1.0 tests=none
>> Subject: Foo
> 
> No tests at all. I doubt the milter generated all those missing headers
> including From and Date, instead of a Received one only. So it seems the
> restricted sa-milt user has no read permissions on the SA config.
> 
> As that user, have a close look at the -D debug output.
> 
> spamassassin -D --lint

bingo - only a snippet below
thank you so much for setp in that thread
___

the files inside exept one have correct permissions (0644)
but "/var/lib/spamassassin/3.004000/updates_spamassassin_org" not

that was pretty sure one of the first "sa-update" cronjobs because
as i started to play around the tagging was fine and i needed to
read manuals how to configure reject above a specific score and
later found out "well, and now the tagging don't work"
___

on the shell now it looks fine, mail still not tagged, all
services hard restarted and as said at the begin of play
around one time it worked - strange

Subject: Test
X-Spam-Status: Yes, score=1.7 required=1.0 tests=ADVANCE_FEE_4_NEW,

ADVANCE_FEE_4_NEW_MONEY,ADVANCE_FEE_5_NEW,ADVANCE_FEE_5_NEW_MONEY,ALL_TRUST
ED, DEAR_SOMETHING,DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,LOTS_OF_MONEY,
T_MONEY_PERCENT,URG_BIZ

i guess i will setup a cronjob to make sure the permissions
below "/var/lib/spamassassin/" are 755 and 644 for any item

[root@mail-gw:~]$ cat /usr/local/bin/sa-permissions.sh
#!/usr/bin/bash
/usr/bin/find /var/lib/spamassassin/ -type d -exec /bin/chmod 0755 "{}" \;
/usr/bin/find /var/lib/spamassassin/ -type f -exec /bin/chmod 0644 "{}" \;
[root@mail-gw:~]$ sa-permissions.sh
___

[sa-milt@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
--cf="required_score 1"
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
mail-gw.thelounge.net
X-Spam-Status: Yes, score=3.7 required=1.0 tests=MISSING_DATE,MISSING_FROM,
MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,NO_RELAYS
Subject: [SPAM] Foo
X-Spam-Prev-Subject: Foo
___

Aug 25 19:18:58.225 [32610] dbg: config: file or directory
/var/lib/spamassassin/3.004000/updates_spamassassin_org/local.cf not 
accessible: Permission denied
Aug 25 19:18:58.226 [32610] dbg: config: file or directory
/var/lib/spamassassin/3.004000/updates_spamassassin_org/regression_tests.cf not 
accessible: Permission denied
[sa-milt@mail-gw:~]$ stat 
/var/lib/spamassassin/3.004000/updates_spamassassin_org/regression_tests.cf
stat: cannot stat 
'/var/lib/spamassassin/3.004000/updates_spamassassin_org/regression_tests.cf': 
Permission denied
___

[root@mail-gw:~]$ stat /var/lib/spamassassin/3.004000/updates_spamassassin_org
  File: '/var/lib/spamassassin/3.004000/updates_spamassassin_org'
  Size: 4096Blocks: 8  IO Block: 4096   directory
Device: 811h/2065d  Inode: 41664   Links: 2
Access: (0750/drwxr-x---)  Uid: (0/root)   Gid: (0/root)
Access: 2014-08-14 19:25:43.022151858 +0200
Modify: 2014-08-25 06:04:43.425632505 +0200
Change: 2014-08-25 06:04:43.425632505 +0200
 Birth: -

[root@mail-gw:~]$ chmod 755 
/var/lib/spamassassin/3.004000/updates_spamassassin_org
mode of '/var/lib/spamassassin/3.004000/updates_spamassassin_org' changed from 
0750 (rwxr-x---) to 0755 (rwxr-xr-x)

[root@mail-gw:~]$ ls /var/lib/spamassassin/3.004000/updates_spamassassin_org/
total 920K
-rw-r--r-- 1 root root 100K 2014-08-25 06:04 languages
-rw-r- 1 root root  718 2014-08-25 06:04 MIRRORED.BY
-rw-r--r-- 1 root root 8.5K 2014-08-25 06:04 10_default_prefs.cf
-rw-r--r-- 1 root root 2.4K 2014-08-25 06:04 10_hasbase.cf
-rw-r--r-- 1 root root 7.5K 2014-08-25 06:04 20_advance_fee.cf
-rw-r--r-- 1 root root 8.9K 2014-08-25 06:04 20_aux_tlds.cf
-rw-r--r-- 1 root root 6.9K 2014-08-25 06:04 20_body_tests.cf
-rw-r--r-- 1 root root 1.9K 2014-08-25 06:04 20_compensate.cf
-rw-r--r-- 1 root root 9.6K 2014-08-25 06:04 20_dnsbl_tests.cf
-rw-r--r-- 1 root root  15K 2014-08-25 06:04 20_drugs.cf
-rw-r--r-- 1 root root  12K 2014-08-25 06:04 20_dynrdns.cf
-rw-r--r-- 1 root root 8.4K 2014-08-25 06:04 20_fake_helo_tests.cf
-rw-r--r-- 1 root root 3.0K 2014-08-25 06:04 20_freemail.cf
-rw-r--r-- 1 root root  42

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Mon, 2014-08-25 at 18:55 +0200, Reindl Harald wrote:
> Am 25.08.2014 um 18:00 schrieb Karsten Bräckelmann:

> > What does this command return?
> > 
> >   echo -e "Subject: Foo\n" | spamassassin --cf="required_score 1"
> 
> as root as expected the modified subject
> as the milter user the unmodified

> [root@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
> --cf="required_score 1"

> X-Spam-Status: Yes, score=3.7 required=1.0 tests=MISSING_DATE,MISSING_FROM,
> MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,NO_RELAYS
> Subject: [SPAM] Foo
> X-Spam-Prev-Subject: Foo

Exactly as expected. Subject tagging works.


> [root@mail-gw:~]$ su - sa-milt
> [sa-milt@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
> --cf="required_score 1"

> X-Spam-Status: No, score=0.0 required=1.0 tests=none
> Subject: Foo

No tests at all. I doubt the milter generated all those missing headers
including From and Date, instead of a Received one only. So it seems the
restricted sa-milt user has no read permissions on the SA config.

As that user, have a close look at the -D debug output.

  spamassassin -D --lint


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 18:00 schrieb Karsten Bräckelmann:
> On Mon, 2014-08-25 at 11:37 +0200, Reindl Harald wrote:
>> header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
>> but the subject does not get [SPAM] tagging with the config
>> below - not sure what i am missing
> 
> What does this command return?
> 
>   echo -e "Subject: Foo\n" | spamassassin --cf="required_score 1"

as root as expected the modified subject
as the milter user the unmodified

but as you can see at bottom the "user_prefs" is completly empty
in that case "score=0.0" even after delete baeysian data

but the score is not the problem, in my origin post you see
the message flagged in the header but no subject changed

anyways - what can cause the complete different behavior
of the restricted user?
__

[root@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin --cf="required_score 
1"
Aug 25 18:46:56.220 [32082] warn: config: created user preferences file: 
/root/.spamassassin/user_prefs
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
mail-gw.thelounge.net
X-Spam-Status: Yes, score=3.7 required=1.0 tests=MISSING_DATE,MISSING_FROM,
MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,NO_RELAYS
Subject: [SPAM] Foo
X-Spam-Prev-Subject: Foo
__

[root@mail-gw:~]$ su - sa-milt
[sa-milt@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
--cf="required_score 1"
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
mail-gw.thelounge.net
X-Spam-Status: No, score=0.0 required=1.0 tests=none
Subject: Foo

[sa-milt@mail-gw:~]$ sa-learn --clear
[sa-milt@mail-gw:~]$ echo -e "Subject: Foo\n" | spamassassin 
--cf="required_score 1"
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on

mail-gw.thelounge.net

X-Spam-Status: No, score=0.0 required=1.0 tests=none

Subject: Foo
__

sa-milt:x:189:188:SpamAssassin Milter:/var/lib/spamass-milter:/usr/bin/bash

[sa-milt@mail-gw:~]$ ls -lha /var/lib/spamass-milter/
insgesamt 28K
drwxr-x---   4 sa-milt sa-milt 4,0K 2014-08-22 17:19 training
drwxr-xr-x   4 sa-milt sa-milt 4,0K 2014-08-21 19:18 .
drwxr-xr-x. 27 rootroot4,0K 2014-08-25 17:59 ..
drwx--   2 sa-milt sa-milt 4,0K 2014-08-25 17:58 .spamassassin
lrwxrwxrwx   1 sa-milt sa-milt   13 2014-08-20 01:07 spamassassin -> 
.spamassassin
-rw---   1 sa-milt sa-milt 2,4K 2014-08-22 20:03 .bash_history
-rw---   1 sa-milt sa-milt  187 2014-08-19 17:24 .bash_profile
-rw---   1 sa-milt sa-milt  285 2014-08-19 17:25 .bashrc

[sa-milt@mail-gw:~]$ cat /var/lib/spamass-milter/.spamassassin/user_prefs
# globally maintained because postfix-milter
# signed off: Reindl Harald 



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Karsten Bräckelmann]

On Mon, 2014-08-25 at 11:37 +0200, Reindl Harald wrote:
> header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
> but the subject does not get [SPAM] tagging with the config
> below - not sure what i am missing

What does this command return?

  echo -e "Subject: Foo\n" | spamassassin --cf="required_score 1"


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 17:29 schrieb Antony Stone:
>> Post follow-ups on an appropriate support forum.  This is not it.
> 
> I think you're being unfairly rude to the original poster here.
> 
> His problem is not specific to spamass-milter (if it were, I would agree with 
> pointing him politely in the direction of another support forum) - but as the 
> link you posted above shows, his problem is with two spamassassin directives, 
> of which he has only one in his configuration.
> 
> Please let's try to be polite to people who come here asking for assistance; 
> telling them they are not welcome is only going to create a bad impression of 
> the spamassassin community

thank you - and BTW there is a good reason why i removed
that line day ago while try to find a solution:

spamd[23972]: config: failed to parse line, skipping, in 
"/etc/mail/spamassassin/local.cf": rewrite_subject 1



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Antony Stone]

On Monday 25 August 2014 at 17:21:51 (EU time), Kevin A. McGrail wrote:

> On 8/25/2014 11:17 AM, Reindl Harald wrote:
> > Am 25.08.2014 um 17:11 schrieb Kevin A. McGrail:
> >> On 8/25/2014 11:08 AM, Reindl Harald wrote:
> >>> Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:
>  On 8/25/2014 5:37 AM, Reindl Harald wrote:
> > header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
> > but the subject does not get [SPAM] tagging with the config
> > below - not sure what i am missing
>  
>  See
>  http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not
>  -working/
> >>> 
> >>> earn 0
> 
> If you read the post I sent, you would have noted you are missing |
> 
> rewrite_subject 1
> 
> Post follow-ups on an appropriate support forum.  This is not it.

I think you're being unfairly rude to the original poster here.

His problem is not specific to spamass-milter (if it were, I would agree with 
pointing him politely in the direction of another support forum) - but as the 
link you posted above shows, his problem is with two spamassassin directives, 
of which he has only one in his configuration.

Please let's try to be polite to people who come here asking for assistance; 
telling them they are not welcome is only going to create a bad impression of 
the spamassassin community.


Thanks,


Antony.

-- 
"The future is already here.   It's just not evenly distributed yet."

 - William Gibson

   Please reply to the list;
 please *don't* CC me.

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 17:21 schrieb Kevin A. McGrail:
> On 8/25/2014 11:17 AM, Reindl Harald wrote:
>> Am 25.08.2014 um 17:11 schrieb Kevin A. McGrail:
>>> On 8/25/2014 11:08 AM, Reindl Harald wrote:
 Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:
> On 8/25/2014 5:37 AM, Reindl Harald wrote:
>> header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
>> but the subject does not get [SPAM] tagging with the config
>> below - not sure what i am missing
> See 
> http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/
 earn 0 
> If you read the post I sent, you would have noted you are missing |
> rewrite_subject 1

https://wiki.apache.org/spamassassin/SubjectRewrite
SubjectRewrite in 3.0.x
- The "rewrite_subject" and "subject_tag" configuration options were deprecated 
and are now removed. Instead, using
"rewrite_header Subject [your desired setting]". e.g.

rewrite_subject 1 subject_tag SPAM(_SCORE_)

becomes
rewrite_header Subject SPAM(_SCORE_)

> Post follow-ups on an appropriate support forum. This is not it

why can't you just ignore something you don't bother about instead
strip all informations out from my first post which maybe somebody
else could found tomorrow and now ignores because stripped follow
ups..





signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Kevin A. McGrail]

On 8/25/2014 11:17 AM, Reindl Harald wrote:


Am 25.08.2014 um 17:11 schrieb Kevin A. McGrail:

On 8/25/2014 11:08 AM, Reindl Harald wrote:

Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:

On 8/25/2014 5:37 AM, Reindl Harald wrote:

header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
but the subject does not get [SPAM] tagging with the config
below - not sure what i am missing

See 
http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/
earn 0 

If you read the post I sent, you would have noted you are missing |

rewrite_subject 1
|
Post follow-ups on an appropriate support forum.  This is not it.

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 17:11 schrieb Kevin A. McGrail:
> On 8/25/2014 11:08 AM, Reindl Harald wrote:
>> Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:
>>> On 8/25/2014 5:37 AM, Reindl Harald wrote:
 header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
 but the subject does not get [SPAM] tagging with the config
 below - not sure what i am missing
>>> See 
>>> http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/
>> i found that days ago but where do you see the "-m" flag below?
>> my original post contained the full "ps aux" cmd lines
>>
>> spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- 
>> -s 1048576
> I don't see the change subject config lines for SA

because you stripped anything useful from my orgiginal post

/etc/mail/spamassassin/local.cf:
clear_headers
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_
rewrite_header Subject [SPAM]

> Also, this is not the user list for spamass-milter

uhm the settings below are also inherited from "/etc/mail/spamassassin/local.cf"
as all other settings and scoring so i doubt that the milter with the
params below and with no "-m" or "-M" is responsible

use_bayes 1
bayes_use_hapaxes 1
bayes_expiry_max_db_size 30
bayes_auto_expire 1
bayes_auto_learn 0



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Kevin A. McGrail]

On 8/25/2014 11:08 AM, Reindl Harald wrote:

Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:

On 8/25/2014 5:37 AM, Reindl Harald wrote:

header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
but the subject does not get [SPAM] tagging with the config
below - not sure what i am missing

See 
http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/

i found that days ago but where do you see the "-m" flag below?
my original post contained the full "ps aux" cmd lines

spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- -s 
1048576
I don't see the change subject config lines for SA.  Also, this is not 
the user list for spamass-milter.


Regards,
KAM

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Am 25.08.2014 um 16:58 schrieb Kevin A. McGrail:
> On 8/25/2014 5:37 AM, Reindl Harald wrote:
>> header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
>> but the subject does not get [SPAM] tagging with the config
>> below - not sure what i am missing
> 
> See 
> http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/

i found that days ago but where do you see the "-m" flag below?
my original post contained the full "ps aux" cmd lines

spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- -s 
1048576



signature.asc
Description: OpenPGP digital signature

Re: no subject tagging in case of "X-Spam-Status: Yes"

[Kevin A. McGrail]

On 8/25/2014 5:37 AM, Reindl Harald wrote:

Hi

header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
but the subject does not get [SPAM] tagging with the config
below - not sure what i am missing


See 
http://www.jigsawboys.com/2006/06/28/spamassassin-rewrite-subject-not-working/


Regards,
KAM

no subject tagging in case of "X-Spam-Status: Yes"

[Reindl Harald]

Hi

header contains "X-Spam-Status: Yes, score=7.5 required=5.0"
but the subject does not get [SPAM] tagging with the config
below - not sure what i am missing

spamassassin-3.4.0-7.fc20.x86_64
spamass-milter-0.3.2-11.fc20.x86_64

spamass-milter -p /run/spamass-milter/spamass-milter.sock -g sa-milt -r 8 -- -s 
1048576
perl -T -w /usr/bin/spamd -c -H --max-children=25 --min-children=10 
--min-spare=5 --max-spare=15
__

"/var/lib/spamass-milter/spamassassin/user_prefs" is empty
"/etc/mail/spamassassin/local.cf" is configured below

use_bayes 1
bayes_use_hapaxes 1
bayes_expiry_max_db_size 30
bayes_auto_expire 1
bayes_auto_learn 0
bayes_learn_during_report 0
report_safe 0
skip_rbl_checks 1

clear_headers
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_
rewrite_header Subject [SPAM]

score UNPARSEABLE_RELAY 0

bayes_ignore_header X-ACL-Warn
bayes_ignore_header X-ASF-Spam-Status
bayes_ignore_header X-ASG-Debug-ID
bayes_ignore_header X-ASG-Orig-Subj
bayes_ignore_header X-ASG-Recipient-Whitelist
bayes_ignore_header X-ASG-Tag
bayes_ignore_header X-Alimail-AntiSpam
bayes_ignore_header X-Amavis-Modified
bayes_ignore_header X-Anti-Spam
bayes_ignore_header X-Anti-Virus
bayes_ignore_header X-Anti-Virus-Version
bayes_ignore_header X-AntiAbuse
bayes_ignore_header X-Antispam
bayes_ignore_header X-Antivirus
bayes_ignore_header X-Antivirus-Status
bayes_ignore_header X-Antivirus-Version
bayes_ignore_header X-Attachment-Id
bayes_ignore_header X-Authenticated-As
bayes_ignore_header X-Authenticated-Sender
bayes_ignore_header X-Authenticated-User
bayes_ignore_header X-Authvirus
bayes_ignore_header X-Barracuda-Apparent-Source-IP
bayes_ignore_header X-Barracuda-BBL-IP
bayes_ignore_header X-Barracuda-BRTS-Status
bayes_ignore_header X-Barracuda-Bayes
bayes_ignore_header X-Barracuda-Connect
bayes_ignore_header X-Barracuda-Encrypted
bayes_ignore_header X-Barracuda-Envelope-From
bayes_ignore_header X-Barracuda-Fingerprint-Found
bayes_ignore_header X-Barracuda-Orig-Rcpt
bayes_ignore_header X-Barracuda-RBL-IP
bayes_ignore_header X-Barracuda-RBL-Trusted-Forwarder
bayes_ignore_header X-Barracuda-Spam-Report
bayes_ignore_header X-Barracuda-Spam-Score
bayes_ignore_header X-Barracuda-Spam-Status
bayes_ignore_header X-Barracuda-Start-Time
bayes_ignore_header X-Barracuda-UID
bayes_ignore_header X-Barracuda-URL
bayes_ignore_header X-Barracuda-Virus-Alert
bayes_ignore_header X-Cloud-Security
bayes_ignore_header X-Coremail-Antispam
bayes_ignore_header X-He-Spam
bayes_ignore_header X-IronPort-AV
bayes_ignore_header X-IronPort-Anti-Spam-Filtered
bayes_ignore_header X-IronPort-Anti-Spam-Result
bayes_ignore_header X-Ironport
bayes_ignore_header X-Klms-Anti
bayes_ignore_header X-Klms-Antispam
bayes_ignore_header X-Kse-Anti
bayes_ignore_header X-Mozilla-Keys
bayes_ignore_header X-Mozilla-Status
bayes_ignore_header X-Mozilla-Status2
bayes_ignore_header X-PROLinux-SpamCheck
bayes_ignore_header X-SPAM-FLAG
bayes_ignore_header X-ServerMaster-MailScanner
bayes_ignore_header X-Spam-Checker-Version
bayes_ignore_header X-Spam-Level
bayes_ignore_header X-Spam-Processed
bayes_ignore_header X-Spam-Report
bayes_ignore_header X-Spam-Score
bayes_ignore_header X-Spam-Score-Int
bayes_ignore_header X-Spam-Status
bayes_ignore_header X-Spam-Threshold
bayes_ignore_header X-SpamExperts-Domain
bayes_ignore_header X-SpamExperts-Outgoing-Class
bayes_ignore_header X-SpamExperts-Outgoing-Evidence
bayes_ignore_header X-SpamExperts-Username
bayes_ignore_header X-SpamInfo
bayes_ignore_header X-Univie-Virus-Scan
bayes_ignore_header X-Virus-Checker-Version
bayes_ignore_header X-Virus-Scanned
bayes_ignore_header X-Virus-Scanner-Version
bayes_ignore_header X-VirusChecked
bayes_ignore_header X-Virus-Status

required_hits 5

score USER_IN_MORE_SPAM_TO -2
score USER_IN_ALL_SPAM_TO -100

score DKIM_SIGNED 0.5
score DKIM_VALID -0.5
score DKIM_VALID_AU -0.5

score ALL_TRUSTED -1
trusted_networks 192.168.196.0/24



signature.asc
Description: OpenPGP digital signature

[no subject]

[24x7server]

[no subject]

[postmaster....@gmail.com]

unsubscribe

[no subject]

[Jose Luis Marin Perez]

Dear Sirs,

I need to know how can I automatically move all emails that are considered as 
SPAM to a specific directory called SPAM.

The server has installed Dovecot + Qmail + Vpopmail + Simscan + Spamassassin 
3.2.5 + ClamAV.

Simscan is configured with:

./configure --enable-clamav=y --enable-clamdscan=/usr/local/bin/clamdscan 
--enable-dropmsg=y --enable-custom-smtp-reject=n --enable-per-domain=y 
--enable-attach=y --enable-spam=y --enable-ripmime=/usr/local/bin/ripmime 
--enable-received=y --enable-spam-hits=5.0 --enable-spamc=/usr/bin/spamc 
--enable-spamc-args="-s 20 -t 60 -U /tmp/spamd.sock" --enable-spamc-user=y 
--enable-regex=y --with-pcre-include=/usr/local/include --enable-quarantinedir

At present all emails are considered SPAM go to the quarantine folder on the 
server.

Thanks

Jose Luis
  
_
Connect to the next generation of MSN Messenger 
http://imagine-msn.com/messenger/launch80/default.aspx?locale=en-us&source=wlmailtagline

[no subject]

[res]

On Sat, 25 Jul 2009, Michael W. Cocke wrote:

>
> There doesn't seem to be a web interface to subscribe/unscribe from
> this list.  The email address
> "users-unsubscr...@spamassassin.apache.org"  complains that my IP
> address is dynamic (which is why I use dyndns.org, thank you very
> much.)  And on that subject, am I the only person who thinks that
> blocking by IP address block is inefficient, brute force, and prone to
> both false positives and false negatives?

If you are sending out from your dynamic home connection, you are going to 
have bigger problems, most of the big ISP's and many many many others 
block at MTA level for your type of connections, either get a static IP
*and* a real PTR entry, or use your ISP as smarthost.

Nothing wrong with the way this list is setup apart from it uses qmail, 
but we wont go into that :)

-- 
Res

-Beware of programmers who carry screwdrivers

[no subject]

[Doni Mediono Indrawan]

Hi,

How are you doing recently? I would like to introduce you a very good
company which I know. Their website is
<<>>

They can offer you all kinds of electronic products Please
take some time to have a check, They must have something you'd like to
buy.

[no subject]

[jcputter]

Can spamassassin miss hits or rules if it is running on a slow machine?

Re: config no subject rewrite, learning spam headers

[Ray]

RW  googlemail.com> writes:

> On Wed, 18 Feb 2009 23:00:03 + (UTC)
> Ray  misinformation.org> wrote:
> > * How do I determine what the current SA config is?
>
> The locations where spamassassin looks for configuration are listed in
> the main manpage.

I managed to find the config directory on this system, thanks for the pointer.
I guess I have to parse all of these files to know how SA is actually config'd?
Alas, I was hoping for something like Postfix's `postconf` to show the
active/final configuration in its entirety.

Where can one submit a feature request, and does this sound like a sensible one?

> If it appears to autolearning, then bayes and autolearning are enabled.

The magically incrementing `sa-learn --dump magic|grep am` values suggest so.
It's odd that there isn't any indication in the "X-Spam-Status" header that this
is happening, as one would expect after reading the wiki article
AutolearnNotWorking.

> Note that autolearning uses its own, more conservative, rules, it's not
> based on the normal single threshold - you should use sa-learn to
> manually train too, if you can.

I noticed the additional thresholds for autolearning.  I was hoping to do manual
training only, but maybe that level of control is just not achievable in my
circumstance.  (The problem being that my headers may be bad for sa-learn.)

> By default Bayes  scoring wont turn-on until you've learned 200 spam,
> and 200 ham (non-spam) messages. If you are going to make a judgement
> about moving the threshold then you should ignore the early mails that
> lack BAYES_* hits.

I imagine after Bayes scoring goes into effect I'll have a nicer distribution of
scores (pushed towards the poles).

> >   * Can I stop SA from judging spamminess (that is, making the binary
> > declaration of whether something is spam, X-Spam-Status,
> > X-Spam-Flag) and retain the scoring markup?  I suppose this may not
> > be important, as sa-learn is said to ignore prior SA markup, it's
> > just that having the declaration sitting in the headers from there on
> > makes these mails look spammy whether they truly are, and other more
> > naive tools might be misled.
>
> Some third-party Baysian filters let you you ignore unwanted headers.

I think this response might mean that I can't stop SA adding X-Spam-Status
and/or X-Spam-Flag, as the response proceeds without answering the question
directly.  I would like to have just the scoring without the judgements, but I
suppose again this is not an issue with regards to future application of
sa-learn.

The only other markup I feel it's actually necessary to hinder is the subject
markup.

> Even if you use one that doesn't, a single spam/ham token isn't likely
> to have all that much effect compared to all the other SA tokens. There

That's reassuring.

> are two main ways to use SA with a separate Bayesian filter. One is to
> score it into SA (which you can't do) and the other is to let the
> Bayesian filter pick-up extra tokens from the SA headers. In the latter
> case you would probably want to leave in the result at the default
> threshold anyway.

And I or another person shouldjust remember while looking at these emails that 
the judgement is not necessarily correct.  I guess I'm including myself (and
other humans) among the naive tools to worry about.

> I think you could get rid of it by creating a custom header, but it's
> probably not worth the effort.

"It" here referring to the final spamminess judgement?  Oh, sorry, I
misunderstood earlier, then.

> >   * If I can't stop SA from judging spamminess, can I at least
> > override the site-wide config to mark up subjects?  I can't figure
> > this out.  Currently I have 'rewrite_header  subject  ""', but that
> > fails.  The docs say the string should be set to 'a null value', but
> > the config file's syntax for specifying nulls is not described.
>
> I believe it just means:
>
> rewrite_header  subject

Ah, that's one of the permutations I tried.  Any idea why it may not have
worked?  I've been able to modify required_score, as is evidenced by mail
headers that come through, so I must be working in a picked-up config file.
(Again a `sa-conf` to view live/final config would be much better for me than
tweaking my user config file's required_score and then waiting for a spam to
arrive so I can know if a config specification went into effect.)  My only guess
now is that somehow site-wide config overrides user config for this item or that
user config for this item is disallowed.

Right now SA's config'd to prepend "***SPAM*** ".  But I don't see this string
or the string "rewrite_header" anywhere in the discovered config directory or my
user config.

So this is part of what I meant earlier about how my headers may be bad.  The
subjects.  I can't imagine SA would know how to ignore this prepended string --
could it?  The wiki article LearningMarkedUpMessages suggests that "Subject
header tagged etc." are automatically removed for learning, but the POD

Re: config no subject rewrite, learning spam headers

[RW]

On Wed, 18 Feb 2009 23:00:03 + (UTC)
Ray  wrote:

> However, SA currently appears to be making spam
> judgement and to be bayes autolearning. (A reasonable default setup
> from the hosting provider.)
> 
> * How do I determine what the current SA config is? 

The locations where spamassassin looks for configuration are listed in
the main manpage.

> Specifically,
> can I see whether bayes is enabled, and whether it's auto-learning
> (if that's distinct from merely enabled)? 

If it appears to autolearning, then bayes and autolearning are enabled.

Note that autolearning uses its own, more conservative, rules, it's not
based on the normal single threshold - you should use sa-learn to
manually train too, if you can.

By default Bayes  scoring wont turn-on until you've learned 200 spam,
and 200 ham (non-spam) messages. If you are going to make a judgement
about moving the threshold then you should ignore the early mails that
lack BAYES_* hits.

>   * Can I stop SA from judging spamminess (that is, making the binary
> declaration of whether something is spam, X-Spam-Status,
> X-Spam-Flag) and retain the scoring markup?  I suppose this may not
> be important, as sa-learn is said to ignore prior SA markup, it's
> just that having the declaration sitting in the headers from there on
> makes these mails look spammy whether they truly are, and other more
> naive tools might be misled.

Some third-party Baysian filters let you you ignore unwanted headers.
Even if you use one that doesn't, a single spam/ham token isn't likely
to have all that much effect compared to all the other SA tokens. There
are two main ways to use SA with a separate Bayesian filter. One is to
score it into SA (which you can't do) and the other is to let the
Bayesian filter pick-up extra tokens from the SA headers. In the latter
case you would probably want to leave in the result at the default
threshold anyway.

I think you could get rid of it by creating a custom header, but it's
probably not worth the effort. 


>   * If I can't stop SA from judging spamminess, can I at least
> override the site-wide config to mark up subjects?  I can't figure
> this out.  Currently I have 'rewrite_header  subject  ""', but that
> fails.  The docs say the string should be set to 'a null value', but
> the config file's syntax for specifying nulls is not described.

I believe it just means:

rewrite_header  subject

config no subject rewrite, learning spam headers

[Ray]

I just moved to a new hosting provider who has Spamassassin 3.2.4 running (on
some kind of Linux, 2.6.18-92.1.22.el5) and I'm otherwise unfamiliar with SA.
I'd like some degree of control over what SA is doing, but config for this is
proving confusing for me.

Ideally if I could get SA just to mark up headers with its observations /
scoring, I'd have a good idea of where to set score threshold while I sort
mails correctly for later training.  First monitor, then act.  However, SA
currently appears to be making spam judgement and to be bayes autolearning.
(A reasonable default setup from the hosting provider.)

I think these things would help me to achieve my goals:

  * How do I determine what the current SA config is?  Specifically, can I see
whether bayes is enabled, and whether it's auto-learning (if that's
distinct from merely enabled)?  Anyway, seeing the whole config would be
useful.  The best I've done so far is `spamassassin -D < /dev/null 2>&1 |
less` and `sa-learn --dump magic`.  (I may not actually have read access
to the site-wide SA config file, and `locate` is twitted.)

  * Can I stop SA from judging spamminess (that is, making the binary
declaration of whether something is spam, X-Spam-Status, X-Spam-Flag) and
retain the scoring markup?  I suppose this may not be important, as
sa-learn is said to ignore prior SA markup, it's just that having the
declaration sitting in the headers from there on makes these mails look
spammy whether they truly are, and other more naive tools might be misled.

  * If I can't stop SA from judging spamminess, can I at least override the
site-wide config to mark up subjects?  I can't figure this out.  Currently
I have 'rewrite_header  subject  ""', but that fails.  The docs say the
string should be set to 'a null value', but the config file's syntax for
specifying nulls is not described.  Again, this may not be critical, as
sa-learn might ignore the markup, but seeing as the markup is an arbitrary
string, how would sa-learn figure out to ignore the specific string
'***SPAM***' if the config ever changes?

Thanks,

RSK

[no subject]

[rickm]

/m:46 spam: 3.2.4
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on mail.limelyte.com
X-Spam-Level: 
X-Spam-Status: No, score=-3.8 required=5.0 tests=ALL_TRUSTED,BAYES_00
autolearn=ham version=3.2.4
Received: from static-166-3.aei.ca (HELO ?192.168.1.119?) ([EMAIL 
PROTECTED]@192.197.166.3)
  by net131.limelyte.net with ESMTPA; 14 Apr 2008 20:20:24 -
Message-ID: <[EMAIL PROTECTED]>
Date: Mon, 14 Apr 2008 16:20:22 -0400
From: Rick Macdougall <[EMAIL PROTECTED]>
User-Agent: Thunderbird 2.0.0.12 (Windows/20080213)
MIME-Version: 1.0
To: users@spamassassin.apache.org
Subject: Re: can not compile "sought" ruleset
References: <[EMAIL PROTECTED]>
In-Reply-To: <[EMAIL PROTECTED]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Stefan Jakobs wrote:
> Hello,
> 
> I just tried the "sought" ruleset (see 
> http://taint.org/2007/08/15/004348a.html). But I was not able to compile it. 
> Is the ruleset not compilable or did I something wrong?
> 
> I'm using SpamAssassin v3.2.3 and here's the output from sa-compile:
> 

I had the same problem.  Upgrading re2c and the removing the 
/var/lib/spamassassin, then re-running sa-update for all my rule sets 
fixed it for me.

Rick

[no subject]

[The Doctor]

Hmm!! Slight problem!

I indicated a whtielist_from in the universal configuration file 
and still there is {spam?} label.

What should I be fixing?

-- 
Member - Liberal International  
This is [EMAIL PROTECTED]   Ici [EMAIL PROTECTED]
God, Queen and country! Beware Anti-Christ rising!  On March 3rd,
Alberta! Time for a change and beware Alliance in PC clothing. Vote Liberal!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[no subject]

[Juergen . Boehm]

Hi 

i need help with Spamassassin. Once in a month we have to send a massive 
amount of mails at the same time. These are Invoice mails to our 
customers.
The problem is, that spamd controls all these mails, which are send from a 
different Server in our network. It happens that 1/4 of this mails are not 
send because of:
554 Relay rejected for policy reasons. 
Error.
When i look in the mail file on the Mailserver I see that spamd arrives at 
the limit of spawned childs and there are some errors.
My question now is: is there an opportunity to tell spamassassin to ignore 
a server in the own network completely so that spamd isn't called when 
there comes a mail from this server?
It can't be "trusted networks" because this parameter is set.

Greets + Thx
Jürgen

[no subject]

[Giampaolo Tomassoni]

> -Original Message-
> From: Jeff Chan [mailto:[EMAIL PROTECTED]
> Sent: Saturday, January 26, 2008 5:33 PM
> 
> Quoting Giampaolo Tomassoni <[EMAIL PROTECTED]>:
> 
> >> From: Jeff Chan [mailto:[EMAIL PROTECTED]
> >> There are lots of legitimate reasons to delegate zones, for example,
> >> migration to a new nameserver.  I suggest you ask someone who runs
> >> major nameservers.  I have.
> >
> > This is a temporary solution. Later you upgrade your registration
> records,
> > right?
> 
> Sometimes it's temporary, sometimes it's not.  Sometimes temporary
> solutions remain in place for many years.

Then you're not obeying to the agreements with your registrar.


> Delegation is a primary function of DNS.

You are misinterpreting what delegation is meant to, Jeff. I suggest you to
read the docs about it at IETF or ICANN: there is not even a single word
about delegation which is not related to sub-domains.

Have good scores...

Giampaolo


> Jeff C.

[no subject]

[Dan Mahoney, System Admin]

--

"Man, this is such a trip"

-Dan Mahoney, October 25, 1997

Dan Mahoney
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---

[no subject]

[Qnet ..]

Hi, 

My Qmail server work  with spamassassin + clamav. The processes Spamd  take the 
most part of the load so it 's  Spamassassin crash. Do you know any way to 
solve it?
Please look the attach file( top -d1 ).  Thank you so munch !

_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

[no subject]

[Qnet ..]

Qnet .. schrieb:
> Hi Guys,
> I'm running a Qmail server with spamassassin + clamav + Simscam.
> The server i'm using is a HP ML110 CPU PIV (3.2 GHZ) 2mb chache , 1GB RAM.
> 
> The problem is, the i'm getting very high load because spamd is the processes 
> which take the most part of the load
> (invoked by spamassassin) si it's Spamassassin crash. i can stop spamassassin 
> and them start it to work 
> again.
> 
> 
> Do you know any way to solve it? sorry for my bad english . 
_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

[no subject]

[Qnet ..]

 hi, i used spamcontrol-2316 with Qmail 1.03. the
validrcptto patch is compatible with this? . Spmacontrol does not just that ?.



Thank you so much.



> From: [EMAIL PROTECTED]

> To: users@spamassassin.apache.org

> Subject: RE: High Qmail-Server Load

> Date: Wed, 31 Oct 2007 08:59:50 -0700

> 

> If you need to reject unknown accounts at smtp time, go to

> 

> http://qmail.jms1.net

> 

> and check out validrcptto patch among other things

> 

> please read site in full to make good decisions re qmail

> 

> i.e. browser will not work there.

> 

> - rh

>
_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

[no subject]

[mj romero]

Hello Spamassassin's users,For Spamassassin and DSPAM, in Bayes, it is possible 
to keep tokens by user? In which formats? It supports Oracle, MySQL, 
PostgreSQL…?Sorry for my english and thanks.
_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

[no subject]

[mj romero]

Hello Spamassassin's users,For Spamassassin and DSPAM, in Bayes, it is possible 
to keep tokens by user? In which formats? It supports Oracle, MySQL, 
PostgreSQL…?Sorry for my english and thanks.
_
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

[no subject]

[Daniel Aquino]

I'm currently using:

my $spam_assassin = Mail::SpamAssassin->new({
  site_rules_filename => '/etc/mail/spamassassin/',
  dont_copy_prefs => 1
});


Would this be the correct way to initialize SA ?

I have been testing back and forth between my script and sa-learn and it
appears that they are not using the same database...

[no subject]

[Michael Worobcuk]

Hi,
I am running SpamAssassin-3.2.1_1 on FreeBSD.
My MTA is Exim.

My problem is that spamd seems to be invoked 3 times by exim.

Here is an excerpt of my mysql-query-log:


 9102 Connect [EMAIL PROTECTED] on spamassassin
   9102 Query   set autocommit=1
   9102 Query   SELECT value FROM  
bayes_global_vars WHERE variable = 'VERSION'
   9102 Query   SELECT id FROM bayes_vars WHERE  
username = '[EMAIL PROTECTED]'
   9102 Query   SELECT max(runtime) from  
bayes_expire WHERE id = '2'
   9102 Query   SELECT spam_count, ham_count,  
token_count, last_expire,
last_atime_delta, last_expire_reduce,  
oldest_token_age,

newest_token_age
   FROM bayes_vars
  WHERE id = '2'
   9102 Quit
   9103 Connect [EMAIL PROTECTED] on  
spamassassin

   9103 Query   set autocommit=1
   9103 Query   SELECT value FROM  
bayes_global_vars WHERE variable = 'VERSION'
   9103 Query   SELECT id FROM bayes_vars WHERE  
username = 'nobody'
   9103 Query   SELECT max(runtime) from  
bayes_expire WHERE id = '1'
   9103 Query   SELECT spam_count, ham_count,  
token_count, last_expire,
last_atime_delta, last_expire_reduce,  
oldest_token_age,

newest_token_age
   FROM bayes_vars
  WHERE id = '1'
   9103 Quit
   9104 Connect [EMAIL PROTECTED] on  
spamassassin

   9104 Query   set autocommit=1
   9104 Query   SELECT id FROM bayes_vars WHERE  
username = 'nobody'
   9104 Query   SELECT max(runtime) from  
bayes_expire WHERE id = '1'
   9104 Query   SELECT spam_count, ham_count,  
token_count, last_expire,
last_atime_delta, last_expire_reduce,  
oldest_token_age,


As you can see, on the second and third connection spamd is called  
with user nobody. It seemd to me that the first query should be  
enough for spamassassin, because the second and third are almost the  
same ( except that "SELECT value FROM bayes_global_vars WHERE  
variable = 'VERSION'" is missing on the third query).


I have no idea, why spamassassin behaves that way !

Can anybody help me ?

[no subject]

[Kelsey Forsythe]

I receive different results running the 'sa-learn --dump magic'  
command depending on the user.


Running as user ‘atom’:

sa-learn --dump magic
0.000  0  3  0  non-token data: bayes db version
0.000  0   8902  0  non-token data: nspam
0.000  0   2590  0  non-token data: nham
0.000  0 135271  0  non-token data: ntokens
0.000  0 1165600543  0  non-token data: oldest atime
0.000  0 1172187010  0  non-token data: newest atime
0.000  0  0  0  non-token data: last journal  
sync atime
0.000  0 1172188618  0  non-token data: last expiry  
atime
0.000  02764800  0  non-token data: last expire  
atime delta
0.000  0  30931  0  non-token data: last expire  
reduction count


And then repeat but as root:

sa-learn --dump magic
0.000  0  3  0  non-token data: bayes db version
0.000  0 95  0  non-token data: nspam
0.000  0 97  0  non-token data: nham
0.000  0  22563  0  non-token data: ntokens
0.000  0 1146776047  0  non-token data: oldest atime
0.000  0 1171272030  0  non-token data: newest atime
0.000  0  0  0  non-token data: last journal  
sync atime
0.000  0  0  0  non-token data: last expiry  
atime
0.000  0  0  0  non-token data: last expire  
atime delta
0.000  0  0  0  non-token data: last expire  
reduction count


And then repeat as clamav:

sa-learn --dump magic
0.000  0  3  0  non-token data: bayes db version
0.000  0   4625  0  non-token data: nspam
0.000  0  19114  0  non-token data: nham
0.000  0 124393  0  non-token data: ntokens
0.000  0 1172484157  0  non-token data: oldest atime
0.000  0 1172909678  0  non-token data: newest atime
0.000  0 1172909274  0  non-token data: last journal  
sync atime
0.000  0 1172829815  0  non-token data: last expiry  
atime
0.000  0 345600  0  non-token data: last expire  
atime delta
0.000  0  39910  0  non-token data: last expire  
reduction count


Which is truly the one used by the SpamAssassin program?

Thanks in advance,
Kelsey

Re: (no subject)

[Evan Platt]

At 12:48 PM 1/2/2007, you wrote:

unsubscribe


As the headers say:
list-unsubscribe: 

(no subject)

[Nicholas Anderson]

unsubscribe

-- 
Nicholas Anderson
Administrador de Sistemas Unix
LPIC-1 Certified
Rede Fiocruz
e-mail: [EMAIL PROTECTED]

[no subject]

[pinoyskull]

set delivery off

(no subject)

[Wojtek Potrzebowski]

[no subject]

[Peter Smith]

Hi,

Over the last week, my machine (Fedora, SA 3.1.3, qmail, 
qmail-scanner-queue.pl) has
been recieving a fair amount of junk mail which is not being tagged as spam; in 
fact the
total scores are negative.

The messages are simply a random stream of words, with punctuation scattered in 
them. No
HTML, no URLs being advertised, no excessive capitalisation, just meaningless 
text. The
message headers are pretty clean too, apart from the From field being false.

As such, SA is finding very little to complain about, and is even lowering the 
scoring
because the bayes filtering deems it to be good.

Any thoughts on what I can do about these messages? Even with bayes turned off, 
they
would still fail to score more than say 2 or 3. Each message contains a 
different
paragraph of random text, so it's not possible to pick out keywords; and the 
messages
are coming from dialup machines, so blocking IP isn't going to be very 
effective.

Many thanks,
Peter Smith

Re: [Sare-users] (no subject)

[Andreas Pettersson]

Andreas Pettersson wrote:


SysAdmin wrote:

I wrote the following rule in an attempt to catch these but I've 
obviously made some error.  Can someone give me a little guidance as 
to where I went awry?


rawbody SWF_r_AMPGFX1   /\.(com|net)/\w+/\?90\&/i



The forward slashes need to be escaped as well.

Regards,
Andreas



Sorry, this went to the wrong list..

Regards, Andreas

Re: [Sare-users] (no subject)

[Andreas Pettersson]

SysAdmin wrote:

I wrote the following rule in an attempt to catch these but I've 
obviously made some error.  Can someone give me a little guidance as 
to where I went awry?


rawbody SWF_r_AMPGFX1   /\.(com|net)/\w+/\?90\&/i



The forward slashes need to be escaped as well.

Regards,
Andreas

[no subject]

[sokka]

Dear Group Members,
 
I have a GW IP from where all mails will come and fall to my real server. I have spamassassin in my real server whihc is almost uptodate. Now, whenever i rcv a mail by bypassing the gw it is stamped as SPAM where if the same mail comes thru that gw it is marked in low rate. 

 
How to reactivate my gw ip in my spamassassin to scan as if a normal ip.
 
regards 

[no subject]

[Andreas Walter]

unsubscribe
end

[no subject]

[Dan Massey]

Hi 
All
 
I hope 
somebody on the list can help me here. Our set-up is as 
follows:
 
Internet 
-->  Spam Gateway  --> pop server/exchange 
server
 
we are 
using:
 
FreeBSD 
6.1
Sendmail 
8.13 forward s mail via smtp from mailertable
spamass-milter
spamassassin 
3.1.3
 
Our problem 
is that we want to send everything marked as spam to a separate smtp server to 
create customer spam traps but allow the rest of the mail to be forwaded by smtp 
to the original popserver or smtp server.
 
Is this 
possible with sendmail?
 
Thanks in 
advance for your time

Dan
 

[no subject]

[Bowie Bailey]

Does anyone know if the AuthCourier.pm module that is described on the
page linked below works with SA 3.1.1?

http://da.andaka.org/Doku/courier-spamassassin.html

--
Bowie

[no subject]

[Daniel Madaoui]

I want to use SA for a lot of users which don't have home directory.  
There mails are in /var/mail. The spammed mails are send to the  
recipient  in his file /var/mail/user with the addition  of SA.


The bayes and auto-whitelist database will be comun to anybody.

I use spamassassin  3.0.3 under freebsd 4.8

I use postfix and  SA through procmail.

postfix  main.cf:

mailbox_command = /usr/local/bin/procmail -t

I 've got the config file for procmail in /usr/local/etc/procmailrc

PATH=$HOME/bin:/usr/bin:/usr/ucb:/bin:/usr/local/bin:.
LOGFILE=/var/log/procmail.log

:0fw: $LOGNAME.lock
*  < 256000
| /usr/local/bin/spamc

I launch spamd in this way:

/usr/local/bin/spamd -d -m10

and when I send a mail  I 've got this log:

Apr 13 19:39:37 host spamd[48968]: spamd: setuid to root succeeded
Apr 13 19:39:37 host spamd[48968]: spamd: still running as root: user  
not specified with -u, not found, or set to root, falling back to  
nobody at /usr/local/bin/spamd line 1152,  line 4.
Apr 13 19:39:37 host spamd[48968]: spamd: processing message  
<[EMAIL PROTECTED]> for root:65534
Apr 13 19:39:37 host spamd[48968]: locker: safe_lock: cannot create  
tmp lockfile /root/.spamassassin/auto-whitelist.lock.example.com. 
48968 for /root/.spamassassin/auto-whitelist.lock: Permission denied
Apr 13 19:39:37 host spamd[48968]: auto-whitelist: open of auto- 
whitelist file failed: locker: safe_lock: cannot create tmp lockfile / 
root/.spamassassin/auto-whitelist.lock.example.com.48968 for / 
root/.spamassassin/auto-whitelist.lock: Permission denied
Apr 13 19:39:37 host spamd[48968]: bayes: locker: safe_lock: cannot  
create tmp lockfile /root/.spamassassin/bayes.lock.example.com.48968  
for /root/.spamassassin/bayes.lock: Permission denied
Apr 13 19:39:37 host spamd[48968]: spamd: clean message (-1.4/5.0)  
for root:65534 in 0.3 seconds, 744 bytes.
Apr 13 19:39:37 host spamd[48968]: spamd: result: . -1 - ALL_TRUSTED  
scantime=0.3,size=744,user=root,uid=65534,required_score=5.0,rhost=local 
host.example.com,raddr=127.0.0.1,rport=1645,mid=<3822750E-3444-4F34-938F 
[EMAIL PROTECTED]>,autolearn=failed



The mail was in the mailbox but the bayes was not used.

So I restart the spamd daemon whith this options

/usr/local/bin/spamd -d -m10  -u spamassassin ( spamassassin in an  
user with its directory /home/spamassassin/.spamassassin )


He try to use the .spamassassin directory who belong to root (/ 
root/.spamssassin/ )


Apr 13 19:50:53 host spamd[49552]: spamd: connection from  
localhost.example.com [127.0.0.1] at port 1982
Apr 13 19:50:53 host spamd[49552]: spamd: processing message  
<[EMAIL PROTECTED]> for root:3005
Apr 13 19:50:53 host spamd[49552]: locker: safe_lock: cannot create  
tmp lockfile /root/.spamassassin/auto-whitelist.lock.example.com. 
49552 for /root/.spamassassin/auto-whitelist.lock: Permission denied
Apr 13 19:50:53 host spamd[49552]: auto-whitelist: open of auto- 
whitelist file failed: locker: safe_lock: cannot create tmp lockfile / 
root/.spamassassin/auto-whitelist.lock.example.com.49552 for / 
root/.spamassassin/auto-whitelist.lock: Permission denied
Apr 13 19:50:53 host spamd[49552]: bayes: locker: safe_lock: cannot  
create tmp lockfile /root/.spamassassin/bayes.lock.example.com.49552  
for /root/.spamassassin/bayes.lock: Permission denied
Apr 13 19:50:53 host spamd[49552]: spamd: clean message (-1.4/5.0)  
for root:3005 in 0.1 seconds, 736 bytes.
Apr 13 19:50:53 host spamd[49552]: spamd: result: . -1 - ALL_TRUSTED  
scantime=0.1,size=736,user=root,uid=3005,required_score=5.0,rhost=localh 
ost.example.com,raddr=127.0.0.1,rport=1982,mid=[EMAIL PROTECTED]>,autolearn=failed


how can I configure spamd to use another directory for using bayes  
and auto-whitelist database ( in /home/spamassassin/.spamassassin ).  
It works if I change the permissions of /root/.spamassassin but it's  
not optimal.


Thanks for your help.

[no subject]

[Marcos Manhanes]

Hello for all,

My SpamAssassin show me this messages somebody that means it ?

[10272] warn: Argument "n.nn" isn't numeric in addition (+) at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 251.
[10272] warn: Argument "n.nn" isn't numeric in addition (+) at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 251.
[10272] warn: Argument "n.nn" isn't numeric in addition (+) at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 251.
[10272] warn: Argument "n.nn" isn't numeric in addition (+) at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf.pm line 251.

Thanks a lot,
Marcos Manhanes
Sucden do Brasil Ltda
Tel: (5511) 5501-1436
Fax: (5511) 5501-1401
[EMAIL PROTECTED]


--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.375 / Virus Database: 267.15.5/256 - Release Date: 10/2/2006

[no subject]

[Nathaniel Dell]

I want to get a notification if a certain user sends an email to anyone
in our company. I am using spamassassin 2.6. I think this might be accomplished
by running the -l filename, --log-to-mbox=filename command and doing a grep on
the sender’s name in the resulting file, but I am not sure if there is a
more elegant way to accomplish this. 

Help would be greatly appreciated!! 

Thanks

 

 

Re: No Subject, No Body not tagging subject line

[Loren Wilton]

I'm a little confused on what you are reporting here, but I *think* you are
saying:

aYou are using 2.64
bThe mail doesn't have a Subject line
cThe mail is spam
dThe subject isn't getting tagged with [spam].
eYou are using qmail

If that is right, I think the key may be the last item there.  I'm pretty
sure that 2.6x would create a subject line if needed containing the spam
score, even if there wasn't one in the original mail.  (However, maybe this
depends on the report_safe value).  3.0 definitely had a feature where it
would not create a subject line with a score if there was no subject on the
original spam.  This was fixed in 3.0.3 or so.

If you aren't seeing a subject line on blank mails, check to see if
report_safe is encapsulating the spam as an attachment or just modifying the
headers with the spam report.  As an attachment it should definitely be
tagged.  If it isn't, it must be a qmail settings problem, I think.

Loren

No Subject, No Body not tagging subject line

[Matthew Yette]

SA 2.64 w/ qmail-scanner. Messages w/ no subject and no body are being
detected as spam (message header info is normal, some score as  high as
9.1 (threshold @ 5)), but it's not being rejected, and the ones that
should be let through, albeit with a [SPAM] tag on the subject line, are
not being tagged, either. 

Any thoughts?

--
Matthew Yette
Senior Engineer - NOC/Operations
MA Polce Consulting, Inc.
[EMAIL PROTECTED]
315-838-1644 (w)
315-356-0597 (f)
AIM/Yahoo: MAPolceNOC
MSN: [EMAIL PROTECTED]

Re: Test for no Subject line field

[Fred]

Slightly off topic but does Sendmail 8.12 add a subject when one is not
present?

Matt Kettler wrote:
> Russell P. Sutherland wrote:
>
>> Is there a test that one can construct that would
>> assign a weight to a message that is missing
>> a certain header, completely? In my case, no Subject
>> line at all.
>>
>
>  From the default ruleset for 3.x:
>
> header __HAS_SUBJECT   exists:Subject
> meta MISSING_SUBJECT   !__HAS_SUBJECT

Re: Test for no Subject line field

[Matt Kettler]

Russell P. Sutherland wrote:
Is there a test that one can construct that would
assign a weight to a message that is missing
a certain header, completely? In my case, no Subject
line at all.
From the default ruleset for 3.x:
header __HAS_SUBJECT   exists:Subject
meta MISSING_SUBJECT   !__HAS_SUBJECT

Test for no Subject line field

[Russell P. Sutherland]

Is there a test that one can construct that would
assign a weight to a message that is missing
a certain header, completely? In my case, no Subject
line at all.


-- 
Quist ConsultingEmail: [EMAIL PROTECTED]
219 Donlea DriveVoice: +1.416.696.7600
Toronto ON  M4G 2N1 Cell:  +1.416.803.0080
CANADA  WWW:   http://www.quist.ca

Re: No subject header then no tag rewrite

[Andy Jezierski]

"Gary W. Smith" <[EMAIL PROTECTED]>
wrote on 01/17/2005 10:35:24 AM:

> I have been getting a couple blank emails lately and looking into

> the headers I find that itâs clearly marked as spam but the subject

> hasnât been rewritten because it doesnât exist in the header.  Is

> there a way to force SA to put a subject header in if one doesnât
exist?
> I browsed around the archives but everything
on this subject talks 
> about writing rules to mark non-subject headers.

I believe 3.0.2 gets around the problem. From the
wiki for 3.0.2:

- Deal with 'rewrite_header Subject' markup when no
Subject header exists

Andy

No subject header then no tag rewrite

[Gary W. Smith]

Title: No subject header then no tag rewrite






I have been getting a couple blank emails lately and looking into the headers I find that it’s clearly marked as spam but the subject hasn’t been rewritten because it doesn’t exist in the header.  Is there a way to force SA to put a subject header in if one doesn’t exist?

I browsed around the archives but everything on this subject talks about writing rules to mark non-subject headers.

Re: No subject = not spam?

[Marco van den Bovenkamp]

Michael Weber wrote:
Should SA add a subject header if none exists and the message needs to
be marked?
Yes, it should. And in 3.0.2 it does. One of the things fixed in there.
--
Regards,
Marco.

No subject = not spam?

[Michael Weber]

Here's a spam I got that was not flagged as spam.  It looks like SA
recognized it as spam, but because the headers had no subject field, the
subject line markup never happened.

Should SA add a subject header if none exists and the message needs to
be marked?

Merry Christmas!

-Michael



Return-path: <""@snet.net>
Received: from web-2.alliednational.com
([172.16.30.32])
by mail.alliednational.com; Mon, 20 Dec 2004 02:09:20 -0600
Received: (from [EMAIL PROTECTED])
by web-2.alliednational.com (8.11.6/8.11.6) id iBK89KJ20784;
Mon, 20 Dec 2004 02:09:20 -0600
X-Authentication-Warning: web-2.alliednational.com: filter set sender
to ""@snet.net using -f
Received: from pcp09216425pcs.rtchrd01.md.comcast.net (unknown
[172.16.30.253])
by web-2.alliednational.com (Postfix) with SMTP
id 9E795BBF7; Mon, 20 Dec 2004 02:09:19 -0600 (CST)
Message-Id: <[EMAIL PROTECTED]>
Date: Mon, 20 Dec 2004 02:09:19 -0600 (CST)
From: ""@snet.net
To: undisclosed-recipients:;
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on 
web-2.alliednational.com
X-Spam-Report: 
*  0.0 NO_REAL_NAME From: does not include a real name
*  1.4 L_T_COMBINED Addressed to "Undisclosed Recipients" or
equivalent
*  1.3 UNDISC_RECIPS Valid-looking To "undisclosed-recipients"
*  1.9 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
*  [score: 1.]
*  0.3 DNS_FROM_RFC_WHOIS RBL: Envelope sender in
whois.rfc-ignorant.org
*  1.6 DNS_FROM_RFC_POST RBL: Envelope sender in
postmaster.rfc-ignorant.org
*  1.3 BODY_EMPTY BODY_EMPTY
*  1.2 MISSING_SUBJECT Missing Subject: header
X-Spam-Status: Yes, score=9.0 required=5.0 tests=BAYES_99,BODY_EMPTY,
DNS_FROM_RFC_POST,DNS_FROM_RFC_WHOIS,L_T_COMBINED,MISSING_SUBJECT,
NO_REAL_NAME,UNDISC_RECIPS autolearn=no version=3.0.1
X-Spam-Level: *


CONFIDENTIALITY NOTICE:  This communication and any 
attached or enclosed files may contain information 
that is privileged, confidential, proprietary and/or 
otherwise protected from disclosure under applicable 
law ("Confidential Information").  Any review, 
retransmission, publication, dissemination, 
distribution, forwarding, printing, copying, storing, saving 
or other use or disclosure of this communication and/or the 
Confidential Information, or taking any action in reliance 
thereon, by an individual or entity other than the intended 
recipient(s) is strictly prohibited.  

This communication and the Confidential Information are 
intended solely for the use of the individual(s) and/or 
entity(ies) to which this communication is addressed. 
If you are not the intended recipient(s) (or responsible 
for delivery to said recipient(s)), please be advised 
that you have received this communication in error and 
have an obligation to promptly inform the sender by reply 
e-mail or facsimile and to permanently delete, shred or 
otherwise destroy, in its entirety, this original communication 
and all copies thereof, whether in electronic or hard copy format. 

Re: SA 3.0 with no Subject Header on Win32 Platform

[Theo Van Dinter]

On Tue, Sep 28, 2004 at 05:12:32PM -0400, Slava Madrit wrote:
> Basically if you remove the Subject header completely, even though SA 
> recognizes that it's spam, it does not mark up the subject with [SPAM] since 
> there is no Subject.  I tried it with 2.63 and it adds a Subject: header to 
> the message if one was not there. SA 3.0 does not seem to be doing so.  

This is not a bug -- if you have no Subject header, SA can't rewrite it, it
doesn't exist.

http://bugzilla.spamassassin.org/show_bug.cgi?id=3816 currently is tracking
the enhancement request.

-- 
Randomly Generated Tagline:
Pfft.  Now you tell me.
 
-- Homer Simpson, finding out that working at a nuclear
  plant can make one sterile
   I Married Marge


pgpGQVqAvUdSe.pgp
Description: PGP signature

SA 3.0 with no Subject Header on Win32 Platform

[Slava Madrit]

I recently upgraded to 3.0 and it is working better than I could have 
imagined.  I'm having just one minor problem.
 
The problem I am having is if a message comes in without a Subject: header 
and SA recognizes that it is spam, it never marks up the Subject as 
[SPAM].  If you add a subject: header then the markup works fine.  

 
I'm running it on Win32 with Perl 5.6.1 build 638. SA is being called by 
Guinevere 2.0.16, which works in conjunction with GroupWise.  Michael Bell 
recommended I post this issue here.
 
I'm not sure if this is just an SA on win32 problem or an SA issue 
itself.
 
I'm attaching some files if someone wants to run it by themselves 
to see what you get... 
 
Basically if you remove the Subject header completely, even though SA 
recognizes that it's spam, it does not mark up the subject with [SPAM] since 
there is no Subject.  I tried it with 2.63 and it adds a Subject: header to 
the message if one was not there. SA 3.0 does not seem to be doing so.  

 
Can someone else running SA on win32 confirm this and if anyone knows of a 
fix I would greatly appreciate it.
 
Thanks.
 
Slava MadritGlobal Network ManagerS A L A N S[EMAIL PROTECTED]+1.212.632.8311
 
 

_

The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential and/or
privileged material.  Any review, retransmission, dissemination
or other use of, or taking of any action in reliance upon, this
information by persons or entities other than the intended recipient
is prohibited.  If you received this transmission in error, please
contact the sender by reply e-mail or by telephone (+1(212)632-5500)
and delete and destroy all copies of the material, including all
copies stored in the recipient's computer, printed or saved to disk.

MAIL FROM: <[EMAIL PROTECTED]>
RCPT TO: <[EMAIL PROTECTED]>
X-GWIA: Fri, 30 Aug 2002 15:42:16 -0400; NTMURRAY([63.70.92.170])
Received: from NTMURRAY
([63.70.92.170])
by salans.com; Fri, 30 Aug 2002 15:42:16 -0400
Received: from  [202.106.168.178] by [63.70.92.170];
using TFS Secure Messaging on Fri, 30 Aug 2002 15:42:02 -0400
Reply-To: <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
From: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Date: Sat, 31 Aug 2002 02:32:32 -0700
Subject: Mortgage Crap
MiME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
Importance: Normal


    
  


   
  

  
  

  


  
Dear 
Homeowner,ice cream
 
*30 Yr Fixed Rate 
Mortgage

  
Interest 
rates are at their lowest point in 40 years! We help 
you 
find the best rate for your situation by matching your 
needs with hundreds of lenders! Home 
Improvement, 
Refinance, Second Mortgage, Home 
Equity 
Loans, and More! Even with less than perfect 
credit! 

  


  
http://mortgage.optinserver.com/mortgage/index.html?affiliate=bt"; 
target=new_win>Click Here for a Free 
Quote!http://mortgage.optinserver.com/mortgage/index.html?affiliate=bt"; 
target=new_win> 
Lock In YOUR LOW FIXED RATE TODAY

  aNO 
COST 
  OUT OF POCKET 
  aNO 
  OBLIGATION 
  aFREE 
  CONSULTATION 
  aALL 
  CREDIT GRADES ACCEPTED 
http://mortgage.optinserver.com/mortgage/index.html?affiliate=bt";>Rates 
as 
low as this won't stay this low forever CLICK 
HERE
 
* based on 
mortgage rate as of August 2002 see lender 
for details
  
 
  
http://mortgage.optinserver.com/mortgage/index.html?affiliate=bt";>H