Re: [qmailtoaster] SpamAssassin whitelist_from is bypassed sometime

[Eric Shubert]

Kaven Gagnon wrote:

Hi,

I got email addresses listed in whitelist_from still rejected as spam.
This is like a intermittent problem...

The spam reject do not come from blocking lists.

Any idea?

Thanks,
Kaven G.


Need a few more details, Kaven.
What sort of rejection message are you seeing?
What's the full path of "whitelist_from" (spamassassin or spamdyke)?

SA could still reject anything in a SD whitelist. They're totally separate.

--
-Eric 'shubes'


-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: [qmailtoaster] fresh installation - centos5.2

[Eric Shubert]

Marco Cordeiro wrote:
 


Guys , I’m start a fresh installation qmailtoaster (centos5.2)

http://wiki.qmailtoaster.com/index.php/CentOS_5_QmailToaster_Install

 


And I have two doubts :

 

The script for deps at 
http://www.qmailtoaster.com/centos/cnt50/cnt50-deps.sh


 


Have packages not found

 


No package compat-libf2c available.

No package compat-libgcc available.

No package compat-libsdc++-33 available.

 


And the other one http://www.qmailtoaster.com/centos/cnt50/cnt50-perl.sh

 


Still use CPAN instead rpmforge !

if I remember we need use yum to install perl packages.

 


Is there any other new scripts to do a fresh install ???

 


Regards,

 


[]

Marco Cordeiro



I really don't know the status of the install scripts.
Here's what I have on a current COS5 toaster:

$ rpm -qa | grep ^compat
compat-libstdc++-296-2.96-138
compat-glibc-headers-2.3.4-2.26
compat-gcc-34-3.4.6-4
compat-gcc-34-c++-3.4.6-4
compat-glibc-2.3.4-2.26

I do have rpmforge repo enabled on that toaster.

I wouldn't use CPAN, but if you do, be sure not to update CPAN itself. 
Doing so will give you a MakeMaker version (v6.44 IIRC) that doesn't 
work with the present spamassassin-toaster spec file.


--
-Eric 'shubes'


-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

[qmailtoaster] fresh installation - centos5.2

[Marco Cordeiro]

 

Guys , I'm start a fresh installation qmailtoaster (centos5.2)

http://wiki.qmailtoaster.com/index.php/CentOS_5_QmailToaster_Install

 

And I have two doubts :

 

The script for deps at
http://www.qmailtoaster.com/centos/cnt50/cnt50-deps.sh

 

Have packages not found

 

No package compat-libf2c available.

No package compat-libgcc available.

No package compat-libsdc++-33 available.

 

And the other one http://www.qmailtoaster.com/centos/cnt50/cnt50-perl.sh

 

Still use CPAN instead rpmforge ! 

if I remember we need use yum to install perl packages.

 

Is there any other new scripts to do a fresh install ???

 

Regards,

 

[]

Marco Cordeiro

 

 

Re: [qmailtoaster] spamdyke smtp logging bugs

[Sam Clippinger]

I've just released spamdyke 4.0.8, which should fix this issue.  It's 
available from:

   http://www.spamdyke.org/

If you installed spamdyke using the QmailToaster Plus package, you 
should be able to use that package to upgrade.


-- Sam Clippinger

Sam Clippinger wrote:
I don't see anything obviously wrong with your "run" file, but it 
certainly looks like two spamdyke log lines are overlapping for some 
reason.


After going through some source code, I see this is a problem with the 
basic design of DJB's multilog program.  When spamdyke prints logging 
output to stderr, it actually uses three function calls to do it.  The 
first prints "spamdyke[PID]:", the second prints the rest of the log 
text and the third prints a newline character.  If two different 
spamdyke processes print messages at the same time, those three calls 
can become intermixed (a classic race condition).  Because multilog 
only uses one pipe for input, it can't separate input from two 
different processes to keep the messages intact.  It just prints what 
it sees which, in this case, is garbage.


I'll update spamdyke to print its log messages using a single function 
call; that should work around this problem.  This is just one more 
reason not to use multilog, I guess.


Thanks for reporting this!

-- Sam Clippinger

Philip Nix Guru wrote:

Yes the * were added  manually
sorry for the confusion

# cat /var/qmail/supervise/smtp/run
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SPAMDYKE="/usr/local/bin/spamdyke"
SPAMDYKE_CONF="/etc/spamdyke/spamdyke.conf"
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
REQUIRE_AUTH=0

exec /usr/bin/softlimit -m 1200 \
/usr/bin/tcpserver -v -R -h -l $HOSTNAME -x $TCP_CDB -c 
"$MAXSMTPD" \

-u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
$SPAMDYKE --config-file $SPAMDYKE_CONF \
$SMTPD $VCHKPW /bin/true 2>&1

-P

Sam Clippinger wrote:
It looks like spamdyke is being run multiple times for each 
connection -- the two spamdyke PIDs in the logs are different.  What 
does your "run" file look like?


I have no idea where the asterisks came from.  Did you insert those 
manually to highlight the duplicated text?


-- Sam Clippinger

Philip Nix Guru wrote:

Hello
I was playing with a spamdyke-stats.pl script I saw, trying to 
update it to work with the qtoaster setup

and I was getting some strange results .. so I checked the logs
and found that that I had a few spamdyke[###]:spamdyke[] in my 
smtp log file


example : (I converted TAI64N timestamps for better readings)

2008-11-03 23:51:28.405450500 spamdyke[26362]: DENIED_RBL_MATCH 
from: [EMAIL PROTECTED] to: 
[EMAIL PROTECTED] origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: (unknown)
2008-11-03 23:51:28.446391500 *spamdyke[26365]: spamdyke[26362]*: 
DENIED_RBL_MATCH from: [EMAIL PROTECTED] to: 
[EMAIL PROTECTED] origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: 
(unknown)DENIED_RBL_MATCH from: 
[EMAIL PROTECTED] to: [EMAIL PROTECTED] 
origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: (unknown)
2008-11-03 23:51:28.488134500 *spamdyke[26365]: spamdyke[26362]*: 
DENIED_RBL_MATCH from: [EMAIL PROTECTED] to: 
[EMAIL PROTECTED] origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: 
(unknown)DENIED_RBL_MATCH from: 
[EMAIL PROTECTED] to: [EMAIL PROTECTED] 
origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: (unknown)
2008-11-03 23:51:28.536631500 *spamdyke[26365]: spamdyke[26362]*: 
DENIED_RBL_MATCH from: 
[EMAIL PROTECTED] to: [EMAIL PROTECTED] 
origin_ip: 86.2.231.197 origin_rdns: 
cpc2-hudd10-0-0-cust964.hudd.cable.ntl.com auth: (unknown)


It seems to happen when you have multiple emails reaching different 
users on the same domain





-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: 
[EMAIL PROTECTED]




-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: 
[EMAIL PROTECTED]




-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



-
QmailToaster hosted by: VR Hoste

Re: [qmailtoaster] SpamAssassin whitelist_from is bypassed sometime

[Kaven Gagnon]

Hi Eric,

@4000490aec170a635ed4 CHKUSER accepted rcpt: from
<[EMAIL PROTECTED]::> remote
 rcpt
<[EMAIL PROTECTED]> : found existing recipient
@4000490aec172428011c simscan:[24762]:SPAM REJECT
(6.10/3.95):0.4125s:***SPAM***
:209.226.175.105:[EMAIL PROTECTED]:[EMAIL PROTECTED]:
@4000490aec17242814a4 qmail-smtpd: qq hard reject (Your email is
considered spam (6.10 spam-hits)): MAILFROM:<[EMAIL PROTECTED]>
RCPTTO:[EMAIL PROTECTED]

I do not use SpamDyke.

Thanks,
Kaven G.

> Kaven Gagnon wrote:
>> Hi,
>>
>> I got email addresses listed in whitelist_from still rejected as spam.
>> This is like a intermittent problem...
>>
>> The spam reject do not come from blocking lists.
>>
>> Any idea?
>>
>> Thanks,
>> Kaven G.
>>
> Need a few more details, Kaven.
> What sort of rejection message are you seeing?
> What's the full path of "whitelist_from" (spamassassin or spamdyke)?
>
> SA could still reject anything in a SD whitelist. They're totally
> separate.
>
> --
> -Eric 'shubes'
>
>
> -
>  QmailToaster hosted by: VR Hosted 
> -
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>
>



-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: [qmailtoaster] SpamAssassin whitelist_from is bypassed sometime

[David Good]

Kaven Gagnon wrote:

Hi Eric,

@4000490aec170a635ed4 CHKUSER accepted rcpt: from
<[EMAIL PROTECTED]::> remote
 rcpt
<[EMAIL PROTECTED]> : found existing recipient
@4000490aec172428011c simscan:[24762]:SPAM REJECT
(6.10/3.95):0.4125s:***SPAM***
:209.226.175.105:[EMAIL PROTECTED]:[EMAIL PROTECTED]:
@4000490aec17242814a4 qmail-smtpd: qq hard reject (Your email is
considered spam (6.10 spam-hits)): MAILFROM:<[EMAIL PROTECTED]>
RCPTTO:[EMAIL PROTECTED]

I do not use SpamDyke.

Thanks,
Kaven G.

  

Kaven Gagnon wrote:


Hi,

I got email addresses listed in whitelist_from still rejected as spam.
This is like a intermittent problem...

The spam reject do not come from blocking lists.

Any idea?

Thanks,
Kaven G.

  

Need a few more details, Kaven.
What sort of rejection message are you seeing?
What's the full path of "whitelist_from" (spamassassin or spamdyke)?

SA could still reject anything in a SD whitelist. They're totally
separate.

--
-Eric 'shubes'



your situation:
1) you get emails marked as spam from spamassassin, randomly, presumably 
from a regular correspondent. or you randomly do not receive mail from same.

2) you do not use spamdyke.
3) you do not want those emails tagged as spam or have them rejected.

my observation:
your spam hits value has been lowered from the default 12 in the stock 
toaster down to something less than or equal to 6 which may be a bit too 
tight. (your header shows a hard reject for a 6.1 value)
remember that marking is controlled by the local.cf  (mark at 5) and the 
hard reject is controlled by the simcontrol file (mine is still at 12).


solution:
1) you can either raise the spam hits value and probably allow more spam 
in for everybody on your toaster.

2) you can whitelist a specific email address or domain.

if you want to whitelist, see 
http://wiki.apache.org/spamassassin/ManualWhitelist
the 'whitelist_from [EMAIL PROTECTED]' works for me 100% of the time for 
companies we deal with.
don't forget to restart SA to reload using the newly edited config 
file...if you use the qmail-toaster plus package, you can 'qmail-spam 
restart' as root.


does that help?

--
fuzzy 



-
QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Re: [qmailtoaster] SpamAssassin whitelist_from is bypassed sometime

[Kent Busbee]

See response below; Kaven Gagnon wrote:
> Hi Eric,
>
> @4000490aec170a635ed4 CHKUSER accepted rcpt: from
> <[EMAIL PROTECTED]::> remote
>  rcpt
> <[EMAIL PROTECTED]> : found existing recipient
> @4000490aec172428011c simscan:[24762]:SPAM REJECT
> (6.10/3.95):0.4125s:***SPAM***
> :209.226.175.105:[EMAIL PROTECTED]:[EMAIL PROTECTED]:
> @4000490aec17242814a4 qmail-smtpd: qq hard reject (Your email is
> considered spam (6.10 spam-hits)): MAILFROM:<[EMAIL PROTECTED]>
> RCPTTO:[EMAIL PROTECTED]
>
> I do not use SpamDyke.
>
> Thanks,
> Kaven G.
>
>> Kaven Gagnon wrote:
>>> Hi,
>>>
>>> I got email addresses listed in whitelist_from still rejected as spam.
>>> This is like a intermittent problem...
>>>
>>> The spam reject do not come from blocking lists.
>>>
>>> Any idea?
>>>
>>> Thanks,
>>> Kaven G.
>>>
>> Need a few more details, Kaven.
>> What sort of rejection message are you seeing?
>> What's the full path of "whitelist_from" (spamassassin or spamdyke)?
>>
>> SA could still reject anything in a SD whitelist. They're totally
>> separate.
>>
>> --
>> -Eric 'shubes'
>>
>>
>> -
>>  QmailToaster hosted by: VR Hosted 
>> -
>> To unsubscribe, e-mail: [EMAIL PROTECTED]
>> For additional commands, e-mail: [EMAIL PROTECTED]
>>
>>
>
>
>
> -
>  QmailToaster hosted by: VR Hosted 
> -
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>
>

Take a look at qmlog spamd, this should give more info as to why it was
rejected, and tell if it hit the whitelist.  I also would check the format
or your whitelist command in your .cf file.  Which file do you use and
where is it?

Kent Busbee
Director of Technology
Northlake Christian School


-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

RE: [qmailtoaster] SpamAssassin whitelist_from is bypassed sometime

[Josh Hopkins]

They have changed the formatting on the whitelist variable.  It is was
whitelist_from now it is def_whitelist_from_rcvd or def_whitelist_from.
Once I changed mine it worked just fine.

-Original Message-
From: Kent Busbee [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, November 05, 2008 12:21 PM
To: qmailtoaster-list@qmailtoaster.com
Subject: Re: [qmailtoaster] SpamAssassin whitelist_from is bypassed
sometime


See response below; Kaven Gagnon wrote:
> Hi Eric,
>
> @4000490aec170a635ed4 CHKUSER accepted rcpt: from
> <[EMAIL PROTECTED]::> remote
>  rcpt
> <[EMAIL PROTECTED]> : found existing recipient
> @4000490aec172428011c simscan:[24762]:SPAM REJECT
> (6.10/3.95):0.4125s:***SPAM***
> :209.226.175.105:[EMAIL PROTECTED]:[EMAIL PROTECTED]:
> @4000490aec17242814a4 qmail-smtpd: qq hard reject (Your email is
> considered spam (6.10 spam-hits)): MAILFROM:<[EMAIL PROTECTED]>
> RCPTTO:[EMAIL PROTECTED]
>
> I do not use SpamDyke.
>
> Thanks,
> Kaven G.
>
>> Kaven Gagnon wrote:
>>> Hi,
>>>
>>> I got email addresses listed in whitelist_from still rejected as
spam.
>>> This is like a intermittent problem...
>>>
>>> The spam reject do not come from blocking lists.
>>>
>>> Any idea?
>>>
>>> Thanks,
>>> Kaven G.
>>>
>> Need a few more details, Kaven.
>> What sort of rejection message are you seeing?
>> What's the full path of "whitelist_from" (spamassassin or spamdyke)?
>>
>> SA could still reject anything in a SD whitelist. They're totally
>> separate.
>>
>> --
>> -Eric 'shubes'
>>
>>
>> -
>>  QmailToaster hosted by: VR Hosted 
>> -
>> To unsubscribe, e-mail:
[EMAIL PROTECTED]
>> For additional commands, e-mail:
[EMAIL PROTECTED]
>>
>>
>
>
>
> -
>  QmailToaster hosted by: VR Hosted 
> -
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail:
[EMAIL PROTECTED]
>
>

Take a look at qmlog spamd, this should give more info as to why it was
rejected, and tell if it hit the whitelist.  I also would check the
format
or your whitelist command in your .cf file.  Which file do you use and
where is it?

Kent Busbee
Director of Technology
Northlake Christian School


-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

[qmailtoaster] multilog rotate

[slamp slamp]

is there a way to rotate the multilogs daily? i see it for size but
not for daily.

-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

[qmailtoaster] Debian?

[Kevin Qiu]

Hi List,
I just installed Debian on my new server. Could QMT install on Debian?
-- 


  Regards,
  Kevin Qiu
  SA
  Beijing
  Foxit Software Company



-
 QmailToaster hosted by: VR Hosted 
-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]