Re: configure question

2015-01-18 Thread Michael Williamson
I think you are right.
Running spamassassin manually appears to use the user's "user_prefs"
configuration file, and bayes database. I need to get amavisd to do it
that way too, if possible.


On 1/18/15, John Hardin  wrote:
> On Sun, 18 Jan 2015, Michael Williamson wrote:
>
>> Here is an example of the automatically inserted spam headers:
>>
>> Return-Path: 
>> X-Spam-Status:
>>tests=[BAYES_00=-1.9
>
>>
>> And here, I ran the same email through spamassassin manually from the
>> command line:
>>
>> X-Spam-Report:
>>  *  3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
>
> That is either due to training that message reclassified it as spam, or
> you are manually training a different bayes database than amavis is using.
>
> --
>   John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
>   jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
>   key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
> ---
>Rights can only ever be individual, which means that you cannot
>gain a right by joining a mob, no matter how shiny the issued
>badges are, or how many of your neighbors are part of it.  -- Marko
> ---
>   5 days until John Moses Browning's 160th Birthday
>


Re: configure question

2015-01-18 Thread John Hardin

On Sun, 18 Jan 2015, Michael Williamson wrote:


Here is an example of the automatically inserted spam headers:

Return-Path: 
X-Spam-Status:
   tests=[BAYES_00=-1.9




And here, I ran the same email through spamassassin manually from the
command line:

X-Spam-Report:
*  3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%


That is either due to training that message reclassified it as spam, or 
you are manually training a different bayes database than amavis is using.


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  Rights can only ever be individual, which means that you cannot
  gain a right by joining a mob, no matter how shiny the issued
  badges are, or how many of your neighbors are part of it.  -- Marko
---
 5 days until John Moses Browning's 160th Birthday


Re: configure question

2015-01-18 Thread Michael Williamson
OK, thanks. I will read the amavisd FAQ.

However, I am skeptical about your explanation for the spam score difference.

Here is an example of the automatically inserted spam headers:

Return-Path: 
...
X-Spam-Flag: NO
X-Spam-Score: -1.106
X-Spam-Level:
X-Spam-Status: No, score=-1.106 tagged_above=-999 required=5
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793,
SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001] autolearn=no

And here, I ran the same email through spamassassin manually from the
command line:

 # spamassassin -t < spam_filename

Return-Path: 
X-Spam-Report:
*  100 USER_IN_BLACKLIST From: address is in the user's black-list
*  3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
*  [score: 1.]
*  3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
*  [5.178.109.37 listed in zen.spamhaus.org]
*  1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
*  [URIs: acant.firm.in]
*  2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
*  [URIs: acant.firm.in]
*  1.2 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
*  [URIs: acant.firm.in]
*  0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
*  [score: 1.]
*  0.0 HTML_MESSAGE BODY: HTML included in message
*  0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
*  0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay 
lines
X-Spam-Flag: YES
X-Spam-Status: Yes, score=113.3 required=4.0 tests=BAYES_99,BAYES_999,
HTML_MESSAGE,RCVD_IN_SBL_CSS,RDNS_NONE,UNPARSEABLE_RELAY,URIBL_BLACK,
URIBL_DBL_SPAM,URIBL_JP_SURBL,USER_IN_BLACKLIST autolearn=no 
version=3.3.1
X-Spam-Level: **




On 1/18/15, RW  wrote:
> On Sun, 18 Jan 2015 09:06:00 -0700
> Michael Williamson wrote:
>
>> Yes, amavisd is running and modifying the file
>> "/etc/amavisd/amavisd.conf" has an effect on the spamassassin header
>> messages added to emails. Thanks, that answers that question.
>
> Amavisd uses SA as a library, you don't need to be running spamd.
>
> "service spamassassin restart" affect's neither amavisd nor the the
> spamassassin script, only tests done through spamc/spamd.
>
> You should read the Amavisd FAQ.
>
>> Now, the next question is, if I manually run
>>
>>  # spamassassin -t < spam_filename
>>
>> I get a different, much higher spam score than is automatically
>> inserted in the X-Spam-Score
>> field. Note that, for this user, this has been done:
>
> You expect to get a higher score the second time. You've trained it as
> spam, and the delay causes it to hit more network test.
>


Re: configure question

2015-01-18 Thread RW
On Sun, 18 Jan 2015 09:06:00 -0700
Michael Williamson wrote:

> Yes, amavisd is running and modifying the file
> "/etc/amavisd/amavisd.conf" has an effect on the spamassassin header
> messages added to emails. Thanks, that answers that question.

Amavisd uses SA as a library, you don't need to be running spamd.  

"service spamassassin restart" affect's neither amavisd nor the the
spamassassin script, only tests done through spamc/spamd.

You should read the Amavisd FAQ.

> Now, the next question is, if I manually run
> 
>  # spamassassin -t < spam_filename
> 
> I get a different, much higher spam score than is automatically
> inserted in the X-Spam-Score
> field. Note that, for this user, this has been done:

You expect to get a higher score the second time. You've trained it as
spam, and the delay causes it to hit more network test.


Re: configure question

2015-01-18 Thread Michael Williamson
Yes, amavisd is running and modifying the file
"/etc/amavisd/amavisd.conf" has an effect on the spamassassin header
messages added to emails. Thanks, that answers that question.

Now, the next question is, if I manually run

 # spamassassin -t < spam_filename

I get a different, much higher spam score than is automatically
inserted in the X-Spam-Score
field. Note that, for this user, this has been done:

 # sa-learn --spam .Spam/cur/*



On 1/18/15, Marieke Janssen  wrote:
>>Spamassassin seems not to be getting the configuration changes that I
>> make.
>
> Is it possible you run something like Amavis that controls SpamAssassin?
> Headers and spamscore are usual controlled there and will override
> local.cf.
>
> /MJ
>
>


Re: Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping: Jan 17 08:00:12.091 [2891] warn: (Insecure dependency in require while running with -T switch at (eval 1037) line 9

2015-01-18 Thread Kevin A. McGrail

On 1/18/2015 7:18 AM, mls wrote:

I am seeing more and more emails that cause the following PERL warnings when
scanned with spamassassin
Based on a quick search, this page leads me to believe it's fixed in a 
newer version of SA:


https://bugzilla.redhat.com/show_bug.cgi?id=1141695

Regards,
KAM


Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping: Jan 17 08:00:12.091 [2891] warn: (Insecure dependency in require while running with -T switch at (eval 1037) line 9

2015-01-18 Thread mls
Hi,

I am seeing more and more emails that cause the following PERL warnings when 
scanned with spamassassin

Jan 17 08:00:12.091 [2891] warn: rules: failed to compile 
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping:
Jan 17 08:00:12.091 [2891] warn:  (Insecure dependency in require while 
running with -T switch at (eval 1037) line 9.
Jan 17 08:00:12.091 [2891] warn: BEGIN failed--compilation aborted at (eval 
1037) line 9.)
Jan 17 08:00:12.118 [2891] warn: rules: failed to compile 
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping:
Jan 17 08:00:12.118 [2891] warn:  (Insecure dependency in require while 
running with -T switch at (eval 1038) line 9.
Jan 17 08:00:12.118 [2891] warn: BEGIN failed--compilation aborted at (eval 
1038) line 9.)
Jan 17 08:00:12.142 [2891] warn: rules: failed to compile 
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping:
Jan 17 08:00:12.143 [2891] warn:  (Insecure dependency in require while 
running with -T switch at (eval 1039) line 9.
Jan 17 08:00:12.143 [2891] warn: BEGIN failed--compilation aborted at (eval 
1039) line 9.)
Jan 17 08:00:12.163 [2891] warn: rules: failed to compile 
Mail::SpamAssassin::Plugin::Check::_head_tests_0_1, skipping:
Jan 17 08:00:12.164 [2891] warn:  (Insecure dependency in require while 
running with -T switch at (eval 1040) line 9.
Jan 17 08:00:12.164 [2891] warn: BEGIN failed--compilation aborted at (eval 
1040) line 9.)
Jan 17 08:00:12.237 [2891] warn: plugin: eval failed: Timeout::_run: Insecure 
dependency in eval while running with -T switch at 
/usr/share/perl5/Mail/SpamAssassin/PerMsgStatus.pm line 2436.)

Is there a mitigation for this issue? I am retrieving mails with getmail and 
the delivery is done by maildrop. In a maildrop filter I am calling SA that due 
to the warnings above does not terminate with an exit code of 0. maildrop 
returns back an error to getmail that then stops retrieving emails .

Thanks & regards,

mls


RE: configure question

2015-01-18 Thread Marieke Janssen
>Spamassassin seems not to be getting the configuration changes that I make.

Is it possible you run something like Amavis that controls SpamAssassin? 
Headers and spamscore are usual controlled there and will override local.cf.

/MJ