Re[6]: after upgrade

[Marcos Saint'Anna]

Hello Loren,

Seems to be working now... I think you're right.

This is the command line I'm using now:

/usr/bin/spamd -d -m 10 -v -u vpopmail --max-conn-per-child=1 \
-r /var/run/spamd/spamd.pid --siteconfigpath=/etc/mail/spamassassin \
--configpath=/usr/share/spamassassin -s /var/log/spamd.log

Is this a bug?

Is there any kind of impact or any problem to the system if I use this
parameter --max-conn-per-child=1 till a solution be found ?

Once again, THANKS INDEED for your time also for your patience. :)

BTW: Thanks to trying understand my english! :D

Best regards
-- 
 Marcos Saint'Anna
 [EMAIL PROTECTED]

You wrote:

 Is  it  possible  that  SA is making some mess with user_prefs, making
 some personal whitelists / blacklists to global ?

LW There seem to be some occurances of spamd picking up bits of user
LW preferences from the wrong places.  This may or may not be related.  But if
LW any of your users to have whitelists, then this might be a possibility.

LW As an experiment, try setting the max uses for the child to 1, and see if
LW the problem goes away.  If it does, that would indicate that SA is indeed
LW mixing up whitelist info between users.

LW Loren

after upgrade

[Marcos Saint'Anna]

Hello guys,

I'm with a serious problem here, and I need some help, plz!

After  the  upgrade  from version 2.64 to version 3.0.0, SA stopped to
work  as before... the most of SPAM going to my server isn't marked as
SPAM... So I noticed that almost all headers had a USER_IN_WHITELIST
in it.

---
X-Spam-Status: No, hits=-88.6 required=5.0 tests=BR_RECEIVED_SPAMMER,
FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,HTML_FONT_BIG,HTML_MESSAGE,
HTML_TAG_EXIST_TBODY,INVALID_DATE,MIME_BASE64_TEXT,
MIME_BOUND_NEXTPART,MIME_HTML_ONLY,PLING_PLING,USER_IN_WHITELIST 
autolearn=no version=3.0.0
---

I've  checked  every  configuration  file  as  so user_prefs files and
didn't found any whitelist entry.

I'm using SA 3.0.0 with Qmail-scanner 1.23.

This is the command line I'm using:
spamd -d -v -u vpopmail -s /var/log/spamd.log

Thanks in advance!
  

Best regards
-- 
 Marcos Saint'Anna
 [EMAIL PROTECTED]

Re[2]: after upgrade

[Marcos Saint'Anna]

Hello Matt,

Thanks for your prompt reply.

I've removed all whitelist_from entries from configuration files, even
those from user_prefs files.

I've  already  tried  to  run  SA with -D option, but got no answer at
all...

This  start  happening  just  after the upgrade. Please note that I've
read  several times the INSTALL and UPGRADE instructions before do the
upgrade...

Best regards
-- 
 Marcos Saint'Anna
 [EMAIL PROTECTED]

You wrote:

MK At 08:42 PM 10/9/2004 -0300, Marcos Saint'Anna wrote:
SPAM... So I noticed that almost all headers had a USER_IN_WHITELIST
in it.

---
X-Spam-Status: No, hits=-88.6 required=5.0 tests=BR_RECEIVED_SPAMMER,

 FORGED_MUA_OUTLOOK,FORGED_OUTLOOK_HTML,HTML_FONT_BIG,HTML_MESSAGE,
 HTML_TAG_EXIST_TBODY,INVALID_DATE,MIME_BASE64_TEXT,

 MIME_BOUND_NEXTPART,MIME_HTML_ONLY,PLING_PLING,USER_IN_WHITELIST
 autolearn=no version=3.0.0
---

I've  checked  every  configuration  file  as  so user_prefs files and
didn't found any whitelist entry.

MK Did you find *any* whitelist statements at all?

MK Also be sure to scrutinize ALL the message headers when trying to check
MK which statement is at fault.

MK SA's whitelisting system honors more than just From: in whitelist_from*. It
MK honors Return-Path, Sender, Resent-From and more-or-less any origin
MK indicating header. 

Re[2]: SA 3.0 - USER_IN_BLACKLIST false positive?

[Marcos Saint'Anna]

Hello Mike,

Almost  the  same  thing here... but it's the USER_IN_WHITELIST that's
making me nuts.

My  configuration files have no whitelist_from... but in the detection
description the USER_IN_WHITELIST is always there...


Best regards
-- 
 Marcos Saint'Anna
 [EMAIL PROTECTED]

You wrote:

MZ On 09 October 2004 18:40 -0400 Theo Van Dinter [EMAIL PROTECTED]
MZ wrote:

 Got me, you have to go hunting around and find out.  I have no way to
 tell you what's on your box, but I can tell you the entries aren't
 from SpamAssassin itself. ;)

MZ I believe that it is a bug in SA 3.0. This is a fresh installation of
MZ SA, no blacklists have been created and the e-mail address was 
MZ previously unknown.

MZ Having searched back through the archives there are a couple of other
MZ reports of this 'phenomenon'.

MZ Mike.

Re[2]: after upgrade

[Marcos Saint'Anna]

 the configuration files:

[...]
debug: using /usr/share/spamassassin for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: config: read file /usr/share/spamassassin/regression_tests.cf
debug: using /etc/mail/spamassassin for site rules dir
debug: config: read file /etc/mail/spamassassin/10_local_report.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using /root/.spamassassin for user state dir
debug: using .spamassassin/user_prefs for user prefs file
debug: config: read file .spamassassin/user_prefs
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8a76a4c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8a4e5f0)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) implements 
'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8a76a4c) implements 
'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84bbca4) inhibited 
further callbacks
[...]

---

The same message as above, with different results:

X-Spam-Status: Yes, hits=16.5 required=5.0 bayes=1. awl=0.0
tests=BAYES_99=1.886,BILL_1618=1.895,BR_ADJUST_2=2,BR_CONGRESSO=3,
BR_MALADIRETA=0.2,BR_REMOVER_QUOTE=0.8,BR_SPAMMER_URI=2,
DRUGS_SLEEP=0.001,FORGED_MUA_OUTLOOK=3.92,FORGED_OUTLOOK_HTML=0.629,
HTML_MESSAGE=0.001,HTML_SHOUTING3=0.019,MIME_HTML_ONLY=0.177,
MISSING_MIMEOLE=0.012 autolearn=unavailable 
version=3.0.0

---

As  you  may  see...  the  configuration  files are the same, also the
binaries are using the same version.

I really don't know whats going on... :(

Thanks in advance for your time.


Best regards
-- 
 Marcos Saint'Anna
 [EMAIL PROTECTED]

You wrote:

KS Marcos Saint'Anna wrote on Sun, 10 Oct 2004 02:18:19 -0300:

 I've  already  tried  to  run  SA with -D option, but got no answer at
 all...


KS So, if you pipe one of those messages with USER_IN_WHITELIST thru 
KS spamassassin -D (not spamd!) it is *not* marked with USER_IN_WHITELIST? If
KS so, I'd think your spamd is using a different configuration than you think
KS or you may have some version mix. Did you run a make test before
KS install?


KS Kai