SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?
Hi everyone,
I've taken over a mail server from a previous technician and he's
modified qmail to call spamassassin and the problem is I make changes to
local.cf but I don't think they get used.
Reasoning is that mail.info shoes it saying that required score is 5.0
but I've changed this to 4.5
spamassassin --lint -D will say that 4.5 is required:
[21280] dbg: rules: running full-text regexp tests; score so far=1.046
[21280] dbg: check: is spam? score=1.046 required=4.5
[21280] dbg: check:
tests=BAYES_05,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE
[21280] dbg: check:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,_
_SANE_MSGID,__UNUSABLE_MSGID
/var/log/mail.info shows the following:
Feb 13 11:26:53 nibbler spamd[14048]: spamd: connection from localhost
[127.0.0.1] at port 44594
Feb 13 11:26:53 nibbler spamd[14048]: spamd: checking message
[EMAIL PROTECTED] for
[EMAIL PROTECTED]:1005
Feb 13 11:26:57 nibbler spamd[14048]: spamd: clean message (-2.6/5.0)
for [EMAIL PROTECTED]:1005 in 3.6 seconds, 1510 bytes.
Feb 13 11:26:57 nibbler spamd[14048]: spamd: result: . -2 - BAYES_00
scantime=3.6,size=1510,[EMAIL PROTECTED],uid=1005,required_sc
ore=5.0,rhost=localhost,raddr=127.0.0.1,rport=44594,mid=B001CE0E4EE3A94
[EMAIL PROTECTED],bayes=0,autolearn=ham
Feb 13 11:26:57 nibbler spamd[887]: prefork: child states: II
Feb 13 11:26:57 nibbler qmail: 1171319217.234315 new msg 586816
Feb 13 11:26:57 nibbler qmail: 1171319217.234479 info msg 586816: bytes
1849 from qp 21157 uid 1008
Feb 13 11:26:57 nibbler qmail-scanner[21149]:
Clear:RC:0(210.54.125.66):SA:0(-2.6/5.0): 3.692409 1492
[EMAIL PROTECTED]
Out_of_Office_AutoReply:_Booking_for_Kaye_Parker_-_Cure_Kids
[EMAIL PROTECTED]
1171319213.21151-0.nibbler:851 orig-nibbler117131921354621149:1492
Feb 13 11:26:57 nibbler qmail: 1171319217.342141 starting delivery
24523: msg 586816 to remote [EMAIL PROTECTED]
Feb 13 11:26:57 nibbler qmail: 1171319217.342316 status: local 0/10
remote 1/20
Feb 13 11:26:58 nibbler qmail: 1171319218.000917 delivery 24523:
success:
222.154.228.91_accepted_message./Remote_host_said:_250_2.6.0__B001CE0E4
[EMAIL PROTECTED]_Queued_mail_for_del
ivery/
Feb 13 11:26:58 nibbler qmail: 1171319218.001407 status: local 0/10
remote 0/20
Feb 13 11:26:58 nibbler qmail: 1171319218.001527 end msg 586816
Feb 13 11:27:50 nibbler qmail: 1171319270.425995 new msg 586816
Feb 13 11:27:50 nibbler qmail: 1171319270.426170 info msg 586816: bytes
3960222 from [EMAIL PROTECTED] qp 21175 uid 1008
Feb 13 11:27:50 nibbler qmail-scanner[21166]:
Clear:RC:0(219.88.242.4):SA:0(?/?): 22.80491 3959889
[EMAIL PROTECTED] [EMAIL PROTECTED]
FW:_Phone_call_at_the_club [EMAIL PROTECTED]
1171319268.21170-0.nibbler:270 1171319268.21170-1.nibbler:4810
3357.wmv:2926143 orig-nibbler117131924654621166:3959889
Feb 13 11:27:50 nibbler qmail: 1171319270.562702 starting delivery
24524: msg 586816 to local [EMAIL PROTECTED]
Feb 13 11:27:50 nibbler qmail: 1171319270.562879 status: local 1/10
remote 0/20
Feb 13 11:27:50 nibbler qmail: 1171319270.631623 delivery 24524:
success: did_0+0+1/
Feb 13 11:27:50 nibbler qmail: 1171319270.632040 status: local 0/10
remote 0/20
Feb 13 11:27:50 nibbler qmail: 1171319270.632160 end msg 586816
Qmail-scanner-queue.pl appears to have the following for spamassassin
(I'm unsure how much this has been edited by the previous technician)
my $spamc_binary='/usr/bin/spamc';
my $spamc_options=' -c ';
my $spamc_subject='';
my $spamassassin_binary='/usr/bin/spamassassin';
my ($sa_comment,$sa_level);
my $sa_symbol='+';
sub spamassassin {
#Only run SA if mail is from a remote SMTP client, or
QS_SPAMASSASSIN
#is defined via tcpserver...
if (defined($ENV{'RELAYCLIENT'}) !defined($ENV{'QS_SPAMASSASSIN'}))
{
debug(spamassassin: don't scan as RELAYCLIENT implies this was
sent by a local user);
return;
}
#SpamAssassin client scanner
my ($spamassassin_found,$spamassassin_status);
my ($start_spamassassin_time)=[gettimeofday];
my
($sa_tag,$DD,$stop_spamassassin_time,$spamassassin_time,$cmdline_recip,$
sa_fast);
my ($sa_status)=0;
my ($sa_score)=0; my ($sa_max)=0;
if ($msg_size 25) {
debug(spamassassin: message too big - skip it);
$sa_score=$sa_max=?;
$tag_score .= SA:0($sa_score/$sa_max):;
$sa_comment = No, hits=$sa_score required=$sa_max if ($sa_fast);
return;
}
#Cleanup $one_recip so it's usable from the commandline...
#any char that isn't supported to changed into an '_'
($cmdline_recip=$one_recip)=~s/[EMAIL PROTECTED]/_/gi;
$cmdline_recip=~/^([EMAIL PROTECTED])$/i;
$cmdline_recip=tolower($1);
$sa_fast=1 if ($spamc_options =~ /\-c /);
$spamc_options=$spamc_options -u \$cmdline_recip\ if
($cmdline_recip ne );
debug(SA: run $spamc_binary $spamc_options
$scandir/$wmaildir/new/$file_id);
open(SIN,$scandir/$wmaildir/new/$file_id)||error_condition(cannot
open
Re: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?
On Tue, Feb 13, 2007 at 11:42:22AM +1300, Philip Seccombe wrote: Hi everyone, I've taken over a mail server from a previous technician and he's modified qmail to call spamassassin and the problem is I make changes to local.cf but I don't think they get used. Reasoning is that mail.info shoes it saying that required score is 5.0 but I've changed this to 4.5 spamassassin --lint -D will say that 4.5 is required: [21280] dbg: rules: running full-text regexp tests; score so far=1.046 [21280] dbg: check: is spam? score=1.046 required=4.5 [21280] dbg: check: tests=BAYES_05,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE [21280] dbg: check: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,_ _SANE_MSGID,__UNUSABLE_MSGID /var/log/mail.info shows the following: Feb 13 11:26:53 nibbler spamd[14048]: spamd: connection from localhost [127.0.0.1] at port 44594 Umm, did you restart spamd? remainder snipped Does anyone have any idea what on earth is going on here? I'm not a huge linux guru so I'm a little confused, qmail appears to download the message, check if it is a virus, then call spamc and check if it is spam, if it is then it puts it on a pop mailbox on the server else it forwards the message onto the customers mail server Appologies on the huge email, I wanted to give as much detail as I could Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email: [EMAIL PROTECTED] Web: www.turnstone.co.nz Cheers, -- Bob McClure, Jr. Bobcat Open Systems, Inc. [EMAIL PROTECTED] http://www.bobcatos.com This day I call heaven and earth as witnesses against you that I have set before you life and death, blessings and curses. Now choose life, so that you and your children may live. Deuteronomy 30:19 (NIV)
RE: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?
Nope, haven't restarted anything recently, I have since changing rules though qmail just runs spamc as a command line to the email message and gets its response afaik -Original Message- From: Bob McClure Jr [mailto:[EMAIL PROTECTED] Sent: Tue 2/13/2007 12:29 PM To: users@spamassassin.apache.org Subject: Re: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc? On Tue, Feb 13, 2007 at 11:42:22AM +1300, Philip Seccombe wrote: Hi everyone, I've taken over a mail server from a previous technician and he's modified qmail to call spamassassin and the problem is I make changes to local.cf but I don't think they get used. Reasoning is that mail.info shoes it saying that required score is 5.0 but I've changed this to 4.5 spamassassin --lint -D will say that 4.5 is required: [21280] dbg: rules: running full-text regexp tests; score so far=1.046 [21280] dbg: check: is spam? score=1.046 required=4.5 [21280] dbg: check: tests=BAYES_05,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE [21280] dbg: check: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,_ _SANE_MSGID,__UNUSABLE_MSGID /var/log/mail.info shows the following: Feb 13 11:26:53 nibbler spamd[14048]: spamd: connection from localhost [127.0.0.1] at port 44594 Umm, did you restart spamd? remainder snipped Does anyone have any idea what on earth is going on here? I'm not a huge linux guru so I'm a little confused, qmail appears to download the message, check if it is a virus, then call spamc and check if it is spam, if it is then it puts it on a pop mailbox on the server else it forwards the message onto the customers mail server Appologies on the huge email, I wanted to give as much detail as I could Kind Regards, Philip Seccombe Turnstone Technologies NZ Limited Phone: +64 9 970 5550 Fax: +64 9 970 5559 DDI: +64 9 970 5552 Email: [EMAIL PROTECTED] Web: www.turnstone.co.nz Cheers, -- Bob McClure, Jr. Bobcat Open Systems, Inc. [EMAIL PROTECTED] http://www.bobcatos.com This day I call heaven and earth as witnesses against you that I have set before you life and death, blessings and curses. Now choose life, so that you and your children may live. Deuteronomy 30:19 (NIV)
RE: SpamAssassin using spamc but not using rules correctly? Is my time being wasted changing local.cf etc?
On Tue, 13 Feb 2007, Philip Seccombe wrote: qmail just runs spamc as a command line to the email message and gets its response afaik Yes, but spamc is just a lightweight client. The daemon (spamd) is what interprets the rules, and what must be restarted when the rules are changed. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 --- You are in a maze of twisty little protocols, all written by Microsoft. -- Today: Abraham Lincoln's and Charles Darwin's 198th Birthdays
