I'm having a problem after having upgraded to 2.41 with my latest Debian
testing update. It seems like whitelist entries in local.cf may not be
honored in certain circumstances.
I have an entry in /etc/spamassassin/local.cf:
whitelist_from [EMAIL PROTECTED]
But then I'm getting messages like (headers only):
Return-Path: <[EMAIL PROTECTED]>
X-Sieve: cmu-sieve 2.0
Received: from mail.premiernet.net [205.229.224.233] by localhost with
POP3
(fetchmail-5.9.0) for ken@localhost (single-drop); Thu, 26 Sep
2002
08:53:02 -0500 (CDT)
Received: from localhost (localhost) by mail.premiernet.net
(8.12.5/8.12.5/Debian-1) id g8QDemQs020079; Thu, 26 Sep 2002
08:52:37 -0500
Date: Thu, 26 Sep 2002 08:52:37 -0500
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Subject: *****SPAM***** Postmaster notify: see transcript for details
Auto-Submitted: auto-generated (postmaster-notification)
X-Spam-Status: Yes, hits=8.3 required=5.0
tests=ALL_CAP_PORN,CLICK_BELOW,FAILURE_NOTICE_2,
FROM_AND_TO_SAME_5,FROM_MALFORMED,LINES_OF_YELLING,
SPAM_PHRASE_01_02,TO_BE_REMOVED_REPLY,TO_MALFORMED,
UPPERCASE_25_50
version=2.41
X-Spam-Flag: YES
X-Spam-Level: ********
X-Spam-Checker-Version: SpamAssassin 2.41 (1.115.2.8-2002-09-05-exp)
X-Spam-Report: Detailed Report SPAM: -------------------- Start
SpamAssassin results ---------------------- SPAM: This mail is
probably
spam. The original message has been altered SPAM: so you can
recognise or
block similar unwanted mail in future. SPAM: See
http://spamassassin.org/tag/ for more details. SPAM: SPAM:
Content
analysis details: (8.30 hits, 5 required) SPAM:
TO_MALFORMED (-0.8
points) To: has a malformed address SPAM: FROM_MALFORMED
(2.2 points)
From: has a malformed address SPAM: ALL_CAP_PORN (1.7
points) BODY:
Possible porn - in ALL CAPS SPAM: FAILURE_NOTICE_2 (0.9
points) BODY:
Mailer daemon failure notice (2) SPAM: CLICK_BELOW (0.3
points)
BODY: Asks you to click below SPAM: TO_BE_REMOVED_REPLY (0.2
points) BODY:
Says: "to be removed, reply via email" or similar SPAM:
SPAM_PHRASE_01_02
(-0.1 points) BODY: Spam phrases score is 01 to 02 (low)
SPAM:
[score: 1] SPAM: LINES_OF_YELLING (0.3 points) BODY: A
WHOLE LINE
OF YELLING DETECTED SPAM: FROM_AND_TO_SAME_5 (1.8 points) From
and To are
same (5) SPAM: UPPERCASE_25_50 (1.8 points) message body is
25-50%
uppercase SPAM: SPAM: -------------------- End of SpamAssassin
results
---------------------
X-UIDL: 1gR"!mfY"!?df"!E*R"!
Content-Type: multipart/report; boundary="=-aP8WzNLCN+WQovOzTda0"
X-Evolution-Source: imap://ken;[EMAIL PROTECTED]/
My procmailrc recipe:
mail:~# cat /etc/procmailrc
# Test for nospamcheck
:0
* ? /usr/bin/test -f $HOME/.nospamcheck
{
#if nospamcheck exists then deliver normally
:0:
$ORGMAIL
}
#Filter message thru SA
:0fw
| /usr/bin/spamc -u $LOGNAME
#Deliver message
:0:
$ORGMAIL
Note that the message above is delivered to 247ent, so I test (after
having cleaned this same message with spamassassin -d):
mail:~# spamc -u 247ent < badspam.eml
>From [EMAIL PROTECTED] Thu Sep 26 08:53:02 2002
Return-Path: <[EMAIL PROTECTED]>
X-Sieve: cmu-sieve 2.0
Received: from mail.premiernet.net [205.229.224.233] by localhost with
POP3
(fetchmail-5.9.0) for ken@localhost (single-drop); Thu, 26 Sep 2002
08:53:02 -0500 (CDT)
Received: from localhost (localhost) by mail.premiernet.net
(8.12.5/8.12.5/Debian-1) id g8QDemQs020079; Thu, 26 Sep 2002 08:52:37
-0500
Date: Thu, 26 Sep 2002 08:52:37 -0500
From: Mail Delivery Subsystem <[EMAIL PROTECTED]>
Message-Id: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Subject: Postmaster notify: see transcript for details
Auto-Submitted: auto-generated (postmaster-notification)
X-UIDL: 1gR"!mfY"!?df"!E*R"!
Content-Type: multipart/report; boundary="=-6mdx8Gl1k+isO1S62w1f"
X-Evolution-Source: imap://ken;[EMAIL PROTECTED]/
X-Spam-Status: No, hits=-93.1 required=5.0
tests=ALL_CAP_PORN,CLICK_BELOW,FAILURE_NOTICE_2,
FROM_AND_TO_SAME_5,LINES_OF_YELLING,SPAM_PHRASE_01_02,
TO_BE_REMOVED_REPLY,UPPERCASE_25_50,USER_IN_WHITELIST
version=2.41
X-Spam-Level:
And the whitelist entry works. Can anyone figure out what's going on
here?
Thanks,
Ken Causey
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
