Suggestions on Rules and SA config location in Plesk?

[Dave Duffner <sa...@pscginternet.com>]

Greetings,

  OK, apparently when I had an Ensim box it was long ago in a land
far, far away with a 2.5.X version of SA.  So I'm used to that setup,
not what I was just finally decoded to understand is the deal with
Plesk's 3.2.4 version!  Maddening!

  So two parts:

  #1 - I now finally know where they go, what's the best place for 
rulesets?  I have the standards, but they're from 2008 and the SA
update's not functioning right thanks to Parallel's monkeying with 
it in the Plesk OS.  So I'm not concerned with messing with what's
there, I need to know where in 2009 the best rules are located to 
snag and import them into our setup.  Apparently it's been since 
2004ish, so I'm not sure who's around and who's not beyond this
List still being here!

  #2 - Anyone have a clue as to where in RH Fedora Core 8, Plesk
is hiding the stupid conf file?  Does it even exist in 3.X or is it some
compiled thing I was reading?  I'm used to a long conf file in plain
English that allowed me to tweak the settings.  Plesk has a major
modification to SA and uses it with Qmail only as a tagger - then
has another system to Reject, Delete or whatever.  Sucks, works
some of the time and hopefully rulesets help.  But there's tweaks
I know were in there - if they still are - and I can't find them in any
standard location in the docs.  Plesk's docs are a joke, so don't 
point me that direction, I'm referring to the SA docs - nothing has a
real match to find the options!

  Plesk calls 4 options at SA's boot, I can't even find docs to then
explain what those are, but along with that should be a stock 
conf file with options for thresholds, actions, ignoring, Bayes and
more.  Plesk gives you an ignorant control panel for a couple of 
the options - then writes to what I'm really after - but leaves no 
clues as to where that file is to attempt to edit it!  Unless it's then
compiled, which may run faster but is annoying, so how do I get it
in a plain form - edit - then recompile?  Also not in docs I could 
find after an exhaustive search.

  Thanks!

  Dave
  PSCGi

Re: Suggestions on Rules and SA config location in Plesk?

[Kris Deugau <kd...@vianet.ca>]

Dave Duffner wrote:
>  What I was asking was for the best 'offsite' locations for rulesets.
> I know SA has it's own and Update's supposed to get the most
> popular - but it's not, if it is they've gone majorly downhill and I can't
> believe that's the case.

Mm, sort of.  sa-update, all on its own, in a stock setup (or most 
packaged ones, for that matter) only updates the core SA rules.  You're 
free to hack together whatever sort of extras you want to dig up 
third-party rulesets and plonk them where SA can use them.

>  So I know the normal stuff, I'm looking for the offshoot sites that
> write up spam rules that not everyone's going to use, etc.

Mmm.  Most rule development seems to have gone site-local;  there aren't 
really any publicly-available hand-maintained rulesets getting many 
updates these days.

There are a couple of people distributing the SARE rulesets (either in a 
big block, or per-file channels), but those rulesets are no longer 
actively maintained for the most part.  There's one file with 
TLD-boundary info for the URI blacklist calls;  look back in the list 
archives and there should be a few references to 90_2tld.cf.

You *could*, with a bit of effort, manually dig out the files that 
sa-update would provide on a sane system, and stuff them in somewhere 
once you find where to put them.  You can try the same with Justin 
Mason's "sought" ruleset;  they're pretty good.

However, for the stock ruleset update, those should probably either 
replace the files for the stock rules you've got installed now, or be 
put in wherever sa-update would have put them.

>  Found all that, the local.cf at best has the spamd call options
> of like -d and 3 others - no docs seem to have clues about
> what these options are/do so that I can configure anything!

Umm...  that sounds like init script options, not the local.cf that 
usually applies to SA config.

Can you post it somewhere, or paste it into a message?  It's a bit hard 
to say for sure what you're looking at if I can't see it.

-kgd

Re: Suggestions on Rules and SA config location in Plesk?

[Dave Duffner <sa...@pscginternet.com>]

----- Original Message ----- 
From: "Kris Deugau" <kd...@vianet.ca>
To: "SpamAssassin Users List" <us...@spamassassin.apache.org>
Sent: Thursday, March 26, 2009 4:04 PM
Subject: Re: Suggestions on Rules and SA config location in Plesk?


> Dave Duffner wrote:
>>   OK, apparently when I had an Ensim box it was long ago in a land
>> far, far away with a 2.5.X version of SA.  So I'm used to that setup,
>> not what I was just finally decoded to understand is the deal with
>> Plesk's 3.2.4 version!  Maddening!
>>  So two parts:
>>  #1 - I now finally know where they go, what's the best place for
>> rulesets?  I have the standards, but they're from 2008 and the SA
>> update's not functioning right
>
> Any more detail on this?  They're really have to be *trying* to break 
> sa-update...  and there are updates to the stock rulesets that are 
> moderately important.

   It's Plesk.  You know as well as I do it ain't right but the 9.X version
is insulting.  And since they've sucked up Ensim for good, they must
figure it's free reign to trash the rest of it.  Thousands of people are
lighting the torches and grabbing the pitchforks - it's that bad.

  What I was asking was for the best 'offsite' locations for rulesets.
I know SA has it's own and Update's supposed to get the most
popular - but it's not, if it is they've gone majorly downhill and I can't
believe that's the case.

  So I know the normal stuff, I'm looking for the offshoot sites that
write up spam rules that not everyone's going to use, etc.  And rather
than the months on end searching I did back in the days of the RaQs
and then the Ensim boxes, I figured this was still the best place to see
what's up.  If they're all in the one location - weird, but OK I'll just
ensure that's what's in there and handwrite the rest.

  The update bit - that's down the road.  All the files have a 2008
creation date tag, no apparent update and there's something in the
attempt logs that say it could be encryption keys or 100 other things
that aren't a priority because SA's used as a tagger - not as THE
spam killer as we had it on the RaQs and Ensim boxes a few years
ago.  Also didn't say I was happy about this setup, it's what I have
to work with so first - stabilize.  THEN - upgrade & improve.

>>   #2 - Anyone have a clue as to where in RH Fedora Core 8, Plesk
>> is hiding the stupid conf file?
>
> Again, unless they've really gone off on a tangent (OK, so this *is* Plesk 
> we're talking about...  <g>) you should find the "site" config directory 
> at one of:
>
> /etc/mail/spamassassin
> /etc/spamassassin
> /usr/local/etc/mail/spamassassin
> /usr/local/etc/spamassassin
> /usr/local/psa/etc/mail/spamassassin
> /usr/local/psa/etc/spamassassin
>
> There should be a mostly-empty local.cf and a few .pre files there.
>
> You can *probably* use "locate v312.pre" to find it, now that I think 
> about it.

  Found all that, the local.cf at best has the spamd call options
of like -d and 3 others - no docs seem to have clues about
what these options are/do so that I can configure anything!

  Formerly I had that same conf file spelled out without any shortcuts
and I could simply change options as needed, there were decent
explanations on what's what and the docs matched to a point.  Now
it's those 4 codes - that's it.  Thus I'm trying to determine where
that other file went, if it was eliminated in favor of a fully compiled
setup and those magic little 'codes' and if so - where the hell is the
guide to what those 4 are, what they do and what others there are
so I can reconfigure SA to be more of what it's supposed to?

  Rulesets, as I mentioned, got that down.  Location, etc. to make
them fly and that's also where the rest you mention is located.
Plesk has stripped things down to the point a majority of those
locations have one script, file or routine that calls one thing, with
2-4 -X type options and no explanations - that's it.  How can
you work with that?  Least without a playbook?

> The other thing you can do to find out where Plesk has meddled with the SA 
> innards is to run "rpm -qa |grep -i spam" to find out what the package 
> name is (most Plesk bits are available packaged as .rpm, and fortunately 
> installed using the system rpm binary, not some customised hack of *that*, 
> too).  Once you have some idea which package name it is, rpm -ql <package> 
> will list the files installed by the package.
>
> The init script is likely in /etc/init.d, and if you're really lucky some 
> of the spamd startup options will have been set in a file in the 
> RH-standard /etc/sysconfig directory.

  Oh they've trashed everything, in 9.X it's to the point where SA was
gelded enough it was just tagging spam and not even rejecting/dropping
it or doing much of anything else.  Like a pointer 'der it is, der it is'. 
And
I'd rather rip the sucker out and reinstall it manually if that's the case, 
but
IP and firewalling most of the spam does a far better trick.  So SA as
they're using it's fine, just domestic spam's coming in at like a 10th of
what was flowing and I'd like to see that down to 1% with some rules
tweaking.  Or split the load with the firewall IF I can find the SA conf
settings to screw with to make it do more than Plesk has it doing.

  I've also, for example, got the Whitelist spam problem in the other
main thread here in the List - but it's not due to the same problem! It's
because of the setup, it needs adjustments but I can't tell what's acutally
tagging certain spam as whitelist and causing the -99ish ratings that do
allow it to pass.  I know where I USED to control it, but that's long
gone in the Plesk/SA mess I've got right now!

> How Plesk integrates SA into the mail flow is something else, and I'm not 
> planning on trying to extend the license key on one of the legacy Plesk 
> machines here to see for myself...

  Don't, they don't deserve the money.  Trust me.  Right now it's like
they're broke and shoved 9.X out on purpose, knowing it was trash
and now forcing a majority of people to call in for service at $75 a
shot minimum.  Like ransom because people are stuck as you can't
go back from 9.X, if you manage to do so - it's a miracle.

  Just to demonstrate, in 9.X they flipped from Qmail to Postfix, we
have options and I wasn't leaving Qmail at this point, so then there's
two mail flows to deal with as far as problems.  And since it's like
a 50/50 split on who took what option they're overloaded because
Parallels/Plesk figured we'd all go like Lemmings to Postfix.  Wrong,
bit'm where it counts too.

  So again my goal is finding 'done' rulesets to munge into what I have
since I can, it works and it'll help finish the giant spam hammer we've
thrown down lately on'em and then find the stinking conf options in
either a file I'm not finding OR a guide that explains those codes if
that's what it is!

  Dave

Re: Suggestions on Rules and SA config location in Plesk?

[Kris Deugau <kd...@vianet.ca>]

Dave Duffner wrote:
>   OK, apparently when I had an Ensim box it was long ago in a land
> far, far away with a 2.5.X version of SA.  So I'm used to that setup,
> not what I was just finally decoded to understand is the deal with
> Plesk's 3.2.4 version!  Maddening!
>  
>   So two parts:
>  
>   #1 - I now finally know where they go, what's the best place for
> rulesets?  I have the standards, but they're from 2008 and the SA
> update's not functioning right

Any more detail on this?  They're really have to be *trying* to break 
sa-update...  and there are updates to the stock rulesets that are 
moderately important.

> thanks to Parallel's monkeying with
> it in the Plesk OS.  So I'm not concerned with messing with what's
> there, I need to know where in 2009 the best rules are located to
> snag and import them into our setup.  Apparently it's been since
> 2004ish, so I'm not sure who's around and who's not beyond this
> List still being here!
>  
>   #2 - Anyone have a clue as to where in RH Fedora Core 8, Plesk
> is hiding the stupid conf file?

Again, unless they've really gone off on a tangent (OK, so this *is* 
Plesk we're talking about...  <g>) you should find the "site" config 
directory at one of:

/etc/mail/spamassassin
/etc/spamassassin
/usr/local/etc/mail/spamassassin
/usr/local/etc/spamassassin
/usr/local/psa/etc/mail/spamassassin
/usr/local/psa/etc/spamassassin

There should be a mostly-empty local.cf and a few .pre files there.

You can *probably* use "locate v312.pre" to find it, now that I think 
about it.

The other thing you can do to find out where Plesk has meddled with the 
SA innards is to run "rpm -qa |grep -i spam" to find out what the 
package name is (most Plesk bits are available packaged as .rpm, and 
fortunately installed using the system rpm binary, not some customised 
hack of *that*, too).  Once you have some idea which package name it is, 
rpm -ql <package> will list the files installed by the package.

The init script is likely in /etc/init.d, and if you're really lucky 
some of the spamd startup options will have been set in a file in the 
RH-standard /etc/sysconfig directory.

How Plesk integrates SA into the mail flow is something else, and I'm 
not planning on trying to extend the license key on one of the legacy 
Plesk machines here to see for myself...

-kgd