You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jaime Aguado <ja...@fresh-it.com> on 2006/01/27 13:03:29 UTC
Configuration issue
Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
postfix as smtpd.
My spamassassin system is leaking most spam messages (60-80%) without
tagging them.
I have done some configuration tests:
# spamassassin --lint gives no output error.
# spamassassin < /tmp/spam-message
[...]
Subject: *****SPAM***** Special Alert to Investors
Date: Sat, 28 Jan 2006 00:22:23 +0000
Message-Id: <PD...@thesitefights.com>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
trueno.fresh-it.com
X-Spam-Level: *********
X-Spam-Status: Yes, hits=9.7 required=4.0
tests=BAYES_99,DATE_IN_FUTURE_12_24,
MIME_BASE64_TEXT autolearn=no version=2.64
X-Spam-Report:
* 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
encoding
* 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received:
date
[...]
# spamc -R < /tmp/spam-message
[...]
Content analysis details: (8.6 points, 4.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
[score: 1.0000]
1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
encoding
2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
The args passed to spamd are: SPAMD_ARGS="-d -c -a -L"
Finally, the message reaches the inbox mail client untagged as spam. What I
am doing wrong?
Thank you.
Re: Configuration issue
Posted by Dirk Bonengel <di...@bonengel.de>.
Jaime,
btw: any special reason you plan to use SA 2.64 with local tests only?
I'd recommend upgrading to the latest and greatest stable version which
can be found (as RPMs for SLES9 on Intel) at
http://ftp.suse.com/pub/people/choeger/spamassassin/i386/sles9/
Take care as the config requires changes in some places.
If you use amavisd-new then enable network tests (or disable the
local-tests-only-option) in the amavis config
HTH
Dirk
Jaime Aguado schrieb:
>Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
>postfix as smtpd.
>
>My spamassassin system is leaking most spam messages (60-80%) without
>tagging them.
>I have done some configuration tests:
>
># spamassassin --lint gives no output error.
>
># spamassassin < /tmp/spam-message
>
>[...]
>Subject: *****SPAM***** Special Alert to Investors
>Date: Sat, 28 Jan 2006 00:22:23 +0000
>Message-Id: <PD...@thesitefights.com>
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
>trueno.fresh-it.com
>X-Spam-Level: *********
>X-Spam-Status: Yes, hits=9.7 required=4.0
>tests=BAYES_99,DATE_IN_FUTURE_12_24,
> MIME_BASE64_TEXT autolearn=no version=2.64
>X-Spam-Report:
> * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> * [score: 1.0000]
> * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
>encoding
> * 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received:
>date
>[...]
>
># spamc -R < /tmp/spam-message
>[...]
>Content analysis details: (8.6 points, 4.0 required)
>
> pts rule name description
>---- ----------------------
>--------------------------------------------------
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
>encoding
> 2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
>
>The args passed to spamd are: SPAMD_ARGS="-d -c -a -L"
>
>Finally, the message reaches the inbox mail client untagged as spam. What I
>am doing wrong?
>
>Thank you.
>
>
>
>
RE: Configuration issue
Posted by Jaime Aguado <ja...@fresh-it.com>.
I finally fix it. There was another bayes db, leave by the admin I have
replaced, under the home directory of the amavis user with 20 spam messages
learned and 30.000 ham learned. I dont know if they have even been learned
properly. I replaced it with the db of the root user and now is catching
almost every spam message.
I have also disable local test in amavis config file and now I run every
learn/test process as the amavis user.
Thanks for all great support!!
Jaime.
-----Mensaje original-----
De: Matt Kettler [mailto:mkettler_sa@comcast.net]
Enviado el: viernes, 27 de enero de 2006 16:06
Para: Jaime Aguado
CC: users@spamassassin.apache.org
Asunto: Re: Configuration issue
Jaime Aguado wrote:
> Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9
> running postfix as smtpd.
>
> My spamassassin system is leaking most spam messages (60-80%) without
> tagging them.
> I have done some configuration tests:
>
> # spamassassin --lint gives no output error.
>
> # spamassassin < /tmp/spam-message
>
> [...]
> Subject: *****SPAM***** Special Alert to Investors
> Date: Sat, 28 Jan 2006 00:22:23 +0000
> Message-Id: <PD...@thesitefights.com>
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
> trueno.fresh-it.com
> X-Spam-Level: *********
> X-Spam-Status: Yes, hits=9.7 required=4.0
> tests=BAYES_99,DATE_IN_FUTURE_12_24,
> MIME_BASE64_TEXT autolearn=no version=2.64
> X-Spam-Report:
> * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> * [score: 1.0000]
> * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using
> base64 encoding
> * 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after
Received:
> date
> [...]
>
> # spamc -R < /tmp/spam-message
> [...]
> Content analysis details: (8.6 points, 4.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
> encoding
> 2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
>
> The args passed to spamd are: SPAMD_ARGS="-d -c -a -L"
>
> Finally, the message reaches the inbox mail client untagged as spam.
> What I am doing wrong?
Your tests are being run as the root user, what user is your mail being
scanned as? Unless you're using a bayes_path declaration, the bayes
databases could be different, resulting in different scores.
Also, for what it's worth, it's generally bad form for spamd to scan mail as
root. SA 3.x actualy refuses to do so and if you try will wind up using the
"nobody" user.
Re: Configuration issue
Posted by Matt Kettler <mk...@comcast.net>.
Jaime Aguado wrote:
> Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
> postfix as smtpd.
>
> My spamassassin system is leaking most spam messages (60-80%) without
> tagging them.
> I have done some configuration tests:
>
> # spamassassin --lint gives no output error.
>
> # spamassassin < /tmp/spam-message
>
> [...]
> Subject: *****SPAM***** Special Alert to Investors
> Date: Sat, 28 Jan 2006 00:22:23 +0000
> Message-Id: <PD...@thesitefights.com>
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
> trueno.fresh-it.com
> X-Spam-Level: *********
> X-Spam-Status: Yes, hits=9.7 required=4.0
> tests=BAYES_99,DATE_IN_FUTURE_12_24,
> MIME_BASE64_TEXT autolearn=no version=2.64
> X-Spam-Report:
> * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> * [score: 1.0000]
> * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
> encoding
> * 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received:
> date
> [...]
>
> # spamc -R < /tmp/spam-message
> [...]
> Content analysis details: (8.6 points, 4.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
> encoding
> 2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
>
> The args passed to spamd are: SPAMD_ARGS="-d -c -a -L"
>
> Finally, the message reaches the inbox mail client untagged as spam. What I
> am doing wrong?
Your tests are being run as the root user, what user is your mail being
scanned as? Unless you're using a bayes_path declaration, the bayes
databases could be different, resulting in different scores.
Also, for what it's worth, it's generally bad form for spamd to scan
mail as root. SA 3.x actualy refuses to do so and if you try will wind
up using the "nobody" user.
Re: Configuration issue
Posted by jdow <jd...@earthlink.net>.
Actually I'd suspect it was amavis doing the rewriting. I understand
it simply uses SA as a score mechanism and discards its markups unless
you tell it otherwise somehow.
Either way it's not an SA issue so you can expect confusion here.
{^_^}
----- Original Message -----
From: "Jaime Aguado" <ja...@fresh-it.com>
> In what way is a postfix issue?. I guess the usual message flow is
>
> postfix -> amavis -> spamassassin -> postfix -> imap_user_inbox
>
> Why would postfix rewrite the subject of a message already tagged with
> ****SPAM****
>
> -----Mensaje original-----
> De: Loren Wilton [mailto:lwilton@earthlink.net]
>
>> X-Spam-Status: Yes, hits=9.7 required=4.0
>
> This says it is spam. The X-Spam-Report also says that.
>
> It would seem you have aproblem in Postfix, that it is doing something wrong
> with the message.
>
> Loren
>
>
RE: Configuration issue
Posted by Jaime Aguado <ja...@fresh-it.com>.
In what way is a postfix issue?. I guess the usual message flow is
postfix -> amavis -> spamassassin -> postfix -> imap_user_inbox
Why would postfix rewrite the subject of a message already tagged with
****SPAM****
-----Mensaje original-----
De: Loren Wilton [mailto:lwilton@earthlink.net]
Enviado el: viernes, 27 de enero de 2006 13:49
Para: users@spamassassin.apache.org
Asunto: Re: Configuration issue
> X-Spam-Status: Yes, hits=9.7 required=4.0
This says it is spam. The X-Spam-Report also says that.
It would seem you have aproblem in Postfix, that it is doing something wrong
with the message.
Loren
Re: Configuration issue
Posted by Loren Wilton <lw...@earthlink.net>.
> X-Spam-Status: Yes, hits=9.7 required=4.0
This says it is spam. The X-Spam-Report also says that.
It would seem you have aproblem in Postfix, that it is doing something wrong
with the message.
Loren
Re: Configuration issue
Posted by Dirk Bonengel <di...@bonengel.de>.
Do you run amavisd-new (which is shipped with SLES9, I think)
If you do, there's the culprit: amavisd-new does its own spam testing
using the spamassassin code directly (not via spamc/spamd)
Details can be found at http://www.ijs.si/software/amavisd/#faq-spam
Likey you didn't configure amavisd-new correctly, so there you are.
Dirk
Jaime Aguado schrieb:
>Hi all, I have spamassassin 2.64 running on a SuSE Enterprise 9 running
>postfix as smtpd.
>
>My spamassassin system is leaking most spam messages (60-80%) without
>tagging them.
>I have done some configuration tests:
>
># spamassassin --lint gives no output error.
>
># spamassassin < /tmp/spam-message
>
>[...]
>Subject: *****SPAM***** Special Alert to Investors
>Date: Sat, 28 Jan 2006 00:22:23 +0000
>Message-Id: <PD...@thesitefights.com>
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on
>trueno.fresh-it.com
>X-Spam-Level: *********
>X-Spam-Status: Yes, hits=9.7 required=4.0
>tests=BAYES_99,DATE_IN_FUTURE_12_24,
> MIME_BASE64_TEXT autolearn=no version=2.64
>X-Spam-Report:
> * 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> * [score: 1.0000]
> * 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
>encoding
> * 3.3 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received:
>date
>[...]
>
># spamc -R < /tmp/spam-message
>[...]
>Content analysis details: (8.6 points, 4.0 required)
>
> pts rule name description
>---- ----------------------
>--------------------------------------------------
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> [score: 1.0000]
> 1.0 MIME_BASE64_TEXT RAW: Message text disguised using base64
>encoding
> 2.2 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date
>
>The args passed to spamd are: SPAMD_ARGS="-d -c -a -L"
>
>Finally, the message reaches the inbox mail client untagged as spam. What I
>am doing wrong?
>
>Thank you.
>
>
>
>