USER_IN_WHITELIST ??

[Lindsay Haisley <fm...@fmp.com>]

I've recently discovered a couple of emails tagged by SA (v3.2.1-gr1)
with USER_IN_WHITELIST and assigned score components of -100 accordingly
according to 50_scores.cf on the basis of a call to
eval:check_from_in_whitelist() in 60_whitelist.cf.

I would assume that this would only be possible if I had configured
'whitelist_from xxxxxxx' in my user prefs (which are stored in a MySQL
database), but I have no such settings, so I don't have a manual
whitelist as described at
http://wiki.apache.org/spamassassin/ManualWhitelist.

On the other hand, both errant addresses _were_ in my AWL database which
should assign a much smaller (possibly positive) spam score, and
shouldn't evoke a hit on USER_IN_WHITELIST.

Am I missing something here, or is this a SA bug?

-- 
Lindsay Haisley       | "In an open world,    |     PGP public key
FMP Computer Services |    who needs Windows  |      available at
512-259-1190          |      or Gates"        | http://pubkeys.fmp.com
http://www.fmp.com    |                       |

Re: USER_IN_WHITELIST ??

[Theo Van Dinter <fe...@apache.org>]

On Mon, Jul 16, 2007 at 01:38:22AM -0500, Lindsay Haisley wrote:
> override these.  Does blacklist_from take precedence over whitelist_from
> or whitelist_from_rcvd?

Whitelists and blacklists are independent, ie: no "precedence" involved.
You could have both hit on a message for a +100 - 100 = 0 total shift.

-- 
Randomly Selected Tagline:
Fatbot: "I heard that in one single night you drank a whole keg, streaked across
 campus, and crammed fifty-eight humans into a phone booth."
 Bender: "Yeah, well, a lot of 'em were children...."

Re: USER_IN_WHITELIST ??

[Lindsay Haisley <fm...@fmp.com>]

Matt, looks like you hit that target on this.  There are tons of
whitelist_from_rcvd directives in /etc/spamassassin/70_sare_whitelist.cf
including the problem addresses.  I'll need to figure out a way to
override these.  Does blacklist_from take precedence over whitelist_from
or whitelist_from_rcvd?

Thanks!

On Sun, 2007-07-15 at 20:26 -0400, Matt Kettler wrote:
> Lindsay nHaisley wrote:
> > I've recently discovered a couple of emails tagged by SA (v3.2.1-gr1)
> > with USER_IN_WHITELIST and assigned score components of -100 accordingly
> > according to 50_scores.cf on the basis of a call to
> > eval:check_from_in_whitelist() in 60_whitelist.cf.
> >   
> What about whitelist_from_rcvd, or whitelist_from_spf?
> 
> Do you have any whitelist commands at the site config level (ie:
> local.cf or add-on rulesets)?

-- 
Lindsay Haisley       | "In an open world,    |     PGP public key
FMP Computer Services |    who needs Windows  |      available at
512-259-1190          |      or Gates"        | http://pubkeys.fmp.com
http://www.fmp.com    |                       |

Re: USER_IN_WHITELIST ??

[Matt Kettler <mk...@verizon.net>]

Lindsay Haisley wrote:
> I've recently discovered a couple of emails tagged by SA (v3.2.1-gr1)
> with USER_IN_WHITELIST and assigned score components of -100 accordingly
> according to 50_scores.cf on the basis of a call to
> eval:check_from_in_whitelist() in 60_whitelist.cf.
>
> I would assume that this would only be possible if I had configured
> 'whitelist_from xxxxxxx' in my user prefs (which are stored in a MySQL
> database), but I have no such settings, so I don't have a manual
> whitelist as described at
> http://wiki.apache.org/spamassassin/ManualWhitelist.
>   
What about whitelist_from_rcvd, or whitelist_from_spf?

Do you have any whitelist commands at the site config level (ie:
local.cf or add-on rulesets)?

try a run of this:
     grep whitelist /etc/mail/spamassassin/*.cf


> On the other hand, both errant addresses _were_ in my AWL database which
> should assign a much smaller (possibly positive) spam score, and
> shouldn't evoke a hit on USER_IN_WHITELIST.
>
> Am I missing something here, or is this a SA bug?
>
>