You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Erik Logtenberg <er...@logtenberg.eu> on 2014/04/18 11:31:44 UTC
Missing header when skipping mail
Hi,
I noticed that SA has a safety feature that causes it to skip messages
that are too large:
spampd[29159]: skipped large message (68.9130859375KB)
I agree very much with the reasoning behind this feature: it avoids
certain types of denial of service attacks, prevents SA from eating too
many resources for a single mail, and such a large mail probably isn't
going to be spam anyway, but is usually ham with some large attachment.
Having said that, I would very much appreciate it if SA would be kind
enough to nevertheless add a header so that users know that SA has at
least taken a look at it, and preferably also telling them the reason
for skipping this specific email.
I am now receiving questions by customers if our spam scanning is
unavailable for some reason, and the only way to conclusively tell them
what's going on is checking out all the maillogs...
Is it possible to configure (or change) SA to add a header always?
Thanks,
Erik.
Re: Missing header when skipping mail
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Fri, 2014-04-18 at 11:31 +0200, Erik Logtenberg wrote:
> I noticed that SA has a safety feature that causes it to skip messages
> that are too large:
>
> spampd[29159]: skipped large message (68.9130859375KB)
That is a rather horrible way of telling you the message is 70567 byte
large...
As Tom already mentioned, that's spampd skipping a "too large" message,
not even feeding it SA in the first place. And Alex pointed out spampd's
default size limit is 64 kByte.
Looking at that ugly log-line [1] with that default in mind, you seem to
actually use the spampd maxsize default value. Which is an anachronism,
to say the least. The SA spamc default is 500 kByte since SA 3.2 (7
years ago), and used to be 250 kByte before. Either one is a *much* more
appropriate choice than the spampd default.
I strongly suggest to raise that spampd maxsize value.
[1] The ridiculously low maxsize threshold would have been easier to
spot, if the logging would have cut out the millionth fraction of a
byte and provide a sane value.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: Missing header when skipping mail
Posted by Axb <ax...@gmail.com>.
On 04/18/2014 12:18 PM, Erik Logtenberg wrote:
>> The tool that hands the message to spamasassin (spampd in your case)
>> imposes the size limit. The message is never seen by spamassassin.
>> You're barking up the wrong tree ;)
>>
>> Tom
>>
>
> Ah, I agree. This is where that happens:
>
>> $self->log(2, "skipped large message (". $size / 1024 ."KB)");
>
> I'll send my question to Maxim Paperno, author of spampd, instead.
>
> Thanks,
>
> Erik.
>
http://www.worlddesign.com/Content/rd/mta/spampd/spampd.html
Options:
--maxsize=n
The maximum message size to send to SpamAssassin, in KBytes. By
default messages over 64KB are not scanned at all, and an appropriate
message is logged indicating this. The size includes headers and
attachments (if any).
Re: Missing header when skipping mail
Posted by Dave Funk <db...@engineering.uiowa.edu>.
On Fri, 18 Apr 2014, Kevin A. McGrail wrote:
> On 4/18/2014 6:18 AM, Erik Logtenberg wrote:
>>> The tool that hands the message to spamasassin (spampd in your case)
>>> imposes the size limit. The message is never seen by spamassassin.
>>> You're barking up the wrong tree ;)
>>>
>>> Tom
>>>
>> Ah, I agree. This is where that happens:
>>
>>> $self->log(2, "skipped large message (". $size / 1024 ."KB)");
>> I'll send my question to Maxim Paperno, author of spampd, instead.
>
>
> Spamassassin is a program AND an API.
>
> Right now you are using the API so your wrapper (spampd) can do anything it
> wants but we could also consider this feature for spamc/spamd and for
> spamassassin as a parameter to enable. Please open a bugzilla bug if you
> would like it considered.
Another way to deal with this problem is, via the glue agent, to truncate
large messages and send just the first X-kbytes of the message (for some
appropriate value of X, I'm using 256K). The idea is that a large spam message
is probably large because of some attachment and the payload is in the first
part.
I'm using a milter to connect to spamd so I can do SMTP rejections of high
scoring spam. I coded the truncation feature in the milter so no need to
modify the MTA nor spamd.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Missing header when skipping mail
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 4/18/2014 6:18 AM, Erik Logtenberg wrote:
>> The tool that hands the message to spamasassin (spampd in your case)
>> imposes the size limit. The message is never seen by spamassassin.
>> You're barking up the wrong tree ;)
>>
>> Tom
>>
> Ah, I agree. This is where that happens:
>
>> $self->log(2, "skipped large message (". $size / 1024 ."KB)");
> I'll send my question to Maxim Paperno, author of spampd, instead.
Spamassassin is a program AND an API.
Right now you are using the API so your wrapper (spampd) can do anything
it wants but we could also consider this feature for spamc/spamd and for
spamassassin as a parameter to enable. Please open a bugzilla bug if
you would like it considered.
regards,
KAM
Re: Missing header when skipping mail
Posted by Erik Logtenberg <er...@logtenberg.eu>.
> The tool that hands the message to spamasassin (spampd in your case)
> imposes the size limit. The message is never seen by spamassassin.
> You're barking up the wrong tree ;)
>
> Tom
>
Ah, I agree. This is where that happens:
> $self->log(2, "skipped large message (". $size / 1024 ."KB)");
I'll send my question to Maxim Paperno, author of spampd, instead.
Thanks,
Erik.
Re: Missing header when skipping mail
Posted by Tom Hendrikx <to...@whyscream.net>.
On 04/18/2014 11:31 AM, Erik Logtenberg wrote:
> Hi,
>
> I noticed that SA has a safety feature that causes it to skip messages
> that are too large:
>
> spampd[29159]: skipped large message (68.9130859375KB)
>
> I agree very much with the reasoning behind this feature: it avoids
> certain types of denial of service attacks, prevents SA from eating too
> many resources for a single mail, and such a large mail probably isn't
> going to be spam anyway, but is usually ham with some large attachment.
>
> Having said that, I would very much appreciate it if SA would be kind
> enough to nevertheless add a header so that users know that SA has at
> least taken a look at it, and preferably also telling them the reason
> for skipping this specific email.
>
> I am now receiving questions by customers if our spam scanning is
> unavailable for some reason, and the only way to conclusively tell them
> what's going on is checking out all the maillogs...
>
> Is it possible to configure (or change) SA to add a header always?
>
The tool that hands the message to spamasassin (spampd in your case)
imposes the size limit. The message is never seen by spamassassin.
You're barking up the wrong tree ;)
Tom