You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Eric A. Hall" <eh...@ehsco.com> on 2005/02/18 20:03:24 UTC
spamassassin and LDAP lookups
http://svn.apache.org/repos/asf/spamassassin/branches/3.0/sql/README
(which has a bad MIME-type definition, btw [text/english is not real])
says that SQL lookups are only used with spamd, and so presumably they are
not used with spamassassin itself. Further poking seems to prove this
assumption correct.
Is this correct? If so, is there intent on adding this functionality?
Because of my postfix/SA setup I'm not able to use spamd very easily.
Thanks
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 2:54 PM, Michael Parker wrote:
> So, you missed the ldap/README file?
http://spamassassin.apache.org/full/3.0.x/dist/doc/ doesn't have it and
http://spamassassin.apache.org/doc.html has zero references to ldap. So
yeah I missed it.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by Michael Parker <pa...@pobox.com>.
On Fri, Feb 18, 2005 at 02:51:42PM -0500, Eric A. Hall wrote:
>
> On 2/18/2005 2:41 PM, Michael Parker wrote:
> > FYI, confusing subject lines and content don't help get your questions
> > answered. Are you talking about LDAP or SQL?
>
> I'm talking about LDAP but it uses the SQL interfaces (from what I gather)
> and the only real docs are for SQL so that's what I have to reference.
>
So, you missed the ldap/README file?
It's interface mimics the SQL interface, but does not use.
Michael
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 2:41 PM, Michael Parker wrote:
> FYI, confusing subject lines and content don't help get your questions
> answered. Are you talking about LDAP or SQL?
I'm talking about LDAP but it uses the SQL interfaces (from what I gather)
and the only real docs are for SQL so that's what I have to reference.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by Michael Parker <pa...@pobox.com>.
FYI, confusing subject lines and content don't help get your questions
answered. Are you talking about LDAP or SQL? In this case maybe there
isn't much of a distinction, but when I filter by subject only, the
chances are lower that I'm gonna read an email about LDAP, but pretty
high I'll read one about SQL, so make the subject reflect what you are
asking.
On Fri, Feb 18, 2005 at 02:03:24PM -0500, Eric A. Hall wrote:
>
> http://svn.apache.org/repos/asf/spamassassin/branches/3.0/sql/README
> (which has a bad MIME-type definition, btw [text/english is not real])
> says that SQL lookups are only used with spamd, and so presumably they are
> not used with spamassassin itself. Further poking seems to prove this
> assumption correct.
That is correct, SQL/LDAP user prefs are available only in spamd.
> Is this correct? If so, is there intent on adding this functionality?
Sure, it's just waiting for someone to work on, assigned to me, but I
currently don't have any plans to work on such a thing, so anyone that
wants can work up a patch and submit it for review.
http://bugzilla.spamassassin.org/show_bug.cgi?id=1145
> Because of my postfix/SA setup I'm not able to use spamd very easily.
I see from a later message that you're most likely not even using the
spamassassin script, but making use of the API directly. I've got a
small side project in a tree somewhere to implement the spamd protocol
in perl. That could possibly be helpful in your case. If you're
interested, check the list archives from a few months back, I believe
I posted the work I had done so far so someone could pick it up and
run with it.
Michael
Re: spamassassin and LDAP lookups
Posted by jdow <jd...@earthlink.net>.
From: "Eric A. Hall" <eh...@ehsco.com>
>
> On 2/18/2005 2:17 PM, Matt Kettler wrote:
> > At 02:03 PM 2/18/2005, Eric A. Hall wrote:
> >
> >>http://svn.apache.org/repos/asf/spamassassin/branches/3.0/sql/README
> >>(which has a bad MIME-type definition, btw [text/english is not real])
> >>says that SQL lookups are only used with spamd, and so presumably they
are
> >>not used with spamassassin itself. Further poking seems to prove this
> >>assumption correct.
> >>
> >>Is this correct? If so, is there intent on adding this functionality?
> >
> > I'd be a bit surprised.. the plain "spamassassin" command line isn't
really
> > well suited to high volume production use. It's more intended for very
> > simple setups that handle small amounts of mail.
>
> That's not mutually exclusive, and is actually somewhat inclusive. I mean,
> if people are using the spamassassin script on a low-volume basis, then
> there's a low volume of SQL/LDAP lookups, so the complaint is nulled.
>
> >>Because of my postfix/SA setup I'm not able to use spamd very easily.
> >
> > Why not? spamc should be a more-or-less drop in replacement for calls to
> > spamassassin once spamd is started...
>
> I'm using a third-party script for the in-line proxy, and it daemonizes
> spamassassin on its own.
Of course, I am crazed enough that I might try to use spamc anyway and
let the third-party script daemonize spamc, Eric. I wonder if anybody
has been crazed enough to try and can report the results.
{^_-}
Re: spamassassin and LDAP lookups
Posted by Matt Kettler <mk...@evi-inc.com>.
At 03:39 PM 2/18/2005, Eric A. Hall wrote:
>Is the LDAP stuff in SA usable for global tests, or is it per-user only,
>or is there less of a difference than I am imagining here?
The LDAP stuff is to replace user_prefs, not the global test list.
Since you need to get as far as parsing the site config before you can even
get the LDAP DSN to look in, all of /usr/share/spamassassin/*.cf and
/etc/mail/spamassassin/*.cf will be parsed before LDAP or SQL are even
looked at.
Also, unless you've got "allow_user_rules" set to 1 in your local.cf, no
body, rawbody, header, uri, or meta statements will be honored.
Some privileged settings will not be honored at this level even if
allow_user_rules is set. Take a look at man Mail::SpamAssassin::Conf and
keep in mind that this is a form of user_prefs.
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 3:39 PM, Eric A. Hall wrote:
> Basically... I've already got postfix calling LDAP for a variety of
> filters (see http://www.ehsco.com/reading/20040916ncf1b.gif), and I'd like
> to extend those LDAP entries for global spamassassin tests (I don't do any
> per-user tests at the global level). Primarily this means moving the
> global whitelists to LDAP (eg, rather than track global whitelists in a
> local cf file, link them to domain-based entries in the directory).
>
> Is the LDAP stuff in SA usable for global tests, or is it per-user only,
> or is there less of a difference than I am imagining here?
okay now that I've found relevant documentation, it doesn't seem that the
existing ldap stuff is going to be very useful. I suppose that could (in
theory) add private whitelist entries linked to the gateway account, but
that's not what I'm hoping for.
It might be best to work up a plugin that queries ldap for predefined
weighting values associated with specific domains, and then adds those
values to the final score. For example:
[cn=example.com,ou=spamassassin,ou=services,dc=ehsco,dc=com]
name = example.com
received-score = -100
from-score = 0
Then do something like parse the trusted Received header and query for any
of the discovered domain names, do another query based on the from header
field value, and so forth.
Is this feasible?
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 3:05 PM, Matt Kettler wrote:
> spampd implements calls directly to the SA perl API via
> Mail::SpamAssassin. By using the API, the tool becomes responsible for
> directly setting up some of the user configuration. In particular, the
> caller of the perl API specifies where to get the user preferences from.
> This is NOT automatically handled.
>
> The perl API does not auto load the user config for any tool. It's always
> up to the caller of the API to specify the source of user preferences. It
> can look at the Mail::SpamAssassin::Conf object to make decisions, but it
> is up to the perl API caller to decide how to proceede.
>
> Mail::SpamAssassin makes the SQL tools available, but it's up to spampd to
> actually call load_scoreonly_sql(). Everything is in there, but spampd
> doesn't use it.
This is helpful thanks.
Basically... I've already got postfix calling LDAP for a variety of
filters (see http://www.ehsco.com/reading/20040916ncf1b.gif), and I'd like
to extend those LDAP entries for global spamassassin tests (I don't do any
per-user tests at the global level). Primarily this means moving the
global whitelists to LDAP (eg, rather than track global whitelists in a
local cf file, link them to domain-based entries in the directory).
Is the LDAP stuff in SA usable for global tests, or is it per-user only,
or is there less of a difference than I am imagining here?
There are comments in spampd about unsure future use of per-user scores
and this may be a central part of the discussion. OTOH, spampd does seem
to pick up the LDAP entries in local.cf, so it appears to be activating
that part of the routine [I generally use the spamassassin script for
tests before activating the changes for use with spampd, and that was part
of the whole confusion on my part here].
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by Matt Kettler <mk...@evi-inc.com>.
At 02:49 PM 2/18/2005, Eric A. Hall wrote:
> > You need it added to your third-party script, as, based on your
> > description, it's invoking the SA perl API's directly.
>
>http://www.worlddesign.com/index.cfm/rd/mta/spampd.htm is what I'm
>currently using. It doesn't provide any additional parameters over regular
>spamassassin configs, and whatever I do to spamassassin is picked up
>transparently. I'm having a couple problems with some of it (SPF errors
>are being picked up and causing problems for it, apparently) but I haven't
>found anything else that fits into the postfix->sa->postfix->cyrus model
>in a better way so I'm inclined to keep using it.
First, let's clarify something. There are three ways to use SA..
spamassassin, spamd/spamc, and Mail::Spamassassin (aka the perl API).
spampd implements calls directly to the SA perl API via
Mail::SpamAssassin. By using the API, the tool becomes responsible for
directly setting up some of the user configuration. In particular, the
caller of the perl API specifies where to get the user preferences from.
This is NOT automatically handled.
The perl API does not auto load the user config for any tool. It's always
up to the caller of the API to specify the source of user preferences. It
can look at the Mail::SpamAssassin::Conf object to make decisions, but it
is up to the perl API caller to decide how to proceede.
Mail::SpamAssassin makes the SQL tools available, but it's up to spampd to
actually call load_scoreonly_sql(). Everything is in there, but spampd
doesn't use it.
http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin.html
There's nothing more for SA to do. It's there, all spampd has to do is make
use of it.
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 2:33 PM, Matt Kettler wrote:
> At 02:21 PM 2/18/2005, Eric A. Hall wrote:
>
>>That's not mutually exclusive, and is actually somewhat inclusive. I mean,
>>if people are using the spamassassin script on a low-volume basis, then
>>there's a low volume of SQL/LDAP lookups, so the complaint is nulled.
>
> True, but it's also intended for users who aren't sophisticated enough to
> run a daemon, in which case they aren't sophisticated enough to run SQL.
At least we're making some progress here... As to the argument about
sophistication, the same could be said for any number of other things in
the spamassassin kit. Seems kind of arbitrary to draw the line here when
we've got more complexity in the various plugins, whitelist and blacklist
maintenance, bayes maintenance, etc. And in a lot of ways, allowing for
per-user SQL/LDAP configs and providing a nice hosted GUI front-end to
their settings removes a lot of that complexity. So from that perspective,
adding it to the spamassassin script would reduce some complexity.
> However, you don't appear to be using the spamassassin command line anyway.
>
>>I'm using a third-party script for the in-line proxy, and it daemonizes
>>spamassassin on its own.
>
> at which point the addition to the spamassassin command-line becomes
> irrelevant, because you aren't using spamassassin. (it's impossible to
> daemonize the spamassassin command line tool.)
>
> You need it added to your third-party script, as, based on your
> description, it's invoking the SA perl API's directly.
http://www.worlddesign.com/index.cfm/rd/mta/spampd.htm is what I'm
currently using. It doesn't provide any additional parameters over regular
spamassassin configs, and whatever I do to spamassassin is picked up
transparently. I'm having a couple problems with some of it (SPF errors
are being picked up and causing problems for it, apparently) but I haven't
found anything else that fits into the postfix->sa->postfix->cyrus model
in a better way so I'm inclined to keep using it.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by Matt Kettler <mk...@evi-inc.com>.
At 02:21 PM 2/18/2005, Eric A. Hall wrote:
>That's not mutually exclusive, and is actually somewhat inclusive. I mean,
>if people are using the spamassassin script on a low-volume basis, then
>there's a low volume of SQL/LDAP lookups, so the complaint is nulled.
True, but it's also intended for users who aren't sophisticated enough to
run a daemon, in which case they aren't sophisticated enough to run SQL.
However, you don't appear to be using the spamassassin command line anyway.
>I'm using a third-party script for the in-line proxy, and it daemonizes
>spamassassin on its own.
at which point the addition to the spamassassin command-line becomes
irrelevant, because you aren't using spamassassin. (it's impossible to
daemonize the spamassassin command line tool.)
You need it added to your third-party script, as, based on your
description, it's invoking the SA perl API's directly.
Re: spamassassin and LDAP lookups
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 2/18/2005 2:17 PM, Matt Kettler wrote:
> At 02:03 PM 2/18/2005, Eric A. Hall wrote:
>
>>http://svn.apache.org/repos/asf/spamassassin/branches/3.0/sql/README
>>(which has a bad MIME-type definition, btw [text/english is not real])
>>says that SQL lookups are only used with spamd, and so presumably they are
>>not used with spamassassin itself. Further poking seems to prove this
>>assumption correct.
>>
>>Is this correct? If so, is there intent on adding this functionality?
>
> I'd be a bit surprised.. the plain "spamassassin" command line isn't really
> well suited to high volume production use. It's more intended for very
> simple setups that handle small amounts of mail.
That's not mutually exclusive, and is actually somewhat inclusive. I mean,
if people are using the spamassassin script on a low-volume basis, then
there's a low volume of SQL/LDAP lookups, so the complaint is nulled.
>>Because of my postfix/SA setup I'm not able to use spamd very easily.
>
> Why not? spamc should be a more-or-less drop in replacement for calls to
> spamassassin once spamd is started...
I'm using a third-party script for the in-line proxy, and it daemonizes
spamassassin on its own.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: spamassassin and LDAP lookups
Posted by Matt Kettler <mk...@evi-inc.com>.
At 02:03 PM 2/18/2005, Eric A. Hall wrote:
>http://svn.apache.org/repos/asf/spamassassin/branches/3.0/sql/README
>(which has a bad MIME-type definition, btw [text/english is not real])
>says that SQL lookups are only used with spamd, and so presumably they are
>not used with spamassassin itself. Further poking seems to prove this
>assumption correct.
>
>Is this correct? If so, is there intent on adding this functionality?
I'd be a bit surprised.. the plain "spamassassin" command line isn't really
well suited to high volume production use. It's more intended for very
simple setups that handle small amounts of mail.
>Because of my postfix/SA setup I'm not able to use spamd very easily.
Why not? spamc should be a more-or-less drop in replacement for calls to
spamassassin once spamd is started...