You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Борис Кукушкин <bk...@gmail.com> on 2016/01/14 08:21:44 UTC
AWL on per-user basis
I'm using Spamassassin 3.4.0 on Debian Jessie and trying to set up AWL
stored in SQL on a per-user basis. My setup is as follows:
1) Spamassassin is run as 'spamd' on behalf of user root, the options
string is as follows:
OPTIONS="-D --create-prefs -x -q -Q --max-children 5 --helper-home-dir -i
<MY_IP> --allow-tell --allowed-ips=<MY_REMOTE_IPS>"
2) Spamd is called by spamc (evoked by Exim) over TCP from one of the
MY_REMOTE_IPS host as follows:
/usr/bin/spamc -F /etc/spamc/spamc.conf -u $local_part@$domain
3) The contents of /etc/spamc/spamc.conf is as follows:
=== spamc.conf ===
# Hosts to connect to
-d <MY_IP>
-t 150
-n 150
--headers
================
Lets say, I'm sending a message from aaa@aaa.aaa to fff@fff.fff.
The problem I'm facing with is that when AWL table is filled in, the
'username' field is updated with 'nobody' string while I would expect it to
become 'fff@fff.fff'. At the same time, 'email' field is updated with
'aaa@aaa.aaa', exactly as I expected it to.
I know about the option 'user_awl_sql_override_username' but not sure if I
can set it to some variable that contains the username that was passed by
Exim? Otherwise I found this message:
http://www.gossamer-threads.com/lists/spamassassin/users/105838?search_string=AWL%20username%20nobody;#105838.
According to it, I can't have per-user AWL in my setup.
So, is it possible to create a per-user AWL in a global database? Any hint
would be much appreciated!
B.R.
Boris
Re: AWL on per-user basis
Posted by Борис Кукушкин <bk...@gmail.com>.
Good day!
You were completely right: after I added '-u debian-spamd' (this user was
automatically created at the time of package installation) to the spamd
start string in the /etc/default/spamassassin AWL started working right as
expected. The database is now filled almost as expected:
*************************** 9. row ***************************
username: mmm@mmm.mmm
email: fff@fff.fff
ip: none
count: 1
totscore: 0.179
signedby:
Thank you for your advice!
What bothers me now are the values of the 'ip' and 'signedby' fields: I
don't seem to understand what they are needed for and whether the data that
they contain is of any importance? If there is a link to read, I will be
glad to follow it.
I have a suspicion that IP address will be set as soon as I will start
sending and receiving mail to/from remote hosts that are not on my
'allowed-ips' list. Can you confirm? Unfortunately, I can't test receiving
right now -- I'm on a development environment. But what about the
'signedby' field?
Boris
On 16 January 2016 at 17:36, RW <rw...@googlemail.com> wrote:
> On Sat, 16 Jan 2016 15:07:36 +0300
> ????? ???????? wrote:
>
>
> > No, spamd is running as user "root", so I don't have the "-u" key
> > anywhere in the smapd configs. I'm sorry for not making this clear
> > enough.
> >
> > What I meant to say is that when I send or receive a message through
> > my Exim (on the remote host) it passes the message to the spamd by
> > calling a locally installed (i.e. installed on the same host where
> > Exim is) spamc binary with the following command: "spamc
> > -F /etc/spamc/spamc.conf -u $local_part@$domain". Unfortunately, I am
> > still unable to get this setup working properly with AWL, as username
> > in the AWL table is set to "nobody".
>
>
> Running spamd without -u is intended to support unix account users. In
> this case the spamd child process drops its privileges from root to the
> user running spamc or the user specified by spamc -u. This allows spamd
> to access home directories without running as root. Probably what's
> happening is that as $local_part@$domain isn't a unix user, spamd is
> overriding it with the unix user "nobody" to avoid scanning an email as
> root.
>
> You should be running spamd with "-u spamd" which causes spamd to drop
> its privileges to the unprivileged user spamd after it has bound to
> the default port (it's usually called spamd, but your spamassassin
> package may have created some other user for this purpose). When you do
> this, the user in spamc -u can be treated as a virtual user.
>
>
>
>
Re: AWL on per-user basis
Posted by RW <rw...@googlemail.com>.
On Sat, 16 Jan 2016 15:07:36 +0300
????? ???????? wrote:
> No, spamd is running as user "root", so I don't have the "-u" key
> anywhere in the smapd configs. I'm sorry for not making this clear
> enough.
>
> What I meant to say is that when I send or receive a message through
> my Exim (on the remote host) it passes the message to the spamd by
> calling a locally installed (i.e. installed on the same host where
> Exim is) spamc binary with the following command: "spamc
> -F /etc/spamc/spamc.conf -u $local_part@$domain". Unfortunately, I am
> still unable to get this setup working properly with AWL, as username
> in the AWL table is set to "nobody".
Running spamd without -u is intended to support unix account users. In
this case the spamd child process drops its privileges from root to the
user running spamc or the user specified by spamc -u. This allows spamd
to access home directories without running as root. Probably what's
happening is that as $local_part@$domain isn't a unix user, spamd is
overriding it with the unix user "nobody" to avoid scanning an email as
root.
You should be running spamd with "-u spamd" which causes spamd to drop
its privileges to the unprivileged user spamd after it has bound to
the default port (it's usually called spamd, but your spamassassin
package may have created some other user for this purpose). When you do
this, the user in spamc -u can be treated as a virtual user.
Re: AWL on per-user basis
Posted by Борис Кукушкин <bk...@gmail.com>.
Good day!
Thanks for your reply.
No, spamd is running as user "root", so I don't have the "-u" key anywhere
in the smapd configs. I'm sorry for not making this clear enough.
What I meant to say is that when I send or receive a message through my
Exim (on the remote host) it passes the message to the spamd by calling a
locally installed (i.e. installed on the same host where Exim is) spamc
binary with the following command: "spamc -F /etc/spamc/spamc.conf -u
$local_part@$domain". Unfortunately, I am still unable to get this setup
working properly with AWL, as username in the AWL table is set to "nobody".
Looking forward to your reply,
Boris
On 14 January 2016 at 17:49, RW <rw...@googlemail.com> wrote:
> On Thu, 14 Jan 2016 10:21:44 +0300
> ????? ???????? wrote:
>
> > I'm using Spamassassin 3.4.0 on Debian Jessie and trying to set up AWL
> > stored in SQL on a per-user basis. My setup is as follows:
> >
> > 1) Spamassassin is run as 'spamd' on behalf of user root, the options
> > string is as follows:
>
> Is spamd getting "-u spamd" or "--username=spamd" from some other
> part of the configuration? In my experience you still need this even if
> you start the daemon directly as spamd.
>
> > OPTIONS="-D --create-prefs -x -q -Q --max-children 5
> > --helper-home-dir -i <MY_IP> --allow-tell
> > --allowed-ips=<MY_REMOTE_IPS>"
>
Re: AWL on per-user basis
Posted by RW <rw...@googlemail.com>.
On Thu, 14 Jan 2016 10:21:44 +0300
????? ???????? wrote:
> I'm using Spamassassin 3.4.0 on Debian Jessie and trying to set up AWL
> stored in SQL on a per-user basis. My setup is as follows:
>
> 1) Spamassassin is run as 'spamd' on behalf of user root, the options
> string is as follows:
Is spamd getting "-u spamd" or "--username=spamd" from some other
part of the configuration? In my experience you still need this even if
you start the daemon directly as spamd.
> OPTIONS="-D --create-prefs -x -q -Q --max-children 5
> --helper-home-dir -i <MY_IP> --allow-tell
> --allowed-ips=<MY_REMOTE_IPS>"