You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Miguel Angel Rasero Peral (TCOR)" <mr...@tcor.net> on 2005/09/06 17:19:29 UTC
Spamc, spamassassin, different scores
Hello, my system is a redhat 7.3 with this spamassassin versions and i
am using qmail in it.
"""
machine:/etc/mail/spamassassin# spamassassin -V
SpamAssassin version 3.0.1
running on Perl version 5.6.1
machine:/etc/mail/spamassassin# spamc -V
SpamAssassin Client version 3.0.1
"""
The problem that i have is that i only want to launch spamassassin in my
account so i am using my .qmail-file to do it.
| spamassassin | preline procmail -t -m -p ./skuda/procmailrc
I know that i would be launching spamc and not spamassassin perl script
but i get different scores from the 2 programs.
SPAMC:
spamc -r <
skuda/Maildir/.spam/cur/1121844030.M156489P30796V0000000000000303I00436361_2015.betanetweb.com,S=9921:2,S
Spam detection software, running on the system "betanetweb.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: neuroanotomy Incredible Prices on Rx Hurry While
Supplies Last! [...]
Content analysis details: (7.3 points, 4.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
1.5 MPART_ALT_DIFF BODY: HTML and text parts are different
0.3 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.2 HTML_FONT_BIG BODY: HTML tag for a big font size
0.2 HTML_90_100 BODY: Message is 90% to 100% HTML
1.1 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS
records
0.1 DNS_FROM_AHBL_RHSBL RBL: From: sender listed in dnsbl.ahbl.org
3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
[URIs: weofferaselection.com]
0.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
[URIs: weofferaselection.com]
-0.6 AWL AWL: From: address is in the auto white-list
Spamassassin:
spamassassin <
cur/1121844030.M156489P30796V0000000000000303I00436361_2015.betanetweb.com,S=9921:2,S
>>From kybard@wildlifemail.com Fri Nov 12 12:53:26 2004
Received: from localhost by betanetweb.com
with SpamAssassin (version 3.0.1);
Tue, 06 Sep 2005 16:24:08 +0200
From: "VicoRx 6" <ky...@wildlifemail.com>
To: skuda@betanetgeb.com
Subject: *****SPAM***** Your order
Date: Fri, 12 Nov 2004 07:50:35 -0500 (MSD)
Message-Id: <20...@www6.pochta.ru>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on
betanetweb.com
X-Spam-Status: Yes, score=11.0 required=4.0 tests=BAYES_95,
DNS_FROM_AHBL_RHSBL,HTML_90_100,HTML_FONT_BIG,HTML_IMAGE_RATIO_02,
HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,NO_DNS_FOR_FROM,
URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=no version=3.0.1
X-Spam-Level: **********
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_431DA688.5E031C81"
This is a multi-part message in MIME format.
------------=_431DA688.5E031C81
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "betanetweb.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: neuroanotomy Incredible Prices on Rx Hurry While
Supplies Last! [...]
Content analysis details: (11.0 points, 4.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
2.1 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
[score: 0.9714]
0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image
area
1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_FONT_BIG BODY: HTML tag for a big font size
0.0 HTML_90_100 BODY: Message is 90% to 100% HTML
1.6 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS
records
0.3 DNS_FROM_AHBL_RHSBL RBL: From: sender listed in dnsbl.ahbl.org
4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
blocklist
[URIs: weofferaselection.com]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
blocklist
[URIs: weofferaselection.com]
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_431DA688.5E031C81
I dont know what happening, on other side i have any times that email
get my inbox without be analyzed because i cant see in his code the
spamassassin headers i suppose that its because any timeout or by the
way i use in .qmail file to call spamassassin, anyone can help me
please?
Re: Spamc, spamassassin, different scores
Posted by Tim Litwiller <ti...@litwiller.net>.
Miguel Angel Rasero Peral (TCOR) wrote:
> Hello, my system is a redhat 7.3 with this spamassassin versions and i
> am using qmail in it.
> """
> The problem that i have is that i only want to launch spamassassin in my
> account so i am using my .qmail-file to do it.
> | spamassassin | preline procmail -t -m -p ./skuda/procmailrc
>
> I know that i would be launching spamc and not spamassassin perl script
> but i get different scores from the 2 programs.
>
I have this in my .qmail file
| /usr/bin/procmail ~/.procmailrc
and then in .procmailrc I first sort out all my mailing lists by
matching headers and then call spamc and then dump high scores > 14 to
/dev/null and 5 - 14 to a Junk mail folder.
# --------------------------------
# put satalk in it's own folder
# --------------------------------
:0 H:
* ^List-Id:.*users@spamassassin.apache.org
satalk/new
# ---------------------------
# run thru spamassassin
# ---------------------------
:0fw
| spamc
# ---------------------------
# catch high scores
# ---------------------------
:0 H:
* ^X-Spam-Status: +(yes|no), +score=\/[^. ]*
* ? (( ${MATCH} > 14 ))
/dev/null
# ---------------------------
# put the rest in Junk folder
# ---------------------------
:0 H:
* ^X-Spam-Status: Yes.*
Junk/new
I get the same score with spamc and spamassassin - different scores
would indicate that you aren't running thru the same rulesets or bayes.
> Content analysis details: (7.3 points, 4.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 1.5 MPART_ALT_DIFF BODY: HTML and text parts are different
> 0.3 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
> MIME
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.2 HTML_FONT_BIG BODY: HTML tag for a big font size
> 0.2 HTML_90_100 BODY: Message is 90% to 100% HTML
> 1.1 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS
> records
> 0.1 DNS_FROM_AHBL_RHSBL RBL: From: sender listed in dnsbl.ahbl.org
> 3.9 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
> blocklist
> [URIs: weofferaselection.com]
> 0.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
> blocklist
> [URIs: weofferaselection.com]
> -0.6 AWL AWL: From: address is in the auto white-list
>
>
> Content analysis details: (11.0 points, 4.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
> 2.1 BAYES_95 BODY: Bayesian spam probability is 95 to 99%
> [score: 0.9714]
> 0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image
> area
> 1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
> MIME
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.1 HTML_FONT_BIG BODY: HTML tag for a big font size
> 0.0 HTML_90_100 BODY: Message is 90% to 100% HTML
> 1.6 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS
> records
> 0.3 DNS_FROM_AHBL_RHSBL RBL: From: sender listed in dnsbl.ahbl.org
> 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL
> blocklist
> [URIs: weofferaselection.com]
> 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL
> blocklist
> [URIs: weofferaselection.com]
>
> I dont know what happening, on other side i have any times that email
> get my inbox without be analyzed because i cant see in his code the
> spamassassin headers i suppose that its because any timeout or by the
> way i use in .qmail file to call spamassassin, anyone can help me
> please?
>
Re: Spamc, spamassassin, different scores
Posted by "Miguel Angel Rasero Peral (TCOR)" <mr...@tcor.net>.
Yeah this was my problems, Thanks.
El mar, 06-09-2005 a las 12:00 -0400, Matt Kettler escribió:
> Andy Jezierski wrote:
> >
> >
> > Are you running the spamassassin command under the same userid as spamd
> > is running under? Looks like spamd is using bayes that spamassassin did
> > not have, and spamassassin had a negative AWL score that spamd didn't
> > have.
>
>
> Definitely not.
>
> Look at the prompts. Miguel is running spamassassin as root.
>
> Miguel is running spamc as root, but spamd will *NEVER* scan mail as root. It
> will setuid itself to nobody if it finds this situation.
>
> This causes a huge difference, because only the root account has bayes training,
> but spamd will never use it.
>
> Notice that the spamassassin (run as root) version has BAYES_95 matching, but
> the spamc one does not.
>
> Miguel, this is your problem: you can't train with sa-learn as root and expect
> this to impact mail run through spamc, unless you set up a global bayes database.
>
> Ideally, I'd suggest creating a "spamd" user, and running spamd with -u spamd.
> Then when you train mail with sa-learn, just su yourself to spamd first. This
> way everything all gets scanned using the same bayes db. You also get the
> security benefit of all scanning being done as a user that isn't used for
> anything else.
>
> If that's not practical, use bayes_path and bayes_file_mode 0777 together in
> your local.cf to create a single bayes DB that gets used no matter what user
> calls SA.
>
> (Warnings: use bayes_file_mode 0777, not 0666. Also, read the docs on bayes_path
> very carefully. It's not just a path. The last part is actually the start of a
> filename, not a directory name)
>
>
>
Re: [sa-list] Re: Spamc, spamassassin, different scores
Posted by Matt Kettler <mk...@evi-inc.com>.
Dan Mahoney, System Admin wrote:
>>
>> Definitely not.
>>
>> Look at the prompts. Miguel is running spamassassin as root.
>>
>> Miguel is running spamc as root, but spamd will *NEVER* scan mail as
>> root. It
>> will setuid itself to nobody if it finds this situation.
>
>
> At least, not on a recent version -- this was a rather prominent bug
> under many OSen.
Very true, that is a definite caveat to my statement that "spamd will never scan
mail as root". I suppose a better statement would be "spamd should never scan
mail as root".
That said, AFAIK the "many OSen" are limited *BSD variants, including Mac OS X.
In this case RedHat is the OS, which is Linux kernel based, which I think is
immune to this issue due to differences in how the Linux kernel handles setuid
as compared to the BSD kernel.
Re: [sa-list] Re: Spamc, spamassassin, different scores
Posted by "Dan Mahoney, System Admin" <da...@prime.gushi.org>.
On Tue, 6 Sep 2005, Matt Kettler wrote:
> Andy Jezierski wrote:
>>
>>
>> Are you running the spamassassin command under the same userid as spamd
>> is running under? Looks like spamd is using bayes that spamassassin did
>> not have, and spamassassin had a negative AWL score that spamd didn't
>> have.
>
>
> Definitely not.
>
> Look at the prompts. Miguel is running spamassassin as root.
>
> Miguel is running spamc as root, but spamd will *NEVER* scan mail as root. It
> will setuid itself to nobody if it finds this situation.
At least, not on a recent version -- this was a rather prominent bug under
many OSen.
--
"One...plus two...plus one...plus one."
-Tim Curry, Clue
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
Re: Spamc, spamassassin, different scores
Posted by Matt Kettler <mk...@evi-inc.com>.
Andy Jezierski wrote:
>
>
> Are you running the spamassassin command under the same userid as spamd
> is running under? Looks like spamd is using bayes that spamassassin did
> not have, and spamassassin had a negative AWL score that spamd didn't
> have.
Definitely not.
Look at the prompts. Miguel is running spamassassin as root.
Miguel is running spamc as root, but spamd will *NEVER* scan mail as root. It
will setuid itself to nobody if it finds this situation.
This causes a huge difference, because only the root account has bayes training,
but spamd will never use it.
Notice that the spamassassin (run as root) version has BAYES_95 matching, but
the spamc one does not.
Miguel, this is your problem: you can't train with sa-learn as root and expect
this to impact mail run through spamc, unless you set up a global bayes database.
Ideally, I'd suggest creating a "spamd" user, and running spamd with -u spamd.
Then when you train mail with sa-learn, just su yourself to spamd first. This
way everything all gets scanned using the same bayes db. You also get the
security benefit of all scanning being done as a user that isn't used for
anything else.
If that's not practical, use bayes_path and bayes_file_mode 0777 together in
your local.cf to create a single bayes DB that gets used no matter what user
calls SA.
(Warnings: use bayes_file_mode 0777, not 0666. Also, read the docs on bayes_path
very carefully. It's not just a path. The last part is actually the start of a
filename, not a directory name)
Re: Spamc, spamassassin, different scores
Posted by Andy Jezierski <aj...@stepan.com>.
"Miguel Angel Rasero Peral (TCOR)" <mr...@tcor.net> wrote on 09/06/2005
10:19:29 AM:
>
> Hello, my system is a redhat 7.3 with this spamassassin versions and i
> am using qmail in it.
> """
> machine:/etc/mail/spamassassin# spamassassin -V
> SpamAssassin version 3.0.1
> running on Perl version 5.6.1
> machine:/etc/mail/spamassassin# spamc -V
> SpamAssassin Client version 3.0.1
> """
>
> The problem that i have is that i only want to launch spamassassin in my
> account so i am using my .qmail-file to do it.
> | spamassassin | preline procmail -t -m -p ./skuda/procmailrc
>
> I know that i would be launching spamc and not spamassassin perl script
> but i get different scores from the 2 programs.
>
Are you running the spamassassin command under the same userid as spamd is
running under? Looks like spamd is using bayes that spamassassin did not
have, and spamassassin had a negative AWL score that spamd didn't have.
Andy