Amavis with Spamassassin

Discussion in 'ISPConfig 3 Priority Support' started by admins, Apr 29, 2015.

  1. admins

    admins Member

    Hi all
    Wehre could I see if Amavis load spamassassin correctly?
    How could I check it?

    Thx
    adminst
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Restart amavis, you can see it then in the mail log file.
     
  3. admins

    admins Member

    Seems to be good:
    Apr 29 14:21:40 srv1 amavis[6523]: Module Amavis::Conf 2.303
    Apr 29 14:21:40 srv1 amavis[6523]: Module Archive::Zip 1.39
    Apr 29 14:21:40 srv1 amavis[6523]: Module BerkeleyDB 0.54
    Apr 29 14:21:40 srv1 amavis[6523]: Module Compress::Zlib 2.064
    Apr 29 14:21:40 srv1 amavis[6523]: Module Convert::TNEF 0.18
    Apr 29 14:21:40 srv1 amavis[6523]: Module Convert::UUlib 1.4
    Apr 29 14:21:40 srv1 amavis[6523]: Module Crypt::OpenSSL::RSA 0.28
    Apr 29 14:21:40 srv1 amavis[6523]: Module DBD::mysql 4.028
    Apr 29 14:21:40 srv1 amavis[6523]: Module DBI 1.631
    Apr 29 14:21:40 srv1 amavis[6523]: Module DB_File 1.831
    Apr 29 14:21:40 srv1 amavis[6523]: Module Digest::MD5 2.53
    Apr 29 14:21:40 srv1 amavis[6523]: Module Digest::SHA 5.88
    Apr 29 14:21:40 srv1 amavis[6523]: Module File::Temp 0.2304
    Apr 29 14:21:40 srv1 amavis[6523]: Module IO::Socket::INET6 2.72
    Apr 29 14:21:40 srv1 amavis[6523]: Module MIME::Entity 5.505
    Apr 29 14:21:40 srv1 amavis[6523]: Module MIME::parser 5.505
    Apr 29 14:21:40 srv1 amavis[6523]: Module MIME::Tools 5.505
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::DKIM::Signer 0.4
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::DKIM::Verifier 0.4
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::Header 2.13
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::Internet 2.13
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::SPF v2.009
    Apr 29 14:21:40 srv1 amavis[6523]: Module Mail::SpamAssassin 3.004000
    Apr 29 14:21:40 srv1 amavis[6523]: Module Net::DNS 0.81
    Apr 29 14:21:40 srv1 amavis[6523]: Module Net::Server 2.008
    Apr 29 14:21:40 srv1 amavis[6523]: Module NetAddr::IP 4.075
    Apr 29 14:21:40 srv1 amavis[6523]: Module Razor2::Client::Version 2.84
    Apr 29 14:21:40 srv1 amavis[6523]: Module Socket6 0.25
    Apr 29 14:21:40 srv1 amavis[6523]: Module Time::HiRes 1.9726
    Apr 29 14:21:40 srv1 amavis[6523]: Module URI 1.64
    Apr 29 14:21:40 srv1 amavis[6523]: Module Unix::Syslog 1.1
    Apr 29 14:21:40 srv1 amavis[6523]: Amavis::DB code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: SQL base code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: SQL::Log code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: SQL::Quarantine NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Lookup::SQL code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Lookup::LDAP code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: AM.PDP-in proto code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: SMTP-in proto code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Courier proto code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: SMTP-out proto code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Pipe-out proto code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: BSMTP-out proto code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Local-out proto code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: OS_Fingerprint code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: ANTI-VIRUS code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-EXT code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-C code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: ANTI-SPAM-SA code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Unpackers code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: DKIM code loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Tools code NOT loaded
    Apr 29 14:21:40 srv1 amavis[6523]: Found $file at /usr/bin/file
    Apr 29 14:21:40 srv1 amavis[6523]: No $altermime, not using it
    Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .mail
    Apr 29 14:21:40 srv1 amavis[6523]: No decoder for .F
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .Z at /bin/uncompress
    Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .gz
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .bz2 at /bin/bzip2 -d
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .xz at /usr/bin/xz -dc
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .lzma at /usr/bin/xz -dc --format=lzma
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .lzo at /usr/bin/lzop -d
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .rpm at /usr/bin/rpm2cpio
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .cpio at /bin/pax
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .tar at /bin/pax
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .deb at /usr/bin/ar
    Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .zip
    Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .kmz
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .7z at /usr/bin/7zr
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .rar at /usr/bin/unrar-
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .arj at /usr/bin/arj
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .arc at /usr/bin/nomarc
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .zoo at /usr/bin/zoo
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .doc at /usr/bin/ripole
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .cab at /usr/bin/cabext
    Apr 29 14:21:40 srv1 amavis[6523]: No decoder for .tnef
    Apr 29 14:21:40 srv1 amavis[6523]: Internal decoder for .tnef
    Apr 29 14:21:40 srv1 amavis[6523]: Found decoder for .exe at /usr/bin/unrar-
    Apr 29 14:21:40 srv1 amavis[6523]: Using primary internal av scanner code for Cl
    Apr 29 14:21:40 srv1 amavis[6523]: Found secondary av scanner ClamAV-clamscan at
    Apr 29 14:21:40 srv1 amavis[6523]: Deleting db files __db.003,__db.001,nanny.db,
    Apr 29 14:21:40 srv1 amavis[6523]: Creating db in /var/lib/amavis/db/; BerkeleyD


    I've sended a mail from external to the mailbox with this body:
    This is the GTUBE, the

    Generic

    Test for

    Unsolicited

    Bulk

    Email


    If your spam filter supports it, the GTUBE provides a test by which you can verify that the filter is installed correctly and is detecting incoming spam. You can send yourself a test mail containing the following string of characters (in upper case and with no white spaces and line breaks):

    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

    You should send this test mail from an account outside of your network.

    It will not be filterd....
    Whats wrong?

    Thx
    admins
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    It might just be that your test string is not supported. I never used that on amavis. Set spam tag 1 level to -100 for the spamfilter policy that you use in ispconfig, then check the header of the recieved email and the amavis line from mail.log that you get for this email.
     
  5. admins

    admins Member

    I've following there:
    $sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
    $sa_tag2_level_deflt = 3.5; # add 'spam detected' headers at that level
    $sa_kill_level_deflt = 4.5; # triggers spam evasive actions
    $sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent

    May I don't see the entrys wich sa shout set.
     
  6. admins

    admins Member

    Mailheader:
    Received: from srv1.domain.ch ([127.0.0.1])
    by localhost (srv1.domain.ch [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id rv33rNw7JUjI for <[email protected]>;
    Wed, 29 Apr 2015 14:41:40 +0200 (CEST)
    Received: from localhost (localhost [127.0.0.1])
    by srv1.domain.ch (Postfix) with ESMTP id 794421480012
    for <[email protected]>; Wed, 29 Apr 2015 14:41:40 +0200 (CEST)
    Received: from localhost (localhost [127.0.0.1])
    (uid 23000)
    by blabla2.ch with local; Wed, 29 Apr 2015 14:41:39 +0200
    id 00000000000F4014.000000005540D183.00007B46
    Received: from blabla2.ch (enfront5.inf.edf.ch [IP])
    by srv1.domain.ch (Postfix) with ESMTPS
    for <[email protected]>; Wed, 29 Apr 2015 14:41:40 +0200 (CEST)
    Return-Path: <[email protected]2.ch>
    Reply-To: <[email protected]2.ch>
    From: <[email protected]2.ch>
    To: <[email protected]>
    Subject: [SPAM] test
    Date: Wed, 29 Apr 2015 14:41:39 +0200
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: text/plain;
    charset="iso-8859-1"
    Content-Transfer-Encoding: 7bit
    Thread-Index: AQDkCwwcCR0R0mbNoZ8L0j4zcsEPBg==
    Content-Language: de
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    This meal has not been scanned by amavis, otherwise it would contain a header like this:

    X-Virus-Scanned: Debian amavisd-new at server1.example.com

    Did you select a spamfilter policy in ispconfig for this mailbox? Dos this show up under spammfilter > user/domain in ispconfig and has this record set "local => yes"? Does this spamfilter policy has the spam checks enabled and is virus, spam, bad header lover set to no?
     
  8. admins

    admins Member

    Viruslover etc. = no
    local = yes
    Mailbox yes
    X-Virus-Scanned header is in the mail.
    May no Spamassassin header entry
     
  9. till

    till Super Moderator Staff Member ISPConfig Developer

    The x virus scanned header means that amavis incl. spamassasin has been run, there is no separate header for spam scanning. Only in case that the spam score of a email exceeds the level that is set as spam tag level in the spamfilter policy, then amavis will add detailed infos which spamfilter rules got matched in that email.
     
  10. admins

    admins Member

  11. admins

    admins Member

    I've turned down the spamtaglevel2 to -800. No spamtag, no header entry, amavis pass
     
  12. till

    till Super Moderator Staff Member ISPConfig Developer

    Not the tag2 level, you have to set the tag level (the other field) to -100.
     
  13. admins

    admins Member

    Till, do you've time to look quickly to my server?

    It's much faster. We can post the solution after that
    Stefan
     
  14. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    Did you check that @local_domains_acl matches your hostname?
     
  15. till

    till Super Moderator Staff Member ISPConfig Developer

    Here the soluton, in case that someone finds this thread. The tests were done on port 587 and amavis had a policy bank for the submission port in its config file that disables spam scans:

    /ETC/AMAVIS/CONF.D/40-POLICY_BANKS: BYPASS_SPAM_CHECKS_MAPS => [1],
     

Share This Page