IspConfig Amavis Spam Header Problem

Discussion in 'Installation/Configuration' started by Joffrey, Sep 13, 2017.

  1. Joffrey

    Joffrey New Member

    Hi everyone , i had a problem with amavis and spam detection.
    if an email is send from gmail, in the header of ispconfig mailbox i have :
    and it's ok. but if other provider send me email, i have :
    and so no spam detection working and i had plenty of spam in my mailbox.

    Do you have any idea why ? I attach my postfix conf and the report of php common issue
    thanks a lot
    Joffrey

    result php common issue :

    Code:
    ##### SERVER #####
    IP-address (as per hostname): [localhost]
    IP-address(es) (as per ifconfig): ***.***.***.***
    [WARN] ip addresses from hostname differ from ifconfig output. Please check your ip settings.
    [INFO] ISPConfig is installed.
    
    ##### ISPCONFIG #####
    ISPConfig version is 3.1.6
    
    
    ##### VERSION CHECK #####
    
    [INFO] php (cli) version is 5.6.31-1~dotdeb+7.1
    
    ##### PORT CHECK #####
    
    [WARN] Port 22 (SSH server) seems NOT to be listening
    
    ##### MAIL SERVER CHECK #####
    
    [WARN] I found no "submission" entry in your postfix master.cf
    [INFO] this is not critical, but if you want to offer port 587 for smtp connections you have to enable this.
    
    ##### RUNNING SERVER PROCESSES #####
    
    [INFO] I found the following web server(s):
        Apache 2 (PID 25427)
    [INFO] I found the following mail server(s):
        Postfix (PID 25864)
    [INFO] I found the following pop3 server(s):
        Courier Mailserver (PID 25363)
    [INFO] I found the following imap server(s):
        Courier Mailserver (PID 25317)
    [INFO] I found the following ftp server(s):
        PureFTP (PID 25454)
    
    ##### LISTENING PORTS #####
    (only        ()
    Local        (Address)
    [localhost]:10024        (24202/amavisd-new)
    [localhost]:10025        (25864/master)
    [localhost]:10026        (24202/amavisd-new)
    [localhost]:3306        (22572/mysqld)
    [localhost]:10027        (25864/master)
    [anywhere]:111        (1540/rpcbind)
    [anywhere]:8080        (25427/apache2)
    [anywhere]:80        (25427/apache2)
    [anywhere]:465        (25864/master)
    [anywhere]:8081        (25427/apache2)
    [anywhere]:8852        (3820/sshd)
    ***.***.***.***:53        (25478/named)
    [localhost]:53        (25478/named)
    [anywhere]:21        (25454/pure-ftpd)
    [anywhere]:25        (25864/master)
    [localhost]:953        (25478/named)
    [anywhere]:443        (25427/apache2)
    *:*:*:*::*:993        (25343/couriertcpd)
    *:*:*:*::*:995        (25384/couriertcpd)
    [localhost]10        (25363/couriertcpd)
    [localhost]43        (25317/couriertcpd)
    [localhost]11        (1540/rpcbind)
    *:*:*:*::*:465        (25864/master)
    *:*:*:*::*:8852        (3820/sshd)
    *:*:*:*::*:53        (25478/named)
    *:*:*:*::*:21        (25454/pure-ftpd)
    *:*:*:*::*:25        (25864/master)
    
    
    
    
    ##### IPTABLES #####
    Chain INPUT (policy DROP)
    target     prot opt source               destination        
    fail2ban-courierauth  tcp  --  [anywhere]/0            [anywhere]/0            multiport dports 25,465,143,220,993,110,995
    fail2ban-postfix  tcp  --  [anywhere]/0            [anywhere]/0            multiport dports 25,465
    fail2ban-apache-phpmyadmin  tcp  --  [anywhere]/0            [anywhere]/0            multiport dports 80,443
    fail2ban-sasl  tcp  --  [anywhere]/0            [anywhere]/0            multiport dports 25,465,143,220,993,110,995
    ACCEPT     all  --  [anywhere]/0            [anywhere]/0          
    ACCEPT     all  --  [anywhere]/0            [anywhere]/0          
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:8852
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:80
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:8080
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:443
    ACCEPT     udp  --  [anywhere]/0            [anywhere]/0            udp spts:1024:65535 dpt:53
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:143
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:993
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:110
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:995
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:25
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:465
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:587
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpt:21
    ACCEPT     tcp  --  [anywhere]/0            [anywhere]/0            tcp dpts:29799:29899
    ACCEPT     all  --  [anywhere]/0            [anywhere]/0            state RELATED,ESTABLISHED
    ACCEPT     all  --  [anywhere]/0            [anywhere]/0            state NEW
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination        
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination        
    ACCEPT     udp  --  [anywhere]/0            [anywhere]/0            udp spts:1024:65535 dpt:53
    
    Chain fail2ban-apache-phpmyadmin (1 references)
    target     prot opt source               destination        
    DROP       all  --  ***.***.***.***        [anywhere]/0          
    DROP       all  --  ***.***.***.***       [anywhere]/0          
    DROP       all  --  ***.***.***.***         [anywhere]/0          
    DROP       all  --  ***.***.***.***        [anywhere]/0          
    RETURN     all  --  [anywhere]/0            [anywhere]/0          
    
    Chain fail2ban-courierauth (1 references)
    target     prot opt source               destination        
    DROP       all  --  ***.***.***.***      [anywhere]/0          
    RETURN     all  --  [anywhere]/0            [anywhere]/0          
    
    Chain fail2ban-postfix (1 references)
    target     prot opt source               destination        
    DROP       all  --  ***.***.***.***       [anywhere]/0          
    RETURN     all  --  [anywhere]/0            [anywhere]/0          
    
    Chain fail2ban-sasl (1 references)
    target     prot opt source               destination        
    DROP       all  --  ***.***.***.***        [anywhere]/0          
    RETURN     all  --  [anywhere]/0            [anywhere]/0          
    
    
    
     

    Attached Files:

  2. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    tagged_above - specifies the value from which the "spam lines" are inserted into the header. Check the SPAM tag level for the Spamfilter policy.
     
  3. Joffrey

    Joffrey New Member

    Hi, thanks for your answer.
    why in some header i have
    and in some header, i don't see X-Spam ... ?
    i attach the screenshot of SPAM tag level.
    I use the strategy "Normal" of anti spam on this mailbox (and this domain)


    Joffrey
     

    Attached Files:

  4. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    Each mail gets an individual score from spamassassin. If the score is < your SPAM tag level (0.70), you will not see the additional lines.
     
  5. Joffrey

    Joffrey New Member

    Ok, i didn't know that. how can i do to see the spam tag level of one spam? put tag level value 0 and then check the header of email that i receive in my mailbox, who is spam but amavis didn't recognise it ?
    thanks
     
  6. Joffrey

    Joffrey New Member

    i make a test, i configure my anti-spam strategy like the princtscreen, so normally all my email's object does contain **, no?
    this is not the case, some email have it, some not
     

    Attached Files:

  7. till

    till Super Moderator Staff Member ISPConfig Developer

    Ensure to set the filter policy on the domain as well and not just on the mailbox. when you receive emails trough aliases, then these will use the domain wide policy.
     
  8. Joffrey

    Joffrey New Member

    Ok thanks, last question, spam assassin tagg some spam with this score :
    X-Virus-Scanned: Debian amavisd-new at www.*******.be
    X-Spam-Flag: NO
    X-Spam-Score: -0.098
    X-Spam-Level:
    X-Spam-Status: No, score=-0.098 tagged_above=-1.7 required=0.8

    is it normal to have spam with negative score ? thanks a lot
    Joffrey
     
  9. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes. The score is the sum of the applied rules and there are trust rules (negative score) and spam rules (positive score), so a trusted mail can get a negative score as well.
     
  10. Joffrey

    Joffrey New Member

    thanks for your answer, unfortunately, 75% of spam had a score of -0.9 . there is somewhere a list with this rules? my filter spam is normal (see last post) but with tag level 0.00 and tag level2 2.00, so much spam in my mailbox.
    thanks

    Joffrey

    [edit]
    in all my spam, the test BAYES_00 is always at -1.9 ? i will search about that
    X-Spam-Status: No, score=0.351 tagged_above=-1.8 required=0.8 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_BRBL_LASTEXT=1.449, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=no
     
  11. till

    till Super Moderator Staff Member ISPConfig Developer

    Seems as if your Bayes filter (self learning spam detection system) has learnt something wrong "BAYES_00=-1.9". You should remove the bayes db so that it starts to learn again from scratch 8or seed it with known ham / spam messages to speed up the learning process.
     
  12. Joffrey

    Joffrey New Member

    ok thanks, i remove de bays db
    Code:
    su amavis -c 'sa-learn --clear'
    then recreate the db with one mail
    Code:
    su amavis -c 'printf "\n\nHello World\n" |  sa-learn --ham'
    
    Then the db was created
    Code:
    Sep 18 11:39:26.300 [25661] dbg: bayes: found bayes db version 3
    0.000          0          3          0  non-token data: bayes db version
    0.000          0          0          0  non-token data: nspam
    0.000          0          2          0  non-token data: nham
    0.000          0        549          0  non-token data: ntokens
    0.000          0 1505726653          0  non-token data: oldest atime
    0.000          0 1505727152          0  non-token data: newest atime
    0.000          0          0          0  non-token data: last journal sync atime
    0.000          0          0          0  non-token data: last expiry atime
    0.000          0          0          0  non-token data: last expire atime delta
    0.000          0          0          0  non-token data: last expire reduction count
    Sep 18 11:39:26.300 [25661] dbg: bayes: untie-ing
    
    the i force sa-learn to re-scan all mailbox for learning spam. i will check the next mail the spam score.
    the sa-learn command must be launch under vmail user for amavis?
    thanks
     
  13. till

    till Super Moderator Staff Member ISPConfig Developer

    The user should be amavis.
     
  14. Joffrey

    Joffrey New Member

    ok. i will see the result with this renew of db, i will search for quick learning thanks
     
  15. Joffrey

    Joffrey New Member

    For information, i use this command learning :

    Code:
    sa-learn --username=amavis --spam --dir /var/vmail/*/*/*
    Joffrey
     
  16. Joffrey

    Joffrey New Member

    Just last question and after i stop :)
    Does anyone know why when i run this two command, the results are different? thanks a lot

    Code:
    [email protected]:~# sa-learn --username=amavis --dump magic
    0.000          0          3          0  non-token data: bayes db version
    0.000          0        654          0  non-token data: nspam
    0.000          0       1432          0  non-token data: nham
    0.000          0     210612          0  non-token data: ntokens
    0.000          0 1428938461          0  non-token data: oldest atime
    0.000          0 1505730672          0  non-token data: newest atime
    0.000          0 1505730749          0  non-token data: last journal sync atime
    0.000          0 1505727067          0  non-token data: last expiry atime
    0.000          0     691200          0  non-token data: last expire atime delta
    0.000          0      69049          0  non-token data: last expire reduction count
    [email protected]:~# su amavis -c 'sa-learn  --dump magic'
    0.000          0          3          0  non-token data: bayes db version
    0.000          0          0          0  non-token data: nspam
    0.000          0          6          0  non-token data: nham
    0.000          0        820          0  non-token data: ntokens
    0.000          0 1505726653          0  non-token data: oldest atime
    0.000          0 1505730621          0  non-token data: newest atime
    0.000          0          0          0  non-token data: last journal sync atime
    0.000          0          0          0  non-token data: last expiry atime
    0.000          0          0          0  non-token data: last expire atime delta
    0.000          0          0          0  non-token data: last expire reduction count
    
     
  17. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    man su:
    For backward compatibility, su defaults to not change the current directory and to only set the environment variables HOME and SHELL (plus USER and LOGNAME if the target user is not root). It is recommended to always use the --login option (instead of its shortcut -) to avoid side effects caused by mixing environments.
     
  18. Joffrey

    Joffrey New Member

    Ok thanks. after reseting bayes db's, anti-spam works fine.
    last question, is that the end user can modify the white list filter on its own?
     

Share This Page