No spamassasin headers?

Discussion in 'Server Operation' started by yucktoufoo, Mar 4, 2011.

  1. yucktoufoo

    yucktoufoo New Member

    Hi all,

    I recently installed ispconfig3 and postfix with spam assassin. Was working fine but today I seem to get a large amount of spam. I checked the headers and there is no X-Spam headers in my email at all.

    I checked to see if spam assassin was running, it is and I can connect to the socket. I also telnet to my server and send g-tube which is correctly removed as spam.

    I check the size of my emails, they are all less than 100k so should be no problem there.

    Its been a while since I looked at spamassassin but IIRC the spam score header should always be present?

    Any ideas?
     
  2. falko

    falko Super Moderator ISPConfig Developer

    Are there any errors in your mail log (in the /var/log/ directory)?
     
  3. yucktoufoo

    yucktoufoo New Member

    Not that I can see, in fact there is very little reference to spamd in maillog at all. The only entries that are in there are related to me stopping and starting the spamassassin daemon.


    Its odd because some stuff is getting scored and is removed from the queue but other emails which are most definitely spam (and would surely be detected by SA) are not. As I mentioned before, no X-Spam headers at all.

    Heres a sample email, whether or not you personaly classify it as spam is neither here nor there, it should still have some X-Spam headers right?

    Code:
    Return-Path: <[email protected]>
    Delivered-To: _REMOVED_@_REMOVED_.com
    Received: from localhost (unknown [127.0.0.1])
            by mailgate._REMOVED_.com (Postfix) with ESMTP id 441F5B2078
            for <_REMOVED_@_REMOVED_.com>; Fri,  4 Mar 2011 20:35:43 +0000 (UTC)
    X-Virus-Scanned: amavisd-new at _REMOVED_.vm.bytemark.co.uk
    Received: from mailgate._REMOVED_.com ([127.0.0.1])
            by localhost (mailgate._REMOVED_.com [127.0.0.1]) (amavisd-new, port 10024)
            with ESMTP id POldj2ZarUlq for <_REMOVED_@_REMOVED_.com>;
            Fri,  4 Mar 2011 20:35:42 +0000 (UTC)
    Received: from mailer5.first-espot.com (mailer5.first-espot.com [74.118.36.57])
            by mailgate._REMOVED_.com (Postfix) with ESMTP id E7BCAB2075
            for <_REMOVED_@_REMOVED_.com>; Fri,  4 Mar 2011 20:35:41 +0000 (UTC)
    DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; d=first-espot.com;
     h=To:Subject:Message-ID:Date:From:Reply-To:MIME-Version:List-Unsubscribe:Content-Type:Content-Transfer-Encoding; i=[email protected];
     bh=gtgL2j0u5HyMfmXfNvau0aTnsBA=;
     b=ZaQp1l4S44xtThzhJrzBoVwrL0dwyniAulwwXuiw43AM/rc+TAOzTz9FTCHLv3xa4+0DJtbhEyUA
       jQNSyYLjfF4P+dW35bVyXoLWuRPIa5DG0/uC6V9Vx4EC5F5wOw3WCS+AT5k2DrlO0oj+VRaZRK/W
       zWHKS1odc21jHOpf6uY=
    DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=first-espot.com;
     b=mUnIGdvmTto4vAJx20X3YsDBpsvylDlBj+nK2n6l/qiZLwGxzIXoo329bYZmvVbkTge9LBzTdKu+
       sspZRtoTY1NgHgi7ny8HZuY4tZcLs3a2S+p5C1f9DodNl3ob0L3q5Aam0tm7+4LhheEuXF887oML
       sYj+6+ZumiIqI2Ew5UU=;
    Received: from cpa3.first-espot.com (10.10.248.250) by mailer5.first-espot.com (PowerMTA(TM) v3.5r13) id he56i011o9gf for <_REMOVED_@_REMOVED_.com>; Fri, 4 Mar 2011 20:35:40 +0000 (envelope-from <[email protected]>)
    To: "_REMOVED_" <_REMOVED_@_REMOVED_.com>
    Subject: Grab a Year's Free Shopping at ASDA
    Message-ID: <[email protected]>
    Date: Fri, 04 Mar 2011 19:51:02 +0000
    From: "Offersclick" <[email protected]>
    Reply-To: [email protected]
    MIME-Version: 1.0
    X-Mailer-LID: 4
    List-Unsubscribe: <http://www.first-espot.com/emailflow/unsubscribe.php?M=1135762&C=7e5c58392a7cc53e106c2f82371d4145&L=4&N=3884>
    X-Mailer-SID: 3884
    X-Mailer-Sent-By: 4
    X-Mailer: Email Flow::Enterprise 0.5
    X-Mailer-Info: AQt4Zlk6LaNhpz96LaOynUIaDUWirzWjMJu1Mlj0
    x-job: 3984
    Content-Type: multipart/alternative; charset="UTF-8"; boundary="b1_2138ca8c292b2b5b30c32f302cd4e8f9"
    Content-Transfer-Encoding: 8bit
    
    --b1_2138ca8c292b2b5b30c32f302cd4e8f9
    Content-Type: text/plain; format=flowed; charset="UTF-8"
    Content-Transfer-Encoding: 8bit
    
    This prize is brought to you by Offersclick and Emailinform.
    Make sure you hear about great money-saving offers and be in with a chance
    to win a yearâ~@~Ys free shopping at ASDA.
    
    Asda is known for its great value, but why not make the price of your
    weekly shop ZERO? Win a free YEAR of shopping at family favourite Asda.
    Complete this survey to enter the prize draw.
    
    Complete our consumer survey to be automatically entered into our prize
    draw AND ensure you get deals and offers in the future tailored to suit
    your needs.
    
    http://www.first-espot.com/emailflow/link.php?M=1135762&N=3884&L=308&F=T
    
     
  4. yucktoufoo

    yucktoufoo New Member

    A little more digging done. Seems like amavis is loading spamassassin when it starts

    Code:
    Mar  5 22:33:50 mailgate amavis[3188]: Module Mail::DKIM::Verifier 0.39
    Mar  5 22:33:50 mailgate amavis[3188]: Module Mail::Header        2.07
    Mar  5 22:33:50 mailgate amavis[3188]: Module Mail::Internet      2.07
    Mar  5 22:33:50 mailgate amavis[3188]: Module Mail::SpamAssassin  3.002005
    ....
    ....
    Mar  5 22:33:50 mailgate amavis[3188]: ANTI-VIRUS code      loaded
    Mar  5 22:33:50 mailgate amavis[3188]: ANTI-SPAM code       loaded
    Mar  5 22:33:50 mailgate amavis[3188]: ANTI-SPAM-EXT code   NOT loaded
    Mar  5 22:33:50 mailgate amavis[3188]: ANTI-SPAM-C code     NOT loaded
    Mar  5 22:33:50 mailgate amavis[3188]: ANTI-SPAM-SA code    loaded
    
    Then sent myself a mail and see the following in the log:

    Code:
    Mar  5 22:59:34 mailgate amavis[3214]: (03214-02) Passed CLEAN, [x.x.x.x] [x.x.x.x] <_REMOVED_@_REMOVED.com> -> <_REMOVED_@_REMOVED.com>, Message-ID: <20110305225917.43D18B20B2@mailgate._REMOVED_.com>, mail_id: YBK5Dg6+Gse8, Hits: 3.962, size: 416, queued_as: A8B28B20B4, 526 ms
    
    I see it has a hit score, not sure if that relates to SA scoring or if its amavis own scoring but I check the headers of the mail and definitely no X-Spam headers still.

    What am I missing here? Bound to be something really stupid
     
    Last edited: Mar 6, 2011
  5. falko

    falko Super Moderator ISPConfig Developer

    Did you check the SpamAssassin scoes in your amavisd configuration?
    Also, have you tried to update SpamAssassin's rules?

    Code:
    sa-update --no-gpg
     
  6. waters

    waters New Member

    I am having the exact same problem. It seems like all spam is getting through. There is nothing about spamd in the maillog file. I also set up logging for spamd to log to a file and there are only entries about it starting up. I followed the CentOS tutorial: Virtual Users And Domains With Postfix, Courier And MySQL (CentOS 5.1)
     
  7. waters

    waters New Member

    Ok, I had set @bypass_spam_checks_maps = ( [ "!.$mydomain","." ] ); in an attempt to not scan outgoing mail, but then it wasn't scanning ANY mail.

    So I commented it out, and it is scanning all mail, except now ALL outgoing mail is being tagged as spam.

    We have virtual users on many different domains, so how can I bypass spam filtering for all smtp authenticated users?
     
  8. yucktoufoo

    yucktoufoo New Member

    Hi Falko,

    I already ran sa-update however, I just realised that the amavisd.conf file in /etc is not the one that is read, its the copy in /etc/amavisd. I knew I was missing something stupid.

    I have cranked the loglevel up as far as it will go (5) and updated $sa_tag_level_deflt to 0.1. Guess X-Spam headers were not being applied previuously because this was set to 2, I want the headers on all emails so I can analyze what each mail is scoring. Then I will learn SA on my spam and ham accordingly.


    @waters - I think that you dont see spamd reference in the logs because amavis is calling the SA libs internally, try turning up the log level in amavisd.conf and then grep maillog for amavis instead.

    I guess that spamd does not event need to run (in fact, if you've started spamd you're probably just wasting memory?)
     

Share This Page