SPAM over assigned policy's kill level not deleted automatically

Discussion in 'Installation/Configuration' started by cbj4074, Jan 9, 2012.

  1. cbj4074

    cbj4074 Member HowtoForge Supporter

    I created a new "Spamfilter Policy" under Email -> Policy, but it seems as though the policy is not being applied to incoming mail.

    My understanding is that if the "SPAM kill level" is set to 15, then messages with a SPAM score >= 15 will be discarded.

    There seems to be conflicting information regarding the following directive in /etc/amavis/conf.d/50-user:

    Code:
    $final_spam_destiny = D_DISCARD;
    
    Some say that this directive must be enabled in this specific configuration file for automatic SPAM deletion to occur, while others (e.g., Till) say that this directive is irrelevant, as ISPConfig overrides this value on a per-policy-assignment basis.

    Anyway, the line in question is un-commented in my amavis configuration.

    However, messages with an X-Spam-Score header well over the kill level are not deleted automatically. Here are the headers from one such email message:

    Code:
    X-Virus-Scanned: Debian amavisd-new at example.com
    X-Spam-Flag: YES
    X-Spam-Score: 27.428
    X-Spam-Level: ***************************
    X-Spam-Status: Yes, score=27.428 tagged_above=1 required=4.5
    tests=[BAYES_99=3.5, DATE_IN_FUTURE_24_48=2.048,
    DKIM_ADSP_CUSTOM_MED=0.001, DRUGS_ERECTILE=1.994, DRUG_ED_CAPS=0.936,
    FORGED_YAHOO_RCVD=1.63, FREEMAIL_FROM=0.001, NML_ADSP_CUSTOM_MED=0.9,
    RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PBL=3.335, RCVD_IN_XBL=0.375,
    RDNS_NONE=0.793, SUBJECT_DRUG_GAP_C=2.14, SUBJ_ALL_CAPS=1.506,
    SUBJ_BUY=0.639, URIBL_DBL_SPAM=1.7, URIBL_JP_SURBL=1.25,
    URIBL_SBL=1.623, URIBL_WS_SURBL=1.608] autolearn=spam
    
    Screen captures of the Spampolicy Filter settings, and of the individual mailbox's Spamfilter setting are attached.

    The Spamfilter setting for the domain is set to "Normal", but my understanding is that the Spamfilter setting for the specific mailbox should override the domain-level setting.

    Am I missing something?
     

    Attached Files:

  2. till

    till Super Moderator Staff Member ISPConfig Developer

    As you can see in the mail header, a policy where spam tag2 Level = 4.5 is applied to this email:

    The policy you posted has score 5.0, so this is not the policy that got applied. Please check your policys to find the one with tag level 4.5.

    Beside that, please go To spamfilter > User/Domain and post the priority of the domain rule and the mailbox rule.
     
  3. cbj4074

    cbj4074 Member HowtoForge Supporter

    Ah, thank you for pointing-out that the filter being applied has 4.5 for the tag2 level. It is the "Normal" filter that is being applied.

    In Email -> Spamfilter -> User / Domain, the "Normal" filter has a priority of 5, and the "Auto-Delete Really Spammy Spam" filter has a priority of 10.

    So, this all makes sense. The part I was missing is the Priority.

    I have lowered the priority for the "Auto-Delete Really Spammy Spam" filter to 1 and expect that this will correct the issue.

    My only question: is there any means by which to avoid having to double-check (and potentially change) the Priority value for every user to whom a new policy is applied?

    To be clear, I would prefer that user-level policies always take precedence over domain-level policies.
     
    Last edited: Jan 9, 2012
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    The last time I tested it on my servers, amavis picked up the highest priority first and not the lowest as on your system now, so the way ispconfig assigned the priorities worked here. I will test that again, maybe its a config option or this has been changed in a amavis release.

    Which amavis version dp you have installed.
     
  5. cbj4074

    cbj4074 Member HowtoForge Supporter

    I'm using amavisd-new-2.6.4.
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Checked it on my servers here and amavis selects the correct policy (mailbox has precedence before domain rule). I verified this also in the amavis config file where the order is set correctly in the sql querys:

    Code:
    $sql_select_policy =
       'SELECT *,spamfilter_users.id'.
       ' FROM spamfilter_users LEFT JOIN spamfilter_policy ON spamfilter_users.policy_id=spamfilter_policy.id'.
       ' WHERE spamfilter_users.email IN (%k) ORDER BY spamfilter_users.priority DESC';
    
    
    $sql_select_white_black_list = 'SELECT wb FROM spamfilter_wblist'.
        ' WHERE (spamfilter_wblist.rid=?) AND (spamfilter_wblist.email IN (%k))' .
        ' ORDER BY spamfilter_wblist.priority DESC';
    Maybe you use a modified amavis configuration file on your system and not the one that is delivered with ISPconfig?
     
  7. cbj4074

    cbj4074 Member HowtoForge Supporter

    I have not modified the amavis configuration; the MySQL queries in my file look just like yours.

    I'll do some additional testing and report back when I figure out exactly what's going on. Thanks for pointing me in the right direction!
     
  8. ptrj

    ptrj New Member

    Hello,
    looks like i have same problem. i can't change Spam Filter Policy on my domain or mailbox. Always the same "Normal" policy is set.
    Code:
    X-Virus-Scanned: Debian amavisd-new at mail.domain1.sk
    X-Spam-Flag: YES
    X-Spam-Score: 11.835
    X-Spam-Level: ***********
    X-Spam-Status: Yes, score=11.835 tagged_above=1 required=4.5
    I create my own policy:
    Code:
    SPAM tag level: 3
    SPAM tag2 level: 3.5
    SPAM kill level: 5
    I have checked my config like /etc/amavis/conf.d/50-user:
    PHP:
    #
    # SQL Select statements
    #

    $sql_select_policy =
       
    'SELECT *,spamfilter_users.id'.
       
    ' FROM spamfilter_users LEFT JOIN spamfilter_policy ON spamfilter_users.policy_id=spamfilter_policy.id'.
       
    ' WHERE spamfilter_users.email IN (%k) ORDER BY spamfilter_users.priority DESC';


    $sql_select_white_black_list 'SELECT wb FROM spamfilter_wblist'.
        
    ' WHERE (spamfilter_wblist.rid=?) AND (spamfilter_wblist.email IN (%k))'.
        
    ' ORDER BY spamfilter_wblist.priority DESC';
    etc..
     
    Last edited: Apr 27, 2015
  9. ptrj

    ptrj New Member

    I have two domains @domain1.sk with mailbox user@domain1.sk and 2nd domain @domain2.sk with alias alias_user@domain2.sk -> user@domain1.sk

    Domain1 spam policy = myOwn
    user@domain2.sk spam policy = myOwn
    Domain2 spam policy = Normal

    And when i send email on alias which spam policy is prefered?

    Code:
    Apr 27 08:10:54.450 mail.domain1.sk /usr/sbin/amavisd-new[31774]: (31774-01) sql: preparing and executing: SELECT *,spamfilter_users.id FROM spamfilter_users LEFT JOIN spamfilter_policy ON spamfilter_users.policy_id=spamfilter_policy.id WHERE spamfilter_users.email IN (?,?,?,?,?) ORDER BY spamfilter_users.priority DESC
    Apr 27 08:10:54.452 mail.domain1.sk /usr/sbin/amavisd-new[31774]: (31774-01) lookup_sql(alias_user@domain2.sk) matches, result=(id=>"18", sys_userid=>"1", sys_groupid=>"0", sys_perm_user=>"riud", sys_perm_group=>"riud", sys_perm_other=>"r", server_id=>"1", priority=>"5", policy_id=>"5", email=>"@domain2.sk", fullname=>"@domain2.sk", local=>"Y", id=>"18", sys_userid=>"1", sys_groupid=>"0", sys_perm_user=>"riud", sys_perm_group=>"riud", sys_perm_other=>"r", policy_name=>"Normal", virus_lover=>"N", spam_lover=>"N", banned_files_lover=>"N", bad_header_lover=>"N", bypass_virus_checks=>"N", bypass_spam_checks=>"N", bypass_banned_checks=>"N", bypass_header_checks=>"N", spam_modifies_subj=>"Y", virus_quarantine_to=>"", spam_quarantine_to=>"", banned_quarantine_to=>"", bad_header_quarantine_to=>"", clean_quarantine_to=>"", other_quarantine_to=>"", spam_tag_level=>"1", spam_tag2_level=>"4.5", spam_kill_level=>"50", spam_dsn_cutoff_level=>"0", spam_quarantine_cutoff_level=>"0", addr_extension_virus=>"", addr_extension_spam=>"", addr_extension_banned=>"", addr_extension_bad_header=>"", warnvirusrecip=>"N", warnbannedrecip=>"N", warnbadhrecip=>"N", newvirus_admin=>"", virus_admin=>"", banned_admin=>"", bad_header_admin=>"", spam_admin=>"", spam_subject_tag=>"", spam_subject_tag2=>"[SPAM] ", message_size_limit=>"0", banned_rulenames=>"", policyd_quota_in=>"-1", policyd_quota_in_period=>"24", policyd_quota_out=>"-1", policyd_quota_out_period=>"24", policyd_greylist=>"N", id=>"18")
    Apr 27 08:10:54.452 mail.domain1.sk /usr/sbin/amavisd-new[31774]: (31774-01) lookup_sql_field(message_size_limit) rec=0, "alias_user@domain2.sk" result: "0"
    Apr 27 08:10:54.452 mail.domain1.sk /usr/sbin/amavisd-new[31774]: (31774-01) lookup [message_size_limit] => false, "alias_user@domain2.sk" matches, result="0", matching_key="id=>"18", sys_userid=>"1", sys_groupid=>"0", sys_perm_user=>"riud", sys_perm_group=>"riud", sys_perm_other=>"r", server_id=>"1", priority=>"5", policy_id=>"5", email=>"@domain2.sk", fullname=>"@domain2sk", local=>"Y", id=>"18", sys_userid=>"1", sys_groupid=>"0", sys_perm_user=>"riud", sys_perm_group=>"riud", sys_perm_other=>"r", policy_name=>"Normal", virus_lover=>"N", spam_lover=>"N", banned_files_lover=>"N", bad_header_lover=>"N", bypass_virus_checks=>"N", bypass_spam_checks=>"N", bypass_banned_checks=>"N", bypass_header_checks=>"N", spam_modifies_subj=>"Y", virus_quarantine_to=>"", spam_quarantine_to=>"", banned_quarantine_to=>"", bad_header_quarantine_to=>"", clean_quarantine_to=>"", other_quarantine_to=>"", spam_tag_level=>"1", spam_tag2_level=>"4.5", spam_kill_level=>"50", spam_dsn_cutoff_level=>"0", spam_quarantine_cutoff_level=>"0", addr_extension_virus=>"", addr_extension_spam=>"", addr_extension_banned=>"", addr_extension_bad_header=>"", warnvirusrecip=>"N", warnbannedrecip=>"N", warnbadhrecip=>"N", newvirus_admin=>"", virus_admin=>"", banned_admin=>"", bad_header_admin=>"", spam_admin=>"", spam_subject_tag=>"", spam_subject_tag2=>"[SPAM] ", message_size_limit=>"0", banned_rulenames=>"", policyd_quota_in=>"-1", policyd_quota_in_period=>"24", policyd_quota_out=>"-1", policyd_quota_out_period=>"24", policyd_greylist=>"N", id=>"18""
    Answer: Normal :-]
     
    Last edited: Apr 27, 2015

Share This Page