SpamSnake 10.10

Discussion in 'HOWTO-Related Questions' started by gachnar, Jan 6, 2011.

  1. gachnar

    gachnar New Member

    Ran into an issue when doing the spamassassin LINT test. Below is a few lines from the output. As you can see its not picking up the sa_user from earlier in the tutorial. Did I miss something?


    Jan 6 13:26:13.484 [1938] dbg: bayes: learner_new self=Mail::SpamAssassin::plugin::Bayes=HASH(0x96ec200), bayes_store_module=Mail::SpamAssassin::BayesStore::SQL
    Jan 6 13:26:13.494 [1938] dbg: bayes: using username: root
    Jan 6 13:26:13.494 [1938] dbg: bayes: learner_new: got store=Mail::SpamAssassin::BayesStore::SQL=HASH(0x97adb50)
    Jan 6 13:26:13.494 [1938] dbg: plugin: Mail::SpamAssassin::plugin::Bayes=HASH(0x96ec200) implements 'learner_is_scan_available', priority 0
    Jan 6 13:26:13.512 [1938] dbg: bayes: database connection established
    Jan 6 13:26:13.512 [1938] dbg: bayes: found bayes db version 3
    Jan 6 13:26:13.513 [1938] dbg: bayes: unable to initialize database for root user, aborting!


    I'm hoping its something I've missed doing, but no joy so far. Please help.
  2. Rocky

    Rocky Member

    That's a standard msg if your server is not actually processing mails. Once it starts to, that msg will change.
  3. gachnar

    gachnar New Member

    Mail errors

    Followed most of the guide... right to the end where I have discovered two problems. First one is below. Basically any address I have tried sending from gets bounced by greyfix.

    Jan 7 13:46:17 spamsnake postfix/smtpd[1982]: NOQUEUE: reject: RCPT from: 450 4.7.1 <[email protected]>: : Recipient address rejected: Greylisted by greyfix 0.3.9, try again in 60 seconds.

    Second problem. I tried using the perl script to pull the AD users for the relay_recipients. The file was created, but it didn't populate. Got any insight?
  4. topdog

    topdog Active Member

    This is what greylisting is all about, the message is rejected with a 4xx code which means try again later. any smtp client that is not ratware should try again.

    Actual bounces use the 5xx codes.
  5. gachnar

    gachnar New Member


    I'm just kinda special. I did a google of greylist and found an answer to that first post. Here is the result of what happens when the message finally gets bounced back to me. It acts like ClamAV isn't configured quite right.


    Our virus detector failed to completely analyse a message you sent:-
    To: [email protected]
    Date: Fri Jan 7 14:37:31 2011
    Any parts of the message that could not be analysed will not have been

    If you are using Microsoft Outlook, we strongly recommend you change your
    outgoing message format from "Rich Text" to "HTML" or "Plain Text".

    1) Click on the "Tools" menu and choose "Options..."
    2) Go to the "Mail Format" tab
    3) For message format, select "HTML" or "Plain text"
    4) Click OK

    The virus detector said this about the message:
    Report: Report: MailScanner: Message attempted to kill MailScanner


    I did also try to send a plain text email, but that got bounced too. I'm at a loss here. No messages are getting through. Any help offered could and would be greatly appreciated.
    Last edited: Jan 9, 2011
  6. topdog

    topdog Active Member

    This issue has been answered before please search the other spamsnake threads here and you should have the answer.
  7. gachnar

    gachnar New Member

    It is a fresh VM that just has the files required for this setup. I am referencing SpamSnake

    I checked to see if my filesystem was full. It is not.

    I also tried to do the freshclam command and got the following...

    ERROR: /var/log/clamav/freshclam.log is locked by another process
    ERROR: Problem with internal logger (UpdateLogFile = /var/log/clamav/freshclam.log).
  8. Rocky

    Rocky Member

    Could possibly be bad signatures. Go ahead and do a purge of clamav and reinstall it per the guide.
  9. gachnar

    gachnar New Member

    Did that. now the command doesn't give me that error when I run freshclam.
    All mail I send is still not getting through. Keeps going back to sender with that error I mentioned earlier about the message not being able to be completely processed by antivirus.

    Let me know what configs you'd need me to post. I will be glad to oblige. I'm not making any headway on my own merit.


    There does seem to be a big delay when I look at the mail.log after I send a test message. Right at the part:

    Jan 10 11:19:39 spamsnake MailScanner[7700]: Connected to Processing Attempts Database
    Jan 10 11:19:39 spamsnake MailScanner[7700]: Found 1 messages in the Processing Attempts Database
    Jan 10 11:19:39 spamsnake MailScanner[7700]: Using locktype = flock
  10. Rocky

    Rocky Member

    Try this:

    apt-get remove --purge clamav-daemon libclamav6
    apt-get install clamav-deamon libclamav6

    Restart mailscanner

    Look at your logs, and post any problems.

    If that doesn't work, run mailscanner in debug mode and post errors.

    How much RAM do you have dedicated to your system?
    Last edited: Jan 10, 2011
  11. gachnar

    gachnar New Member

    disabled postfix.
    set debug mode in /opt/MailScanner/etc/MailScanner.conf

    ran command: check_mailscanner

    will post results when I get them.


    I let the command sit for 10 minutes at the last line before I stopped it.

    UPDATE 2:

    The VM has 512MB of RAM. That should be more than enough unless I am processing a high amount of mail flow.

    UPDATE 3:

    Similar to another forum I can't quite remember which one. I also don't show an active MTA in baruwa. It shows me having no processes.
    Last edited: Jan 10, 2011
  12. Rocky

    Rocky Member

    Run it with postfix enabled, or it won't process mails.
  13. gachnar

    gachnar New Member

    ran the command with postfix enabled and it made it past there once, but I wasn't able to get that text saved. when I retried it again, it still hangs at the message: "Building a message batch to scan..."

    checked the mail.log and couldn't find the relevant section I was talking about. Any other suggestions?
    Last edited: Jan 11, 2011
  14. Rocky

    Rocky Member

    Do you by chance have amavisd-new installed? Check to make sure your clamd config is correct with the proper user. This is what my clamd.conf looks like:
    #Automatically Generated by clamav-base postinst
    #To reconfigure clamd run #dpkg-reconfigure clamav-base
    #Please read /usr/share/doc/clamav-base/README.Debian.gz for details
    LocalSocket /var/run/clamav/clamd.ctl
    FixStaleSocket true
    LocalSocketGroup clamav
    LocalSocketMode 666
    # TemporaryDirectory is not set to its default /tmp here to make overriding
    # the default with environment variables TMPDIR/TMP/TEMP possible
    User clamav
    AllowSupplementaryGroups true
    ScanMail true
    ScanArchive true
    ArchiveBlockEncrypted false
    MaxDirectoryRecursion 15
    FollowDirectorySymlinks false
    FollowFileSymlinks false
    ReadTimeout 180
    MaxThreads 12
    MaxConnectionQueueLength 15
    LogSyslog false
    LogFacility LOG_LOCAL6
    LogClean false
    LogVerbose false
    PidFile /var/run/clamav/
    DatabaseDirectory /var/lib/clamav
    SelfCheck 3600
    Foreground false
    Debug false
    ScanPE true
    ScanOLE2 true
    ScanHTML true
    DetectBrokenExecutables false
    ExitOnOOM false
    LeaveTemporaryFiles false
    AlgorithmicDetection true
    ScanELF true
    IdleTimeout 30
    PhishingSignatures true
    PhishingScanURLs true
    PhishingAlwaysBlockSSLMismatch false
    PhishingAlwaysBlockCloak false
    DetectPUA false
    ScanPartialMessages false
    HeuristicScanPrecedence false
    StructuredDataDetection false
    CommandReadTimeout 5
    SendBufTimeout 200
    MaxQueue 100
    ExtendedDetectionInfo true
    StreamMaxLength 0
    LogFile /var/log/clamav/clamav.log
    LogTime true
    LogFileUnlock false
    LogFileMaxSize 0
    Bytecode true
    BytecodeSecurity TrustSigned
    BytecodeTimeout 60000
    OfficialDatabaseOnly false
    CrossFilesystems true
    # Automatically created by the clamav-freshclam postinst
    # Comments will get lost when you reconfigure the clamav-freshclam package
    DatabaseOwner clamav
    UpdateLogFile /var/log/clamav/freshclam.log
    LogVerbose false
    LogSyslog false
    LogFacility LOG_LOCAL6
    LogFileMaxSize 0
    LogTime true
    Foreground false
    Debug false
    MaxAttempts 5
    DatabaseDirectory /var/lib/clamav
    AllowSupplementaryGroups false
    PidFile /var/run/clamav/
    ConnectTimeout 30
    ReceiveTimeout 30
    TestDatabases yes
    ScriptedUpdates yes
    CompressLocalDatabase no
    Bytecode true
    # Check for new database 24 times a day
    Checks 24
    Double check to make sure it looks like mine.
  15. gachnar

    gachnar New Member

    Checked mine against yours and had to make the following changes to my clamd.conf. I commented out the following two lines. My freshclam.conf was the same as what you had posted.

    #OLE2BlockMacros false
    #StreamMaxLength 25M
    StreamMaxLength 0

    I do not have amavisd-new installed.
    Last edited: Jan 12, 2011
  16. Rocky

    Rocky Member

    This really looks like a problem for the mailscanner list. I have never actually had that problem with any of my setups.

    Give the mailscanner list ( a try, maybe someone knows what's happening on your system.

    Just out of curiousity, try increasing the ram, I read somewhere about another user who had 512Mb ram and was having the same issues. He eventually increased his ram to around 768Mb and the problem went away.
  17. gachnar

    gachnar New Member

    I'll try upping the memory like you said. I'll also start from the beginning again.. I really really want this to work. When I can get his working, I actually plan on putting my own site up and getting a whole setup rolling. I've already got the mail server running ubuntu using citadel as my email server. It's authenticating to a server 2k3. Just giving some details on my particular setup.


    I do have one question that kinda kept me confused. What should I put for my ORG-NAME and LONG-ORG-NAME. Also in the postfix conf file myorigin and myhostname.tld

    Say if my company was Widget Co. and my site was with my mail server being hosted at

    Third question in /opt/MailScanner/etc/spam.assassin.prefs.conf
    for the bayes section would my headers be x-widgetco-cc?

    Any Help?
    Last edited: Jan 14, 2011
  18. Rocky

    Rocky Member


    orgname is usually the abbreviation of your company's name while longorgname would be the full name.

    myorigin would be and myhostname would be mail.widgetco.c.

    If you used as myorigin, then you would place that in spam.assassin.prefs.conf eg. x-widgetco-cc.

Share This Page