SpamAssasin Problem..

Hi Fleibo,

Try adding "sourcespamfilter1optin spam" to tcp_local channel rather then the ims-ms channel. Ideally you want emails coming into the organisation from external to be scanned for spam rather then anything that is being delivered.

Then to test you need to send an email from 'outside' your organisation i.e. if you send from your PC you can add the following line to the INTERNAL_IP mapping table:

INTERNAL_IP

<PC ip address> $N

Shane.

shane_hjorth at 2007-7-7 1:35:42 >

defaults notices 1 2 4 7 copywarnpost copysendpost postheadonly noswitchchannel immnonurgent maxjobs 7 defaulthost dataone.in

dataone.in logging

wrong. . .

defaults notices 1 2 4 7 copywarnpost copysendpost postheadonly noswitchchannel immnonurgent maxjobs 7 defaulthost dataone.in logging

dataone.in

correct

jay_plesset at 2007-7-7 1:35:42 >

Fleibo:

Shane was suggesting you add that line to the MAPPINGS file, not to any line in imta.cnf

That is to make that pc temporarily EXTERNAL to your domain, so mail from it would come through tcp_local, instead of tcp_intranet

Mail coming from your local users shouldn't be scanned, because it just takes too long, and your users shouldn't be sending spam anyway.

Did you try this?

Have you put debug logging on your channels, and seen what actually happens with a message?

jay_plesset at 2007-7-7 1:35:42 >

Well, you've not put the line in. Here's what Shane said, before:

Then to test you need to send an email from 'outside' your organisation i.e. if you send from your PC you can add the following line to the INTERNAL_IP mapping table:

INTERNAL_IP

<PC ip address> $N

Shane.

This would go here

INTERNAL_IP

$(83.111.111.111/24) $Y

127.0.0.1 $Y

1.2.3.4 $N(replace the numbers with your pc's ip address

* $N

Please note, that there is a leading blank in front of all these entries.

then, compile the configuraiton, and restart the mta

imsimta cnbuild

imsimta restart dispatcher

jay_plesset at 2007-7-7 1:35:42 >

Messaging Server's MTA is oriented into channels. Messages are assigned to the various channels by the ip address they originate at.

the channel called, "tcp_local" is reserved for "external" messages, the internet at large. "tcp_intranet" is for messages that are "internal", your users.

When you test something, such as SpamAssassin, and you've put keywords on "tcp_local", but you're testing from an "internal_ip" as mapped, then you're not going to see anything.

The suggestion is to make your test pc "external", for testing.

A normal install will not allow one external user to send mail to any other external user. That prevents "open relay", and keeps you from spreading spam everywhere.

A normal install of SpamAssassin checks mail coming from "external" sources. If you then test SA from an "internal" source, you're not really testing anything.

better?

jay_plesset at 2007-7-7 1:35:42 >

You should be seeing a "mail.log_current" file. That will help you troubleshoot your issue.

Check to make sure that mail actually is coming IN via tcp_local, and getting delivered to "ims_ms".

If your mail is coming in through "tcp_intranet", you are mis-configured in your mappings file, and that's why nothing is getting scanned for spam.

jay_plesset at 2007-7-7 1:35:42 >

You do make it a little harder, though. Is "company.pl" you? Is "othercompany.pl" you, too?

May I also assume that both kilab and root are not users on your system?

do you have spamd running? What happens when you telnet to the port you have it running on?

What do you get when you run

spamassassin --D -lint

(or is that -D --lint? I forget)

jay_plesseta at 2007-7-21 15:23:35 >

root@workgroup [/opt/sun/messaging/log]# spamassassin --D -lint

[16306] warn: The -l option has been deprecated and is no longer supported, ignoring.

so, it's not doing the lint thing.......

you may want to put some debugging on the tcp_local channel, and see what it's trtying to do

add these keywords to the config line:

slave_debug master_debug

and, add this line to the end of your option.dat file:

mm_debug=5

run:

imsimta cnbuild

imsimta restart dispatcher

and send an external message through. You should see some new files for each message in the log area.

jay_plesseta at 2007-7-21 15:23:35 >

I have just noticed tht those process_master logs are old ;( and so the information there can't be taken into consideration. The only thing that is created are tcp_local_master and slave logs but can't find anything related to spamd or spam assasin.

-rw-1 mailsrv mail788 Aug 22 14:20 process_master.log-f0c0F0PO_M1

-rw-1 mailsrv mail788 Aug 22 14:45 process_master.log-f0c1F0V7_C0

-rw-1 mailsrv mail788 Aug 22 15:15 process_master.log-f0c1G02q1h0

-rw-1 mailsrv mail11 Sep 17 12:04 stored.ckp

-rw-1 mailsrv mail11 Sep 17 12:04 stored.lcu

-rw-1 mailsrv mail11 Sep 17 11:38 stored.per

-rw-1 mailsrv mail3268 Sep 17 09:27 tcp_local_master.log-0J5Q003047E12M00

-rw-1 mailsrv mail3313 Sep 17 09:27 tcp_local_master.log-0J5Q003067E12M00

-rw-1 mailsrv mail1304 Sep 17 10:38 tcp_local_master.log-0J5Q00402AJ62900

-rw-1 mailsrv mail2635 Sep 17 10:41 tcp_local_master.log-0J5Q00404AJ72900

-rw-1 mailsrv mail1066 Sep 17 10:41 tcp_local_master.log-f0e1O08gOf0

-rw-1 mailsrv mail2764 Sep 17 11:50 tcp_local_slave.log-0J5Q008CTE11X000

-rw-1 mailsrv mail3440 Sep 17 11:55 tcp_local_slave.log-0J5Q008CTE9EWZ00

-rw-1 mailsrv mail1186 Sep 17 11:55 tcp_local_slave.log-0J5Q008CWE8BX000

-rw-1 mailsrv mail3020 Sep 17 12:00 tcp_local_slave.log-0J5Q008CWEHPWZ00

-rw-1 mailsrv mail1137 Sep 17 11:55 tcp_local_slave.log-0J5Q008CYE8BWR00

-rw-1 mailsrv mail3679 Sep 17 12:00 tcp_local_slave.log-0J5Q008CYEHPX000

-rw-1 mailsrv mail595 Sep 17 12:01 tcp_local_slave.log-0J5Q008CZEIKWZ00

-rw-1 mailsrv mail3424 Sep 17 11:55 tcp_local_slave.log-0J5Q008D0E9EWR00

-rw-1 mailsrv mail2764 Sep 17 12:00 tcp_local_slave.log-0J5Q008D1EHPX000

-rw-1 mailsrv mail2764 Sep 17 12:00 tcp_local_slave.log-0J5Q008D3EHPWR00

-rw-1 mailsrv mail61207 Sep 17 12:01 tcp_local_slave.log-0J5Q008D6EJCWR00

-rw-1 mailsrv mail0 Sep 17 02:25 tcp_smtp_server.log-0J5P00D06NUBAW00

-rw-1 mailsrv mail0 Sep 17 02:25 tcp_smtp_server.log-0J5P00D07NUBAW00

-rw-1 mailsrv mail310 Sep 17 02:25 tcp_smtp_server.log-0J5P00D08NUBAW00

-rw-1 mailsrv mail310 Sep 17 02:25 tcp_smtp_server.log-0J5P00D09NUBAW00

-rw-1 mailsrv mail310 Sep 17 02:25 tcp_smtp_server.log-0J5P00D0ANUBAW00

-rw-1 mailsrv mail45653 Sep 15 19:38 watcher

Fleiboa at 2007-7-21 15:23:35 >

root@workgroup [/opt/sun/messaging/config]# cat imta.cnf

!

! IMTA configuration file

!

! part I : rewrite rules

!

! Domain Rewrite Rules.

! Uncomment this line to use domain rewrite rules

! from the configuration file instead of the domain database.

! Please refer to the iMS documentation for details.

!<IMTA_TABLE:domains.rules

!

! Rules to select local users

$* $A$E$F$U%$H$V$H@sun.workgroup.company.pl

sun.workgroup.company.pl $U%$D@sun.workgroup.company.pl

workgroup.company.pl $U%$D@sun.workgroup.company.pl

!

! ims-ms

.ims-ms-daemon $U%$H.ims-ms-daemon@ims-ms-daemon

!

! lmtp

!.lmtp $U%$H@lmtpcs-daemon

!

! lmtpn

!.lmtpn $U%$H@lmtpcn-daemon

!

! native

.native-daemon $U%$H.native-daemon@native-daemon

!

! pipe

.pipe-daemon $U%$H.pipe-daemon@pipe-daemon

!

! tcp_local

! Rules for top level internet domains

><IMTA_TABLE:internet.rules

!

! tcp_intranet

! Do mapping lookup for internal IP addresses

[] $E$R${INTERNAL_IP,$L}$U%[$L]@tcp_intranet-daemon

.workgroup.company.pl $U%$H.workgroup.company.pl@tcp_intranet-daemon

* $U%$&0.workgroup.company.pl

!

! reprocess

reprocess $U%reprocess.sun.workgroup.company.pl@reprocess-daemon

reprocess.sun.workgroup.company.pl $U%reprocess.sun.workgroup.company.pl@reprocess-daemon

!

! process

process $U%process.sun.workgroup.company.pl@process-daemon

process.sun.workgroup.company.pl $U%process.sun.workgroup.company.pl@process-daemon

!

! defragment

defragment $U%defragment.sun.workgroup.company.pl@defragment-daemon

defragment.sun.workgroup.company.pl $U%defragment.sun.workgroup.company.pl@defragment-daemon

!

! conversion

conversion $U%conversion.sun.workgroup.company.pl@conversion-daemon

conversion.sun.workgroup.company.pl $U%conversion.sun.workgroup.company.pl@conversion-daemon

!

! bitbucket

bitbucket $U%bitbucket.sun.workgroup.company.pl@bitbucket-daemon

bitbucket.sun.workgroup.company.pl $U%bitbucket.sun.workgroup.company.pl@bitbucket-daemon

!

! deleted

deleted-daemon $U%$H@deleted-daemon

.deleted-daemon $U%$H@deleted-daemon

!

! inactive

inactive-daemon $U%$H@inactive-daemon

.inactive-daemon $U%$H@inactive-daemon

!

! hold

hold-daemon $U%$H@hold-daemon

.hold-daemon $U%$H@hold-daemon

!

! part II : channel blocks

!

defaults notices 1 2 4 7 copywarnpost copysendpost postheadonly noswitchchannel immnonurgent maxjobs 7 defaulthost workgroup.company.pl workgroup.company.pl logging

!

! delivery channel to local /var/mail store

l subdirs 20 viaaliasrequired maxjobs 7 pool LOCAL_POOL

sun.workgroup.company.pl

!

! ims-ms

ims-ms defragment subdirs 20 notices 1 7 14 21 28 backoff "pt5m" "pt10m" "pt30m" "pt1h" "pt2h" "pt4h" maxjobs 2 pool IMS_POOL fileinto $U+$S@$D sourcespamfilter1optin spam

ims-ms-daemon

!

! native

native defragment subdirs 20 maxjobs 1

native-daemon

!

! pipe

pipe single defragment subdirs 20

pipe-daemon

!

! tcp_local

tcp_local smtp mx single_sys remotehost inner switchchannel identnonenumeric subdirs 20 maxjobs 7 pool SMTP_POOL maytlsserver maysaslserver saslswitchchannel tcp_auth missingrecipientpolicy 0 loopcheck slave_debug master_debug

tcp-daemon

!

! tcp_intranet

tcp_intranet smtp mx single_sys subdirs 20 dequeue_removeroute maxjobs 7 pool SMTP_POOL maytlsserver allowswitchchannel saslswitchchannel tcp_auth missingrecipientpolicy 4

tcp_intranet-daemon

!

! tcp_submit

tcp_submit submit smtp mx single_sys mustsaslserver maytlsserver missingrecipientpolicy 4

tcp_submit-daemon

!

! tcp_auth

tcp_auth smtp mx single_sys mustsaslserver missingrecipientpolicy 4

tcp_auth-daemon

!

! tcp_tas

tcp_tas smtp mx single_sys allowswitchchannel mustsaslserver maytlsserver deliveryflags 2

tcp_tas-daemon

!

! tcp_lmtpss (LMTP server - store)

!tcp_lmtpss lmtp subdirs 20

!tcp_lmtpss-daemon

!

! tcp_lmtpcs (LMTP client - store)

!tcp_lmtpcs defragment lmtp port 225 nomx single_sys subdirs 20 maxjobs 7 pool SMTP_POOL dequeue_removeroute

!lmtpcs-daemon

!

! reprocess

reprocess

reprocess-daemon

!

! process

process

process-daemon

!

! defragment

defragment

defragment-daemon

!

! conversion

conversion

conversion-daemon

!

! bitbucket

bitbucket

bitbucket-daemon

!

! deleted

deleted

deleted-daemon

!

! inactive

inactive

inactive-daemon

!

! hold

hold

hold-daemon

root@workgroup [/opt/sun/messaging/config]# cat option.dat

! MTA configuration options

!

! This sets the alias resolution order

!8 = Use ALIAS_URL0

!7 = Use ALIAS_URL1

!6 = Use ALIAS_URL2

!4 = Use the alias file

ALIAS_MAGIC=8764

ALIAS_URL0=ldap:///$V?*?sub?$R

USE_REVERSE_DATABASE=4

REVERSE_URL=ldap:///$V?$N?sub?$R

USE_DOMAIN_DATABASE=0

! MISSING_RECIPIENT_POLICY controls how illegal headers that don't

! contain any To:, Cc:, or Bcc: fields are handled for channels that

! do not have their own explicit missingrecipientpolicy keyword set.

! The default of 0 means that the envelope addresses are used to

! construct a valid To: header field. This default behavior tends

! to be especially appropriate for the tcp_local channel.

MISSING_RECIPIENT_POLICY=0

MISSING_RECIPIENT_GROUP_TEXT=Undisclosed recipients

ALIAS_DOMAINS=6

!

LDAP_SCHEMALEVEL=2

!

VACATION_TEMPLATE=file:///opt/sun/messaging/data/vacation/$3I/$1U/$2U/$U.vac

!

!for SPAMASSASSIN

!

spamfilter1_config_file=/opt/sun/messaging/config/spamassassin.opt

spamfilter1_library=/opt/sun/lib/spamassass.so

spamfilter1_optional=1

spamfilter1_string_action=data:,addtag "[SPAM detected $U]";

mm_debug=5

Here you go. Hope it gives you something>

Fleiboa at 2007-7-21 15:23:35 >

Yes, what you see via telent is normal.spamassassin has it's own syntax, and not telnet. You're only checking that indeed, it answers.

Actually, here's your problem.

! ims-ms

ims-ms defragment subdirs 20 notices 1 7 14 21 28 backoff "pt5m" "pt10m" "pt30m" "pt1h" "pt2h" "pt4h" maxjobs 2 pool IMS_POOL fileinto $U+$S@$D sourcespamfilter1optin spam

ims-ms-daemon

sourcespamfilter1optin goes in a source channel. You have it in a destination channel

I would move this to tcp_local.ims-ms can never be a source channel. It's where messages get written to the store. Destination only.

jay_plesseta at 2007-7-21 15:23:35 >

18:26:27.46: Loading spam filter #0, library /opt/sun/lib/spamassass.so

18:26:27.46: Spam filter initialization failure: Cannot load spam filter bmiEndHeaders

18:43:18.98:Final result "tcp_local|some.mail@wp.pl|ims-ms|my.user%company.pl@ims-ms-daemon"

18:43:18.98:- passed.

18:43:18.98: - Spam filter 0 not disabled, checking this recipient

18:43:18.98: - Spam filter 1 not disabled, checking this recipient

18:43:18.98: - Spam filter 2 not disabled, checking this recipient

18:43:18.98: - Spam filter 3 not disabled, checking this recipient

18:43:18.98: - Spam filter 4 not disabled, checking this recipient

18:43:18.98: - Spam filter 5 not disabled, checking this recipient

18:43:18.98: - Spam filter 6 not disabled, checking this recipient

18:43:18.98: - Spam filter 7 not disabled, checking this recipient

18:43:18.98: - adding address my.user%company.pl@ims-ms-daemon to channel ims-ms

18:43:18.98: - Copy estimate now 2

18:43:18.98: Closing URL context 2, new type = 7

18:43:18.98:- adding address my.user@company.pl to headers.

That's one tcp_slave .log well part of it.. seems okey ?

Fleiboa at 2007-7-21 15:23:35 >

that's spamassassin.opt

host=127.0.0.1

port=2000

field=

mode=1

debug=1

both option.dat and imta.cnf are posted in few posts up here.

-rw-r--1 mailsrv mail1114 Sep 16 02:21 option.dat

-rw-r--r--1 mailsrv mail47 Sep 9 22:58 spamassassin.opt

both readable.

i have no brightmail at all so dunno where that header comes from.

Fleiboa at 2007-7-21 15:23:40 >

Hi Jay

Can you give me the solution for following problem

- -

root # /etc/init.d/spamd stop

Stopping SpamAssassin in /usr/local/bin :

[11778] error: spamd: could not create INET socket on 127.0.0.1:783: Address already in use

spamd: could not create INET socket on 127.0.0.1:783: Address already in use

- --

Thanks in Advance

bsnl-niba at 2007-7-21 15:23:40 >