From sl6xx at luxent.com.tw Sat Oct 2 19:14:35 2004 From: sl6xx at luxent.com.tw (sl6xx@luxent.com.tw) Date: Sat Oct 2 03:12:07 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 Message-ID: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> Just upgrade to SpamAssassin 3.0 but then backed to 2.63 immediately. It seems that the header was not properly parsed. I've seen the following message in exam's panic log: 2004-10-01 18:40:45 1CDKq8-0008Iz-4D SA: PANIC: SA: could not parse X-Spam-Status: to extract hits and required. Bad!. Got: 'X-Spam-Status: Yes, score=16.6 required=5.0 tests=BigEvilList_3029, For sa-exim to work properly I also observed that the log looks like this one: X-Spam-Status: Yes, hits=30.1 required=5.0 tests=AWL,BAYES_99, Is there anyway I can do to adjust my configuration file for sa-exim to work with SpamAssassin 3.0? From ssmeenk at freshdot.net Sat Oct 2 13:18:59 2004 From: ssmeenk at freshdot.net (Sander Smeenk) Date: Sat Oct 2 03:19:34 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 In-Reply-To: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> References: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> Message-ID: <20041002101859.GB10992@freshdot.net> Quoting sl6xx@luxent.com.tw (sl6xx@luxent.com.tw): > Just upgrade to SpamAssassin 3.0 but then backed to 2.63 immediately. Weird. This is the second report I see about 3.0 not working with sa-exim. The first one was from a friend of mine, but he got the problem after a fresh install and forgot to remove the SAEximRunCond: 0 line ;) > Is there anyway I can do to adjust my configuration file for sa-exim to work > with SpamAssassin 3.0? I'm running sa-exim 4.1 and spamassassin 3.0, and it works for me (TM). Relevant stuff from my /etc/spamassassin/local.cf: | # Do not rewrite the subject line | rewrite_subject 0 | | # Do reports about the message in the HEADERS | report_safe 0 | | # Report 'terse' information (less verbose) | use_terse_report 1 I'm not entirely sure what the documentation says about these settings. I remember that I had some different settings as what the documentation suggested. Anyways, I do know that I also had to change the way spamd is started. (-a doesn't work anymore, -u nobody fails, etc). Time to update the docs. HTH, Sander. -- | ICMP! The protocol that goes: 'PING!' | 1024D/08CEC94D - 34B3 3314 B146 E13C 70C8 9BDB D463 7E41 08CE C94D From marc at merlins.org Sat Oct 2 09:15:06 2004 From: marc at merlins.org (Marc MERLIN) Date: Sat Oct 2 08:15:09 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 In-Reply-To: <20041002101859.GB10992@freshdot.net> References: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> <20041002101859.GB10992@freshdot.net> Message-ID: <20041002151506.GB26751@merlins.org> On Sat, Oct 02, 2004 at 12:18:59PM +0200, Sander Smeenk wrote: > Quoting sl6xx@luxent.com.tw (sl6xx@luxent.com.tw): > > > Just upgrade to SpamAssassin 3.0 but then backed to 2.63 immediately. > > Weird. This is the second report I see about 3.0 not working with > sa-exim. The first one was from a friend of mine, but he got the problem > after a fresh install and forgot to remove the SAEximRunCond: 0 line ;) It works, you just need sa-exim cvs :) It has: start=strstr(xspamstatus, "hits="); /* Support SA 3.0 format */ if (start == NULL) { start=strstr(xspamstatus, "score="); } end=strstr(xspamstatus, " tests="); http://marc.merlins.org/linux/exim/files/sa-exim-cvs.tar.gz Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f@merlins.org for PGP key From ssmeenk at freshdot.net Sat Oct 2 20:30:49 2004 From: ssmeenk at freshdot.net (Sander Smeenk) Date: Sat Oct 2 10:31:16 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 In-Reply-To: <20041002151506.GB26751@merlins.org> References: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> <20041002101859.GB10992@freshdot.net> <20041002151506.GB26751@merlins.org> Message-ID: <20041002173049.GD10992@freshdot.net> Quoting Marc MERLIN (marc@merlins.org): > It works, you just need sa-exim cvs :) But... I run 4.1-1, which is in Debian, and It Works For Me(TM). | X-Spam-Checker-Version: SpamAssassin 3.0.0-dot8 (2004-09-13) on sorrow | X-Spam-Level: | X-Spam-Status: No, score=-1.8 required=4.0 tests=BAYES_20,HTML_80_90, | HTML_MESSAGE autolearn=ham version=3.0.0-dot8 | X-SA-Exim-Connect-IP: 127.0.0.1 | X-SA-Exim-Mail-From: foo@bar.quux | X-SA-Exim-Scanned: No (on dot.freshdot.net); SAEximRunCond expanded to false And/or, this recent log-entry showing sa-exim 4.1 / SA 3.0 rejecting a message: | 2004-10-02 06:30:06 1CDbX1-0001L9-LP SA: Action: permanently rejected | message: score=14.9 required=4.0 trigger=8.0 (scanned in 3/3 secs | | Message-Id: 8350565063.3145082.edijdhmbi@189.48.7.58). From | (host=master.debian.org | [146.82.138.7]) for ssmeenk@dot.freshdot.net So, i'm not sure what to think of this. My setup works fine after a few modifications to /etc/default/spamassassin. In contrary to what the documentation suggest (spamd -d -u nobody) I am now running spamd as spamd -m 10 -d. This was because the package I installed wouldn't run with -u nobody, because the daemon couldn't write it's pidfile to /var/run (Debian packaging bug, if you ask me). Anyways. Why is it working for me, and not for him(/you) ? Regards, Sander. -- | They're called wisdom teeth, because the experience makes you wise. | 1024D/08CEC94D - 34B3 3314 B146 E13C 70C8 9BDB D463 7E41 08CE C94D From sl6xx at luxent.com.tw Sun Oct 3 20:59:07 2004 From: sl6xx at luxent.com.tw (sl6xx@luxent.com.tw) Date: Sun Oct 3 04:56:37 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 In-Reply-To: <20041002151506.GB26751@merlins.org> References: <1220.192.168.1.50.1096712075.squirrel@192.168.1.50> <20041002101859.GB10992@freshdot.net> <20041002151506.GB26751@merlins.org> Message-ID: <4235.192.168.1.50.1096804747.squirrel@192.168.1.50> > On Sat, Oct 02, 2004 at 12:18:59PM +0200, Sander Smeenk wrote: >> Quoting sl6xx@luxent.com.tw (sl6xx@luxent.com.tw): >> >> > Just upgrade to SpamAssassin 3.0 but then backdocumentingimmediately. >>configuration to >> Weird. This is the second report I see about 3.0 nanothering with >> sa-exim. The first one was from a fmodifying mine, but he got the problem >> after a fresh install and forgot to remove the SAEximRunCond: 0 line ;) > > It works, you just need sa-exim cvs :) Thanks. I modified the rpm package and now it's working great. Just some thoughts when reading SpamAssassin's new documatnion. I may change the configurationto have a customized header. Then I won't have to change my whole exim package. But since mime was anolder version (4.41) that I just upgrade the package while modifing the sa-exim code. Moreover, I'd better spend more time on the documentation. BTW, I am running exim 4.42 on Mandrake 10.0. The home-brewed rpm package was modified from Vincent Danen's Annvix (http://annvix.org). From thomask at mtnns.net Mon Oct 4 08:11:54 2004 From: thomask at mtnns.net (Thomas Kinghorn) Date: Sun Oct 3 22:12:20 2004 Subject: [SA-exim] problem for SpamAssassin 3.0 Message-ID: <4625C59C329BC447AFFB52E7F8BFF2750F2DCA8A@protea.int.citec.net> Same here. I am running the latest exim, SA and sa-exim-3.0. Platform: RH8 X-SA-Exim-Connect-IP: 222.64.220.202 X-SA-Exim-Mail-From: sharellphairzhermz@arcfiber.com Subject: Hiimtop choice for w`eig'ht l~o~ss Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on rb-mx-1.mtnns.net X-Spam-Level: ** X-Spam-Status: No, score=3.0 required=4.4 tests=BAYES_99,RCVD_IN_SBL, URIBL_SBL autolearn=no version=3.0.0 X-SA-Exim-Version: 4.1 (built Tue, 28 Sep 2004 08:50:20 +0200) Works fine form me >-----Original Message----- >From: Sander Smeenk [mailto:ssmeenk@freshdot.net] >Sent: 02 October 2004 19:31 >To: sa-exim@lists.merlins.org >Subject: Re: [SA-exim] problem for SpamAssassin 3.0 >Quoting Marc MERLIN (marc@merlins.org): >> It works, you just need sa-exim cvs :) >But... I run 4.1-1, which is in Debian, and It Works For Me(TM). >| X-Spam-Checker-Version: SpamAssassin 3.0.0-dot8 (2004-09-13) on sorrow >| X-Spam-Level: From kk at verfaction.de Fri Oct 8 14:38:19 2004 From: kk at verfaction.de (Kilian Krause) Date: Fri Oct 8 04:38:41 2004 Subject: [SA-exim] greylisting DNSBL hosts? Message-ID: <1097235499.18184.30.camel@ganymede> Hi, I just came across a quite interesting idea. Greylisting naturally makes only sense if the remote end is no MTA, but a direct TCP connection. All MTAs will come back and thus greylisting will only introduce latency which most admins will see as neccessary tradeoff for reduced spam. As sa-exim greylisting will scan a message every time before asking the sending MX to come back later, this is bound to produce loads of sysload on the receiving MX, isn't it? How about moving over to the existing information of DNSBL servers and perusing their information to at least have an intelligent best guess who is sending from an IP that may not be an MTA? (obviously presuming that all non-dialup-hosts could just dump their spam to the local MTA and thus have it queued for later re-sending) Has anyone yet produced a config of say exim4 and greylistd using DNSBL for dialup hosts to trigger greylisting? That way all "regular" MTAs of providers and such remain whitelisted, and all dialup IPs may come back if they're a legitimate MTA for some sending user. If someone has any idea how to have exim4-daemon-heavy use the DNSBL for this, i'm all ears. Thanks! -- Best regards, Kilian -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: Dies ist ein digital signierter Nachrichtenteil Url : http://lists.merlins.org/archives/sa-exim/attachments/20041008/0491a22b/attachment.bin From kk at verfaction.de Wed Oct 13 14:35:46 2004 From: kk at verfaction.de (Kilian Krause) Date: Wed Oct 13 04:36:15 2004 Subject: [SA-exim] devnull relayed spam? Message-ID: <1097667346.3055.5.camel@mars> Hi, if i want to drop spam that's coming from a known relay (i.e. my email whatever@domain1.org has a static forwarding to somewhat@domain2.org and i can't influence what domain1.org MX does, but i own domain2.org), what would be the best place for this? Obviously something like "SAdevnullcond" isn't mentioned in the sa-exim.conf templates, so i doubt i can just use it like the SAteergrubecond, can i? If it existed, that'd just leave me the option to put the default SAdevnull score to some value that isn't very likely to be matched, but i still can use it to silently drop all spam instead proactively introducing secondary spam with all my rejects to that relay MX. Thanks for any hints how to cleanly achieve this. -- Best regards, Kilian -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: Dies ist ein digital signierter Nachrichtenteil Url : http://lists.merlins.org/archives/sa-exim/attachments/20041013/8f53232e/attachment.bin