spamd Errors on New Ubuntu 14.04 Server - Permission denied

Hi,

We just migrated our main Virtualmin Pro server to a new server and I'm just working through the issues.

The old server was CentOS 6, but we needed newer PHP. Since CentOS 7 gives me the creeps, I put the new server up on Ubuntu Server 14.04 LTS. I don't know how much that matters...

I installed all the perl modules Spamassassin wants, using cpan for the ones I couldn't find packages for.

"spamassassin -D --lint" looks very happy to me, as does "sa-update -D".

I checked the permissions for the perl modules that the errors are occurring on and they all look good, even if being run setuid to the user.

The modules with the errors are in "/usr/lib/perl5/Net/DNS/RR/" and were installed by packages.

In the mail.log, I consistently see lines like this:

Jan 25 19:56:02 www spamd[3742]: spamd: connection from localhost [::1]:38818 to port 783, fd 6
Jan 25 19:56:02 www spamd[3742]: spamd: setuid to jgalen succeeded
Jan 25 19:56:02 www spamd[3742]: spamd: processing message <201601260251.u0Q2pUo5018127@l33.spamh.com> for jgalen:1047
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 1534) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1535) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 35 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/CNAME.pm: Permission denied at (eval 1536) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 35 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1537) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 47 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1538) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 1539) line 2, <GEN67> line 170.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3742]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 1540) line 2.
Jan 25 19:56:02 www spamd[3742]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SPF/Server.pm line 513.
Jan 25 19:56:02 www spamd[3745]: spamd: connection from localhost [::1]:38820 to port 783, fd 6
Jan 25 19:56:02 www spamd[3745]: spamd: setuid to jgalen succeeded
Jan 25 19:56:02 www spamd[3745]: spamd: processing message <201601260251.u0Q2pUQv018014@s30.spamh.com> for jgalen:1047
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 1460) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1461) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 35 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/CNAME.pm: Permission denied at (eval 1462) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 35 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1463) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 47 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 1464) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 1465) line 2, <GEN29> line 170.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 25 19:56:02 www spamd[3745]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 1466) line 2.
Jan 25 19:56:02 www spamd[3745]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SPF/Server.pm line 513.
Jan 25 19:56:02 www spamd[3742]: spamd: clean message (0.8/5.0) for jgalen:1047 in 0.6 seconds, 10766 bytes.

Thanks in advance for your assistance.

G

Status: 
Active

Comments

Hmm, those are some pretty unusual errors! You shouldn't have to manually install or configure any modules for SpamAssassin on a typical installation.

Is this a dedicated server, or a VPS? I'm curious if you're using a provider-supplied VPS image?

Or is it possible you have some custom SpamAssassin settings?

Also, what is the output of this command:

find /usr -name NS.pm

Not being overly familiar with Ubuntu Server, I ran across another log file with important info.../var/log/mail.err...which contains lines like:

Jan 25 09:27:02 www spamc[3744]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Jan 25 09:27:02 www spamc[3744]: connect to spamd on 127.0.0.1 failed, retrying (#1 of 3): Connection refused
Jan 25 09:27:03 www spamc[3744]: connect to spamd on ::1 failed, retrying (#2 of 3): Connection refused
Jan 25 09:27:03 www spamc[3744]: connect to spamd on 127.0.0.1 failed, retrying (#2 of 3): Connection refused
Jan 25 09:27:04 www spamc[3744]: connect to spamd on ::1 failed, retrying (#3 of 3): Connection refused
Jan 25 09:27:04 www spamc[3744]: connect to spamd on 127.0.0.1 failed, retrying (#3 of 3): Connection refused
Jan 25 09:27:04 www spamc[3744]: connection attempt to spamd aborted after 3 retries

A little Googling seems to indicate that I might need "allow_user_rules 1" in the Spamassassin config. But in Virtualmin, the Spamassassin config is 'distributed' and I'm not sure which user_prefs file to edit or if I'm evenon the right track.

Maybe there's some user/group/permissions issue I need to deal with first?

BTW, here is the answer to your question: /usr/lib/perl5/Net/DNS/RR/NS.pm

And yes, this is a VM, but it's on our infrastructure (XenServer) and I built the Ubuntu VM myself.

Thanks,

G

I just tried a test and it seemed to work, so maybe the permissions idea is wrong.

su - henry -s /bin/bash

spamc < /home/henrycrafter/homes/henry/Maildir/.spam/cur/1453765102.8845_0.www

Seems to work OK, but this was still logged in /var/log/mail.log:

Jan 26 14:56:11 www spamd[23969]: spamd: connection from localhost [::1]:46820 to port 783, fd 6
Jan 26 14:56:11 www spamd[23969]: spamd: setuid to henry succeeded
Jan 26 14:56:11 www spamd[23969]: spamd: processing message <cc18f0b01b42906984ddc4c0fa6182bc@team.com> for henry:1033
Jan 26 14:56:11 www spamd[23969]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 4151) line 2, <GEN1528> line 500.
Jan 26 14:56:11 www spamd[23969]:  RR at octet 39 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 26 14:56:11 www spamd[23969]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 4152) line 2, <GEN1528> line 500.
Jan 26 14:56:11 www spamd[23969]:  RR at octet 43 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 26 14:56:11 www spamd[23969]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 4153) line 2.
Jan 26 14:56:11 www spamd[23969]:  RR at octet 26 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Jan 26 14:56:12 www spamd[23969]: spamd: identified spam (8.2/5.0) for henry:1033 in 0.4 seconds, 36043 bytes.
Jan 26 14:56:12 www spamd[23969]: spamd: result: Y 8 - BASE64_LENGTH_79_INF,BAYES_80,MISSING_DATE,MISSING_HEADERS,NO_RELAYS,TVD_PH_BODY_ACCOUNTS_PRE,T_OBFU_HTML_ATTACH,URI_PHISH scantime=0.4,size=36043,user=henry,uid=1033,required_score=5.0,rhost=localhost,raddr=::1,rport=46820,mid=<cc18f0b01b42906984ddc4c0fa6182bc@team.com>,bayes=0.878678,autolearn=no autolearn_force=no

G

You don't suppose this issue has anything to do with IPv6, do you? I'm not well versed in v6...

G

Okay, what is the output of these commands:

ls -ld /usr/lib/perl5
ls -ld /usr/lib/perl5/Net
ls -ld /usr/lib/perl5/Net/DNS/RR
ls -l /usr/lib/perl5/Net/DNS/RR/NS.pm

The mail.err log you found may have been a temporary problem, since you're able to run spamc now without errors. If spamd weren't working, your command on the command line would not have worked.

root@www:~# ls -ld /usr/lib/perl5
drwxr-xr-x 21 root root 4096 Jan 25 19:22 /usr/lib/perl5
root@www:~# ls -ld /usr/lib/perl5/Net
drwxr-xr-x 4 root root 4096 Aug  8 13:10 /usr/lib/perl5/Net
root@www:~# ls -ld /usr/lib/perl5/Net/DNS/RR
drwxr-xr-x 3 root root 4096 Aug  8 13:10 /usr/lib/perl5/Net/DNS/RR
root@www:~# ls -l /usr/lib/perl5/Net/DNS/RR/NS.pm
-rw-r--r-- 1 root root 2069 Jan 27  2012 /usr/lib/perl5/Net/DNS/RR/NS.pm

I can make ssh access temporarily available...

Thanks,

G

I've been trying to determine what can cause this sort of issue based on people seeing similar errors.

I see similar errors in a variety of distros out there, though the cause isn't clear. in some cases it appears to be a packaging bug though. I don't imagine you have any packages available to update?

Also, do you know if any third party (ie, non-standard) repositories have been enabled?

Lastly, if you look in Email Messages -> Spam and Virus Scanning, what is "SpamAssassin client program" set to?

Hi, and thanks again.

'spamc' is the selected option...and it IS working, at least partly.

No repos enabled, other than the defaults and Virtualmin...not even the Canonical partner repos.

Fully updated.

You don't suppose it might be because I have ALL the listed modules enabled, do you? (Our old CentOS Virtualmin server also had all the perl modules installed.) You commented the installing additional perl modules was usually unnecessary, but that was not my previous experience, so I enabled CPAN (cpanm) and installed all the perl modules queried by:

spamassassin -D --lint

Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: Digest::SHA1, version 2.13
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: HTML::Parser, version 3.71
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: Net::DNS, version 0.68
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: NetAddr::IP, version 4.071
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: Time::HiRes, version 1.9725
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: Archive::Tar, version 1.90
Jan 29 12:13:49.562 [25808] dbg: diag: [...] module installed: IO::Zlib, version 1.10
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: Digest::SHA1, version 2.13
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: MIME::Base64, version 3.13
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: DB_File, version 1.827
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: Net::SMTP, version 2.31
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: Mail::SPF, version v2.009
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: Geo::IP, version 1.45
Jan 29 12:13:49.563 [25808] dbg: diag: [...] module installed: Razor2::Client::Agent, version 2.84
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: IO::Socket::IP, version 0.37
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: IO::Socket::INET6, version 2.71
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: IO::Socket::SSL, version 1.965
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: Compress::Zlib, version 2.06
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: Mail::DKIM, version 0.4
Jan 29 12:13:49.564 [25808] dbg: diag: [...] module installed: DBI, version 1.63
Jan 29 12:13:49.565 [25808] dbg: diag: [...] module installed: Getopt::Long, version 2.39
Jan 29 12:13:49.565 [25808] dbg: diag: [...] module installed: LWP::UserAgent, version 6.05
Jan 29 12:13:49.565 [25808] dbg: diag: [...] module installed: HTTP::Date, version 6.02
Jan 29 12:13:49.565 [25808] dbg: diag: [...] module installed: Encode::Detect, version 1.01
Jan 29 12:13:49.565 [25808] dbg: diag: [...] module installed: Net::Patricia, version 1.22

However, the module that is apparently responsible for the errors was installed by a package (libnet-dns-perl). I just did a reinstall of that package, but no change:

apt-get install --reinstall libnet-dns-perl

Every incoming message gets something like:

Jan 29 12:35:12 www spamd[13085]: spamd: connection from localhost [::1]:53071 to port 783, fd 6
Jan 29 12:35:12 www spamd[13085]: spamd: setuid to stownsend succeeded
Jan 29 12:35:12 www spamd[13085]: spamd: processing message (unknown) for stownsend:1087
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3843) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 24 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3844) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 34 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/CNAME.pm: Permission denied at (eval 3845) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 38 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3846) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 41 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3847) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 41 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3848) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 34 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 3849) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 34 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3850) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 41 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1097.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3851) line 2, <GEN1138> line 653.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 24 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 3852) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 60 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 3853) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 60 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 3854) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 51 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 3855) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 34 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3856) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 57 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Dns.pm line 263.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/TXT.pm: Permission denied at (eval 3857) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 34 corrupt/incomplete at /usr/share/perl5/Mail/SPF/Server.pm line 513.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3858) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 30 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3859) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 46 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3860) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 37 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3861) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 46 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 3862) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 37 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Jan 29 12:35:12 www spamd[13085]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 3863) line 2.
Jan 29 12:35:12 www spamd[13085]:  RR at octet 37 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Jan 29 12:35:13 www spamd[13085]: spamd: clean message (2.0/5.0) for stownsend:1087 in 1.3 seconds, 43686 bytes.
Jan 29 12:35:13 www spamd[13085]: spamd: result: . 1 - BAYES_00,DKIM_SIGNED,DRUGS_ERECTILE,DRUGS_ERECTILE_OBFU,DRUGS_MUSCLE,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,MISSING_MID,RP_MATCHES_RCVD,T_DKIM_INVALID,T_REMOTE_IMAGE scantime=1.3,size=43686,user=stownsend,uid=1087,required_score=5.0,rhost=localhost,raddr=::1,rport=53071,mid=(unknown),bayes=0.000000,autolearn=no autolearn_force=no
Jan 29 12:35:13 www postfix/local[31054]: EEA5715EA0E: to=<stownsend@mail.virtualarchitects.com>, orig_to=<stownsend@swrealtyinvestments.com>, relay=local, delay=2.7, delays=0.64/0/0/2.1, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
Jan 29 12:35:13 www postfix/qmgr[3064]: EEA5715EA0E: removed

G

What are the contents of your "/etc/spamassassin/local.cf" file?

Almost nothing:

(IPs obfuscated)

grep -v '^$\|^\s*\#' /etc/spamassassin/local.cf
trusted_networks 192.168.0. 10.10.1. 198.xxx.xxx. 198.xxx.yyy.
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
endif # Mail::SpamAssassin::Plugin::Shortcircuit
locate local.cf
/etc/spamassassin/local.cf
/etc/webmin/virtual-server/spam/128329006312811/local.cf
/etc/webmin/virtual-server/spam/128519338314575/local.cf
/etc/webmin/virtual-server/spam/128519586218500/local.cf
/etc/webmin/virtual-server/spam/128519597619204/local.cf
/etc/webmin/virtual-server/spam/128519623620390/local.cf
/etc/webmin/virtual-server/spam/128519829726783/local.cf
/etc/webmin/virtual-server/spam/128527130018116/local.cf
/etc/webmin/virtual-server/spam/12861349251653/local.cf
/etc/webmin/virtual-server/spam/12969483123251/local.cf
/etc/webmin/virtual-server/spam/13228485531292/local.cf
/etc/webmin/virtual-server/spam/13228488182320/local.cf
/etc/webmin/virtual-server/spam/13293338651776/local.cf
/etc/webmin/virtual-server/spam/133255343721692/local.cf
/etc/webmin/virtual-server/spam/137496398828655/local.cf
/etc/webmin/virtual-server/spam/137572381914311/local.cf
/etc/webmin/virtual-server/spam/1375988502495/local.cf
/etc/webmin/virtual-server/spam/140716248831345/local.cf
/etc/webmin/virtual-server/spam/141306329427828/local.cf
/etc/webmin/virtual-server/spam/142516762932236/local.cf
/etc/webmin/virtual-server/spam/14530861824794/local.cf
/usr/share/spamassassin/local.cf
/var/lib/spamassassin/3.004000/updates_spamassassin_org/local.cf

Maybe this is another clue. Not sure if it's related, but it's more SA problems:

In Usermin, if a user tries to "Report Spam", it errors out with this visible in the browser window:

plugin: eval failed: bayes: learner_new Mail::SpamAssassin::BayesStore::DBM new() failed: Can't locate Mail/SpamAssassin/BayesStore/DBM.pm:   Permission denied at (eval 98) line 2.
plugin: eval failed: Can't call method "tie_db_readonly" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 637.
plugin: eval failed: Can't call method "sync" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 612.
plugin: eval failed: Can't call method "expire_old_tokens" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 624.
plugin: eval failed: Can't call method "untie_db" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 401.
plugin: eval failed: Can't call method "db_readable" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 327.
ERROR: the Bayes learn function returned an error, please re-run with -D for more information at /usr/bin/sa-learn line 497.
Learned tokens from 0 message(s) (1 message(s) examined)

It seems that SA is having trouble finding or using built-in SA perl modules.

It seems there must be some path or environment issue, maybe?

This is killing me. I really appreciate any pointers you can give me as Googling hasn't served me well here.

Thanks,

G

I have concluded that the Ubuntu Spamassassin installation and the Virtualmin installation script simply do not produce a working spam filter when installed on the latest Ubuntu 14.04 LTS. Since we purchased and maintain our support of Virtualmin Pro to avoid this situation, this is disappointing.

I'm not sure how correct these command examples are, but spamc (which is how I want to use Spamassassin) appears to run correctly:

spamc -u eiasillo < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1453809058.6267_0.www

But spamd logs this for the above spamc command:

Feb  2 14:11:27 www spamd[7668]: spamd: connection from localhost [::1]:59806 to port 783, fd 6
Feb  2 14:11:27 www spamd[7668]: spamd: setuid to eiasillo succeeded
Feb  2 14:11:27 www spamd[7668]: spamd: processing message <80087333843065.224blk87824df@weight-fetish.com> for eiasillo:1052
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 2545) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 31 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 2546) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 39 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2547) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 43 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 2548) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 25 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2549) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 25 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/NS.pm: Permission denied at (eval 2550) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 33 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 931.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/CNAME.pm: Permission denied at (eval 2551) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 38 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/CNAME.pm: Permission denied at (eval 2552) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 42 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1016.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2553) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 41 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1097.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2554) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 42 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1097.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2555) line 2, <GEN552> line 273.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 49 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1097.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/MX.pm: Permission denied at (eval 2556) line 2.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 30 corrupt/incomplete at /usr/local/share/perl/5.18.2/Mail/DKIM/DNS.pm line 177.
Feb  2 14:11:28 www spamd[7668]: Can't locate Net/DNS/RR/A.pm: Permission denied at (eval 2557) line 2.
Feb  2 14:11:28 www spamd[7668]:  RR at octet 41 corrupt/incomplete at /usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm line 1097.
Feb  2 14:11:28 www spamd[7668]: spamd: clean message (-1.0/5.0) for eiasillo:1052 in 1.0 seconds, 24920 bytes.
Feb  2 14:11:28 www spamd[7668]: spamd: result: . 0 - BAYES_00,HTML_MESSAGE,NO_RELAYS,RAZOR2_CHECK,T_REMOTE_IMAGE scantime=1.0,size=24920,user=eiasillo,uid=1052,required_score=5.0,rhost=localhost,raddr=::1,rport=59806,mid=<80087333843065.224blk87824df@weight-fetish.com>,bayes=0.000000,autolearn=no autolearn_force=no

Spamassassin appears to run correctly as root:

spamassassin -D -t -p /home/processengineeringllc/homes/eiasillo/.spamassassin/user_prefs < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1453809058.6267_0.www

But it errors out completely when run as a regular user:

su -s /bin/sh -c "spamassassin -D -t -p /home/processengineeringllc/homes/eiasillo/.spamassassin/user_prefs < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1453809058.6267_0.www" eiasillo

I have reinstalled both spamassassin and spamc using the --reinstall option.

sa-update runs OK after tweaking the ownership of /var/lib/spamassassin/3.004000.

su - debian-spamd -c "sa-update --gpghomedir /var/lib/spamassassin/sa-update-keys"

sa-learn bombs right away when run as a regular user:

su -s /bin/sh -c "sa-learn --spam --no-sync /home/processengineeringllc/homes/eiasillo/Maildir/.spam/{cur,new}" eiasillo
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/SpamCop.pm:   Permission denied at (eval 39) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/AutoLearnThreshold.pm:   Permission denied at (eval 40) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/WhiteListSubject.pm:   Permission denied at (eval 41) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/MIMEHeader.pm:   Permission denied at (eval 42) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/ReplaceTags.pm:   Permission denied at (eval 43) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/DKIM.pm:   Permission denied at (eval 44) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/Check.pm:   Permission denied at (eval 45) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/HTTPSMismatch.pm:   Permission denied at (eval 46) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/URIDetail.pm:   Permission denied at (eval 47) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/Bayes.pm:   Permission denied at (eval 48) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/BodyEval.pm:   Permission denied at (eval 49) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/DNSEval.pm:   Permission denied at (eval 50) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/HTMLEval.pm:   Permission denied at (eval 51) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/HeaderEval.pm:   Permission denied at (eval 52) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/MIMEEval.pm:   Permission denied at (eval 53) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/RelayEval.pm:   Permission denied at (eval 54) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/URIEval.pm:   Permission denied at (eval 55) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/WLBLEval.pm:   Permission denied at (eval 56) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/VBounce.pm:   Permission denied at (eval 57) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/ImageInfo.pm:   Permission denied at (eval 58) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/FreeMail.pm:   Permission denied at (eval 59) line 1.
plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/AskDNS.pm:   Permission denied at (eval 60) line 1.
Learned tokens from 0 message(s) (1 message(s) examined)
ERROR: the Bayes learn function returned an error, please re-run with -D for more information at /usr/bin/sa-learn line 497.

But runs fine when run as root:

sa-learn --spam --no-sync /home/processengineeringllc/homes/eiasillo/Maildir/.spam/{cur,new}
Learned tokens from 64 message(s) (64 message(s) examined)

I suspect the same basic problem is causing all these failures.

Any ideas?

Thanks,

G

Sorry that you're still having problems!

We unfortunately haven't been able to reproduce the problem you're seeing, and we haven't received other reports of that occurring.

One thought did occur to me as I was typing this out though -- what is the output of this command:

cat /etc/procmailrc

I wonder if something about the procmail config on your server could be causing that.

And similarly, what is the output of this command:

postconf -n | grep mailbox_command

That will show if there's anything unusual with how incoming email is being handled.

I apologize, but procmail looks like voodoo to me.

When we put up the new server and migrated the domains, we did not migrate the Virtualmin configuration...we did the domains only since we were switching OS's from CentOS to Ubuntu. So I would imaging most of the server configuration to be default Ubuntu+Virtualmin...like procmail.

cat /etc/procmailrc

LOGFILE=/var/log/procmail.log
TRAP=/etc/webmin/virtual-server/procmail-logger.pl
:0wi
VIRTUALMIN=|/etc/webmin/virtual-server/lookup-domain.pl $LOGNAME
EXITCODE=$?
:0
* ?/usr/bin/test "$EXITCODE" = "73"
/dev/null
EXITCODE=0
:0
* ?/usr/bin/test "$VIRTUALMIN" != ""
{
INCLUDERC=/etc/webmin/virtual-server/procmail/$VIRTUALMIN
}
ORGMAIL=$HOME/Maildir/
DEFAULT=$HOME/Maildir/
DROPPRIVS=yes
:0
$DEFAULT

Postfix, on the other hand, has been tweaked some, but not this parameter:

postconf -n | grep mailbox_command
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME

Thanks again,

G

That all looks normal.

I don't imagine you're seeing any errors in /var/log/procmail.log when emails arrive?

My only other thought at the moment is to verify the permissions on procmail and procmail wrapper... you can do that with these two commands:

ls -l /usr/bin/procmail
ls -l /usr/bin/procmail-wrapper

No errors noted in /var/log/procmail.log.

root@www:~# ls -l /usr/bin/procmail
-rwsr-sr-x 1 root mail 89216 Sep  4  2014 /usr/bin/procmail
root@www:~# ls -l /usr/bin/procmail-wrapper
-rwsr-xr-x 1 root root 4536 Dec 13  2006 /usr/bin/procmail-wrapper

Thanks again,

G

"spamd" and "spamd child" are both running as root. Setting "-u debian-spamd" in /etc/default/spamassassin makes "spamd child" run as debian-spamd, but it makes the logged problems worse.

/var/lib/spamassassin is owned by debian-spamd.

/etc/spamassassin is owned by root. The errors being logged in var/log/messages are by "spamd child"

Is this all correct? It doesn't make much sense to me...

It appears that the logged errors are mainly from the URIDNSBL.pm plugin, but running "spamassassin -D" as root from the command line does not show the same errors.

root@www:/var/lib/spamassassin# ps auxwww|grep spam
root      9303  0.0  0.0  11748  2224 pts/2    S+   13:13   0:00 grep --color=auto spam
root     28915  0.0  1.9 163884 77056 ?        Ss   11:54   0:02 /usr/sbin/spamd --create-prefs --max-children 5 --helper-home-dir -d --pidfile=/var/run/spamd.pid
root     28921  1.4  2.4 184092 97068 ?        S    11:54   1:08 spamd child
root     28922  0.0  2.1 173428 86728 ?        S    11:54   0:03 spamd child
root@www:/var/lib/spamassassin# cat /etc/default/spamassassin
ENABLED=1
OPTIONS="--create-prefs --max-children 5 --helper-home-dir"
CRON=1
PIDFILE=/var/run/spamd.pid

Is this possibly an ENV (environment) issue for "spamd" or "spamd child" ?

root@www:/var/lib/spamassassin# su - debian-spamd
$ env
MAIL=/var/mail/debian-spamd
USER=debian-spamd
HOME=/var/lib/spamassassin
LOGNAME=debian-spamd
TERM=xterm
XDG_SESSION_ID=2
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
XDG_RUNTIME_DIR=/run/user/0
LANG=en_US.UTF-8
SHELL=/bin/sh
PWD=/var/lib/spamassassin

sa-learn won't run as a user. Trying to mark a message as spam in Usermin results in:

Reporting this message to Razor and other SpamAssassin spam-blocking databases ..

plugin: eval failed: bayes: learner_new Mail::SpamAssassin::BayesStore::DBM new() failed: Can't locate Mail/SpamAssassin/BayesStore/DBM.pm:   Permission denied at (eval 1156) line 2.
plugin: eval failed: Can't call method "tie_db_readonly" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 637.
plugin: eval failed: Can't call method "sync" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 612.
plugin: eval failed: Can't call method "expire_old_tokens" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 624.
plugin: eval failed: Can't call method "untie_db" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 401.
plugin: eval failed: Can't call method "db_readable" on an undefined value at /usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm line 327.
ERROR: the Bayes learn function returned an error, please re-run with -D for more information at /usr/bin/sa-learn line 497.
Learned tokens from 0 message(s) (1 message(s) examined)

.. failed! See the error message above for the reason why.

Something is preventing SpamAssassin from looking for or loading it's modules, but I'm not sure what yet. That's a very bizarre issue! We've never run into anything like that before.

I asked Joe for some ideas, as all the output you shared above looks good... Joe wondered if maybe something like SELinux (or related) was causing any issues here.

If you look in /var/log/messages, /var/log/kern.log, or the dmesg output, do you see any errors occurring at the time these other messages show up?

Looking for coincident messages/errors:

/var/log/syslog No (Ubuntu 14.04 doesn't have /var/log/messages) /var/log/kern.log No (Just duplicated firewall messages from syslog) dmesg No (more duplicated firewall messages from syslog)

Ubuntu Server logging is messed up. I'm beginning to regret switching to Ubuntu Server 14.04 LTS.

I have now gotten more drastic in trying to fix this...and I'm breaking things. Bad for a production server.

I've disabled and uninstalled AppArmor.

I've disabled IPv6, and all the various services that were configured to use it.

I've also noticed that the cron job to update SA rules doesn't work properly. Since it runs as debian-spamd probably.

The goofed up mixture of ownership, permissions and run-as are just a mess with Spamassassin. Doesn't anybody sanity-check this stuff? Baggage from SA, Debian, Ubuntu, Virtualmin... Unless it's just too much work, you guys should use your own packages to keep idiots like me from going through this nightmare. Or integrate MailScanner...or something.

Sorry for whining...

G

Yup, I completely understand that you're frustrated! I would be too.

We do thoroughly test distros though before they're labeled as production ready.

We have quite a few Ubuntu 14.04 users. And I've tried several times to reproduce the issues you're experiencing. No other users have reported that, and we can't seem to reproduce it.

We have a meeting today, and I plan to run the issues you're seeing by Joe and Jamie. I'm hoping to come up with some more ideas that we can use to get to the bottom of that.

I know this isn't ultimately what you want, but just for testing purposes -- does the problem with incoming email go away if you were to switch it to use the spamassassin standalone scanner, rather than spamc? That can be changed in Email Messages -> Spam and Virus Scanning -> SpamAssassin client program.

Well, that did something. It turned off spam filtering...no references in mail.log and no SA headers on received messages. That HAS to be a big clue.

Unfortunately, I still don't really understand how Virtualmin does the mail filter routing. There is no milter configured in /etc/postfix/master.cf and no additional Received: headers, so I'm not sure how it works.

I have made some headway though...

I did Re-run Install Wizard (don't know if helped).

I did Re-check Configuration (it checked OK again).

I tweaked the permissions of /var/lib/spamassassin and a couple of things improved:

chown -R debian-spamd.debian-spamd /var/lib/spamassassin
find /var/lib/spamassassin -type f -exec chmod 644 {} \;
find /var/lib/spamassassin -type d -exec chmod 775 {} \;

reboot

1) It appears the spamc configuration is no longer causing errors to be logged on every incoming message (by "spamd child").

2) Errors are no longer thrown in the browser (Usermin) when clicking Report Spam.

Running spamc now seems to work:

spamc -u eiasillo < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1454565258.32109_0.www

When that spamc command is run, spamd only logs:

Feb  4 16:07:27 www spamd[3789]: spamd: connection from localhost [127.0.0.1]:41065 to port 783, fd 5
Feb  4 16:07:27 www spamd[3789]: spamd: setuid to eiasillo succeeded
Feb  4 16:07:27 www spamd[3789]: spamd: processing message <13204307-Intort24467618-634184491804ceeaf425b4dba52e9b21eiasillo@processengineeringllc.com> for eiasillo:1052
Feb  4 16:07:29 www spamd[3789]: spamd: identified spam (5.7/4.0) for eiasillo:1052 in 1.7 seconds, 10329 bytes.
Feb  4 16:07:29 www spamd[3789]: spamd: result: Y 5 - BAYES_60,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,NO_RELAYS,T_REMOTE_IMAGE,URIBL_BLACK,URIBL_DBL_SPAM scantime=1.7,size=10329,user=eiasillo,uid=1052,required_score=4.0,rhost=localhost,raddr=127.0.0.1,rport=41065,mid=<13204307-Intort24467618-634184491804ceeaf425b4dba52e9b21eiasillo@processengineeringllc.com>,bayes=0.797925,autolearn=no autolearn_force=no

Running spamassassin as root still works:

spamassassin -D -t -p /home/processengineeringllc/homes/eiasillo/.spamassassin/user_prefs < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1454619898.14251_0.www

I learned something important about those errors locating perl modules: I think it has to do with root's environment polluting things. Adding a 'dash' to the command line seems to change everything when run manually. I don't know how/if this is important to Virtualmin.

Running spamassassin as a user doesn't work without the 'dash'. This command bombs:

su -s /bin/sh -c "spamassassin -D -t -p /home/processengineeringllc/homes/eiasillo/.spamassassin/user_prefs < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1454565258.32109_0.www" eiasillo

It has multiple problems running SA plugins:

warn: plugin: failed to parse plugin (from @INC): Can't locate Mail/SpamAssassin/Plugin/SpamCop.pm: Permission denied

then fails with:

Can't locate Mail/SpamAssassin/Bayes.pm:   Permission denied at /usr/share/perl5/Mail/SpamAssassin.pm line 1770

However, this version of that command (with the 'dash') works properly:

su -s /bin/sh -c "spamassassin -D -t -p /home/processengineeringllc/homes/eiasillo/.spamassassin/user_prefs < /home/processengineeringllc/homes/eiasillo/Maildir/.spam/cur/1454565258.32109_0.www" - eiasillo

Same for sa-learn. This command bombs:

su -s /bin/sh -c "sa-learn -D --spam --no-sync /home/processengineeringllc/homes/eiasillo/Maildir/.spam/{cur,new}" eiasillo

And this version (with 'dash') runs fine:

su -s /bin/sh -c "sa-learn -D --spam --no-sync /home/processengineeringllc/homes/eiasillo/Maildir/.spam/{cur,new}" - eiasillo

As for sa-update, it now seems to run correctly also (command from /etc/cron.daily/spamassassin):

su - debian-spamd -c "sa-update --gpghomedir /var/lib/spamassassin/sa-update-keys"

So, I'm much closer, but I still want to fix things completely.

Why does setting "SpamAssassin client program" to standalone effectively turn off the filtering completely?

Thanks again,

G

A couple of comments on your questions --

Selecting spamassassin standalone program does not, or at least should not, disable spam filtering.

It just changes how it is accomplished.

Rather than running "spamc" on incoming emails, and communicating with the spamassassin daemon, it doesn't use a spamassassin daemon, and instead spawns a new spamassassin command for each incoming email.

As far as how Virtualmin uses/runs SpamAssassin -- that's done via procmail.

The "mailbox_command" within Postfix is set to have it call procmail-wrapper when delivering emails.

And then, within /etc/procmailrc, there's a line like this one here:

INCLUDERC=/etc/webmin/virtual-server/procmail/$VIRTUALMIN

That runs the proper procmail script for that particular Virtual Server.

Within that file that's called (in /etc/webmin/virtual-server/procmail), is a line that calls either spamc, or spamassassin, or neither, depending on the settings in use.

Since procmail changes to the user who owns the email, that procmail script is being run as the email user.

I spoke with Joe and Jamie about the issues you're seeing. Off the top of our heads, none of us were entirely certain what might be causing that.

When I was researching, I did run into a handful of other users who were seeing that around the Internet. There were even some bug reports open for a variety of distros with that same issue. Environmental issues appeared to cause of most cases I saw.

However, the fix wasn't clear, and the bug reporters were having a tough time because the folks trying to help them weren't able to reproduce it.

I'd be happy to log into your server and see if anything stands out to me as a possible cause, if you like.

Hi and thanks for the offer.

It's working pretty well right now, so I'm afraid to 'poke the bear'. SA always takes a lot out of me but it always works pretty well after all the tweaking.

Customers are happy now...

I don't really need to worry about any other configuration since I need it to work with spamc anyway.

Thanks for all your help.

G