Spamassassin configuration questions

Submitted by mhagen on Sat, 06/02/2018 - 15:47 Pro Licensee

Howdy guys,

So i really need some help with spamassassin. I can't figure it out with google and stuff.

In webmin spamassassin i have edited the "global" config to use bayes at path "/var/spamassassin/bayes_db/bayes".

But for every mailbox under /home//homes/ there is a .spamassassin with a user_prefs. But this one is just a generic config with nothing enabled. Why is this? Sometimes it also contains the bayes_seen and bayes_toks. ALSO in the /home/ is a .spamassassin folder with stuff in it.

My goal is to create a global spamassassin. 1 config, 1 db. This is not the case atm.

Status: 
Active

Comments

Submitted by andreychek on Sat, 06/02/2018 - 16:01

Howdy -- if you look in Email Settings -> Spam and Virus Scanning, what is "SpamAssassin client program" set to?

If it's set to "spamc", you should end up with one centralized config.

If it's set to "standalone", each user should end up with their own config.

There's additional details in the help text for that option, but let us know if you have any additional questions!

Submitted by mhagen on Sat, 06/02/2018 - 16:59 Pro Licensee

It's set to spamc, thats the problem. Spam mails get the X-Spam with a requirement of 5.0 but i have set the global to 2.0. So i know for a facts that its not working.

Submitted by mhagen on Wed, 06/20/2018 - 16:25 Pro Licensee

This need some help with this.

Submitted by andreychek on Wed, 06/20/2018 - 17:30

Could you share a screenshot of how your Email Settings -> Spam and Virus Settings screen looks?

Also, what is the output of this command:

rpm -qa | grep -i spamassassin

Submitted by andreychek on Thu, 06/21/2018 - 10:05

Hmm, no problems are standing out to me there, that all looks good. Unfortunately, I'm not quite sure why you're seeing that behavior from SpamAssassin.

One thing I think I'd try, is just reset those SpamAssassin settings, to ensure there isn't a bad config in there somewhere.

To do that, go into that Spam and Virus scanning screen, and there, set SpamAssassin to use the "SpamAssassin (standalone program)" option.

After making that change, click Save.

Now, go back in and switch it back to "Spamc (Client for SpamAssassin)".

Then, try it again and see if that makes a difference.

Submitted by mhagen on Fri, 06/22/2018 - 16:54 Pro Licensee

I have tried that and watched the logs for awhile. I also had deleted all the .spamassassin, but they where still created upon receiving email. But this is a user pref file so different from first. That's good! I don't know how or what but i think it has been fixed somehow. I did some changed to where the bayes_db path is but should be irrelevant.

I'll keep watching for some more days.

Submitted by mhagen on Wed, 06/27/2018 - 14:12 Pro Licensee

So after some days it looks like it working now, it uses the global config and made user_pref files as override. Thanks for the support

Submitted by mhagen on Wed, 06/27/2018 - 14:13 Pro Licensee

Status: Active » Closed (fixed)

Submitted by mhagen on Fri, 06/29/2018 - 11:43 Pro Licensee

Well Just got a bunch more spam which are not filtered while it should be.

Submitted by andreychek on Fri, 06/29/2018 - 11:46

Unfortunately, SpamAssassin doesn't catch everything... what we can do though is verify that SpamAssassin is processing the messages.

Do you see a X-Spam-Status header in your email? If so, can you paste in it's contents?

Submitted by mhagen on Fri, 06/29/2018 - 11:51 Pro Licensee

X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
web.dutchmasterserver.nl
X-Spam-Level: *
X-Spam-Status: No, score=1.8 required=5.0 tests=DKIM_ADSP_CUSTOM_MED,
DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,
HEADER_FROM_DIFFERENT_DOMAINS,NML_ADSP_CUSTOM_MED,T_DKIM_INVALID autolearn=no
autolearn_force=no version=3.4.0

I know it’s wrong because of the required 5.0 The default config is 2.0

Submitted by andreychek on Fri, 06/29/2018 - 12:01

I'm unfortunately really not sure why you're seeing that behavior, I don't seem to be able to reproduce that elsewhere, and we hadn't received other similar reports.

I'd be curious though, is there a "required=5.0" in the user_prefs file? I'd be curious if commenting that out causes it to look at the global config.

Submitted by mhagen on Fri, 06/29/2018 - 12:07 Pro Licensee

All the user_pref files are “empty” or all lines are commented out. It should use the /etc/mail/SpamAssassin/local.cf as default

Submitted by andreychek on Fri, 06/29/2018 - 16:57

Understood.

I'm hoping maybe Jamie will have some thoughts on what's going on there, as I've never run into anything like that before.

Submitted by JamieCameron on Sat, 06/30/2018 - 13:05

Note that in spamc mode, only the global config is used - not per-user files under ~/.spamassassin

Submitted by mhagen on Sat, 06/30/2018 - 14:13 Pro Licensee

Hi there,

For every domain that has email enabled has a .spamassassin with a user_prefs file in it.
Example: /home/marchagen/homes/hello for hello[at]marchagen.[nl] email box has this folder.

And like mentioned above the files are recreated when deleted.

Submitted by mhagen on Mon, 07/02/2018 - 12:31 Pro Licensee

procmail wrapper file (/etc/webmin/virtual-server/procmail/[ID]):

DROPPRIVS=yes
:0fw
| /bin/spamc
SPAMMODE=1
:0
* ^X-Spam-Status: Yes
$HOME/Maildir/.Spam/
SPAMMODE=0

This is for all the procmail files in /etc/webmin/virtual-server/procmail the same

Submitted by mhagen on Mon, 07/02/2018 - 13:27 Pro Licensee

As it appears it was not working for 2 of the 15 domains, i recreated the configs there and seems to work now. Not quite sure what happened there but will see. Have to wait on spam mail tho. Takes a day or 2

Submitted by andreychek on Mon, 07/02/2018 - 13:37

That's really bizarre, but that's a good find!

I don't imagine you happen to recall what the configs looked like for the 2 domains you mentioned that were having this problem?

Is that an example of one in Comment #18 above?

Submitted by mhagen on Mon, 07/02/2018 - 13:41 Pro Licensee

Comment #18 has one of a domain that was good, i didn't look at all the configs. Way to much :P
But indeed i don't have a version of that. I think it was a faulty procmail config.