Peter Ulrich Kruppa wrote:
Am Montag, den 04.01.2010, 13:45 +0000 schrieb Matthew Seaman:Matthew Seaman wrote:find the records in /var/mail/maillog to show abuse.net's serverconnecting Ooops. /var/log/maillogThat would be those: --------------------------------------------cat maillog | grep "abuse.net"Jan 4 12:26:46 pukruppa sm-mta[8964]: o04BQi0O008964: from=<prvs=0613aad273=postmaster-ulrich=pukruppa....@abuse.net>, size=333, class=0, nrcpts=1, msgid=<20100104112454.38321.qm...@gal.iecc.com>, proto=ESMTP, daemon=IPv4, relay=gal.iecc.com [208.31.42.53] Jan 4 12:32:12 pukruppa sm-mta[10672]: o04BWBOA010672: from=<spamt...@abuse.net>, size=909, class=0, nrcpts=1, msgid=<rlytest-1262604620-41...@abuse.net>, proto=SMTP, daemon=IPv4, relay=verify.abuse.net [208.31.42.77] Jan 4 12:33:00 pukruppa spamd[1650]: spamd: checking message<rlytest-1262604620-41...@abuse.net> for ulrich:1001 Jan 4 12:33:03 pukruppa spamd[1650]: spamd: result: . -4 -BAYES_50,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HIscantime=3.4,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=28691,mid=<rlytest-1262604620-41...@abuse.net>,bayes=0.486826,autolearn=ham Jan 4 13:28:39 pukruppa sm-mta[56503]: o04CSb9P056503:from=<spamt...@abuse.net>, size=909, class=0, nrcpts=1, msgid=<rlytest-1262608007-71...@abuse.net>, proto=SMTP, daemon=IPv4, relay=verify.abuse.net [208.31.42.77] Jan 4 13:29:20 pukruppa spamd[1650]: spamd: checking message<rlytest-1262608007-71...@abuse.net> for ulrich:1001 Jan 4 13:29:24 pukruppa spamd[1650]: spamd: result: . -6 -AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HIscantime=3.4,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=21436,mid=<rlytest-1262608007-71...@abuse.net>,bayes=0.000000,autolearn=ham Jan 4 13:35:47 pukruppa sm-mta[58137]: o04CZkfq058137:from=<spamt...@abuse.net>, size=909, class=0, nrcpts=1, msgid=<rlytest-1262608435-75...@abuse.net>, proto=SMTP, daemon=IPv4, relay=verify.abuse.net [208.31.42.77] Jan 4 13:39:20 pukruppa spamd[1650]: spamd: checking message<rlytest-1262608435-75...@abuse.net> for ulrich:1001 Jan 4 13:39:24 pukruppa spamd[1650]: spamd: result: . -6 -AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HIscantime=4.1,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=24280,mid=<rlytest-1262608435-75...@abuse.net>,bayes=0.000000,autolearn=ham Jan 4 14:27:59 pukruppa sm-mta[87839]: o04DRvKd087839:from=<spamt...@abuse.net>, size=906, class=0, nrcpts=1, msgid=<rlytest-1262611567-9...@abuse.net>, proto=SMTP, daemon=IPv4, relay=verify.abuse.net [208.31.42.77] Jan 4 14:29:27 pukruppa spamd[1650]: spamd: checking message<rlytest-1262611567-9...@abuse.net> for ulrich:1001 Jan 4 14:29:30 pukruppa spamd[1650]: spamd: result: . -6 -AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HIscantime=3.1,size=1227,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=27859,mid=<rlytest-1262611567-9...@abuse.net>,bayes=0.000000,autolearn=ham ----------------------------------------------------------BTW. I have read somewhere, there might be problems with hostnames like pukruppa.net, since they would allow to relay all mails from .net ?!?
Something doesn't add up here -- the log shows the message being processed by SpamAssassin, but there was no indication in the sendmail .mc file you showed us of any integration with a spam filter. I'd expect some sort of milter configuration. Unfortunately as well, the log line showing the delivery result is usually one of the ones *following* the line showing the external MTA handing off the message to you. Try grepping for the sendmail queue IDs: o04BQi0O008964 o04BWBOA010672 o04CSb9P056503 o04CZkfq058137 etc.The lines that say 'dsn=<something>' are the important bits. If <something> is 2.0.0 (ie. successful delivery) then you've got a real problem. The result
should be 5.x.y (ie. permanent failure) and a snotty message about 'relaying denied'. Cheers, Matthewbtw. you need to update your SpamAssassin rules -- you're triggering on the FH_DATE_PAST_20XX test all the time, which will give you some false
positives. -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW
signature.asc
Description: OpenPGP digital signature