This behaviour has been the same since I started using filter-spamassassin
which was before the May 23 snapshot.  Currently on the June 6 snapshot of
opensmtpd & opensmtpd-extras.

Using filter-spamassassin like this

filter filter-spamassassin spamassassin "-s reject"

When an email is rejected, the log entry looks like this:

Jun 15 13:28:04 mxgw3 smtpd[23583]: 94725446b2523387 smtp event=connected
address=60.167.113.80 host=60.167.113.80
Jun 15 13:28:11 mxgw3 filter-spamassassin[10058]: warn: session
94725446b2523387: on_eom: REJECT spam
Jun 15 13:28:11 mxgw3 smtpd[23583]: 94725446b2523387 smtp
event=failed-command command=DATA result=554 5.7.1 Message considered spam
Jun 15 13:28:11 mxgw3 smtpd[23583]: 94725446b2523387 smtp event=closed
reason=quit


I also use an IP whitelist - actually the nospamd table used for spamd. PF
redirects whitelisted connections to a listener at opensmtpd which doesn't
do filter-spamassassin.

The problem is troubleshooting false positives so I can improve my
whitelist.  Unless I obtain a sample NDR from the sender, it's difficult to
match up the source MTA with a sending domain.

The ideal solution is to display the from and to address in the rejection
log line just like clamsmtp does it:

Jun 15 13:14:48 mxgw3 clamsmtpd: 102B1B: [email protected], to=
[email protected], status=VIRUS:Heuristics.Phishing.Email.SSL-Spoof

Incidentally, I've tried adding the -v option to the filter-spamassassin
directive at smtpd.conf.  This in fact breaks smtpd such that it accepts no
connections at all.  I believe I'll need to file a separate bug report for
that.

Thanks,
Andrew

Reply via email to