On 11/01/2013 08:45 AM, Tim Whitaker wrote:
Hi everybody... I've been running qmail toaster on a fresh CentOS 5.9
install for about a month now and all has been well except for one
thing... spam. I have googled as much as I could to try and figure out
what my problem might be and I've made some changes but still some
really annoying spam is coming through with file attachments and such.
My problem is I can't figure out how to find any logs to tell me if
SpamAssassin is actually working. I know the service is running. In
there spirit of giving too much information, here's a bunch of stuff:
cat /etc/tcprules.d/tcp.smtp
127.:allow,RELAYCLIENT="",DKSIGN="/var/qmail/control/domainkeys/%/private"
:allow,BADMIMETYPE="",BADLOADERTYPE="M",CHKUSER_RCPTLIMIT="50",CHKUSER_WRONGRCPTLIMIT="10",QMAILQUEUE="/var/qmail/bin/simscan",DKSIGN="/var/qmail/control/domainkeys/%/private"
cat /var/qmail/control/simcontrol
:clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif
qmailctl stat
authlib: up (pid 16643) 49008 seconds
clamd: up (pid 16614) 49008 seconds
imap4: down 49008 seconds
imap4-ssl: down 49008 seconds
pop3: up (pid 16603) 49008 seconds
pop3-ssl: up (pid 16665) 49008 seconds
send: up (pid 16626) 49008 seconds
smtp: up (pid 16635) 49008 seconds
spamd: up (pid 16622) 49008 seconds
submission: up (pid 16685) 49007 seconds
authlib/log: up (pid 16645) 49008 seconds
clamd/log: up (pid 16616) 49008 seconds
imap4/log: down 49008 seconds
imap4-ssl/log: down 49008 seconds
pop3/log: up (pid 16605) 49008 seconds
pop3-ssl/log: up (pid 16671) 49008 seconds
send/log: up (pid 16610) 49008 seconds
smtp/log: up (pid 16640) 49008 seconds
spamd/log: up (pid 16631) 49008 seconds
submission/log: up (pid 16661) 49008 seconds
Nice thread, everyone. I'm happy to see the community taking such an
active role.
I'd like to add and reinforce a few things.
Spamdyke will be included [email protected] in the
forthcoming stock QMT release. It's a must have. If I had to pick a
single anti-spam piece of software, it'd be spamdyke hands down. Sam C
(the author) deserves many kudos for this great product. FWIW, Sam will
probably be modifying the next version to be able to function as an smtp
proxy, so it will be usable by any smtp transport, not just qmail. When
that happens, I expect that spamdyke will become widely adopted.
I hope that Dspam will be available with a future QMT release, but don't
look for it any time soon. It will likely be implemented along with
amavisd-new, which will replace simscan.
I'm a little surprised more of you aren't using qmlog. It's a great tool
for examining logs. I often do:
# qmlog -f smtp
to tail the smtp log. qmlog also has powerful search capabilities with
the -lc (log containing) option for searching for any regex. qmlog also
nicely formats the date/time stamp, so you don't need to remember to
pipe through tai64nlocal (which is part of the daemontools package, so
should be on every QMT host). For spamassassin, you might do:
# qmlog -f spamd
to see spmaassassin at work. Of course if you have spamdyke installed,
there won't be a lot to see there. :) Enter the qmlog command by itself
to see all of its options. You'll never need to manually examine logs again.
While sanesecurity doesn't catch a lot of spam, what it does specialize
in is phishing attempts, which nothing else appears to catch. I do use
it. The only problem I've had is that some phishing attempts are so good
at appearing to be emails from banking institutions that sometimes it
blocks monthly statements from AmExp and Chase. As a work-around I've
chosen to bypass scanning of emails from these institutions.
Thanks again to everyone for their participation here. Nice work!
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
