From: "Thomas Booms" <[EMAIL PROTECTED]>
Loren Wilton schrieb:
Well, header I have on detected spams like these (possibly I need to
reconfigure something) to get the above lists:
X-Spam-Status: No, score=-1.8 required=1.5 tests=BAYES_00,
DATE_IN_FUTURE_03_06 autolearn=ham version=3.0.4
This says that the message is NOT spam. Bayes in particular is convinced
that it was ham, and has auto-learned it as such. It looks like your
Bayes
database is corrupt and will need to be rebuilt at some point.
However, before doing that, we need to figure out why all this hit was
date-in-future.
I'm a little concerned that that initial Received header from Qmail may
be
keeping SA from analyzing the return headers. This could case a lot fo
the
net tests to fail. Hiwever, maybe that header is ok. Others that know
more
about received headers than I do will look at it.
If that spam had been in English the body text would have nailed it.
"Greencard lottery" is pretty much a guaranteed spam indicator all by
itself. This looks like a case where a few of the rules for these things
could profitably be translated to German, by someone that speaks both
languages. (I don't, or I'd just do it.)
There is a good chance though that register-usa.com should have hit
SURBL.
This makes me think your net tests aren't working. Since this is 3.0.4,
they should be by default.
Why don't you run "spamassassin --lint -D" and post the output. My guess
is
you either have a problem with the Net::DNS version, or init.pre insn't
installed correctly. (Of course you might be starting SA with the -L
parameter that disables net tests.)
Loren
Here's what you wanted (by spamassassin --lint -D):
spamassassin --lint -D
debug: SpamAssassin version 3.0.4
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/sbin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/root/bin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/usr/local/news/bin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/var/qmail/bin', keeping.
debug: PATH included '/usr/local/bin/ezmlm', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/games', keeping.
debug: PATH included '/opt/gnome/bin', keeping.
debug: PATH included '/opt/kde3/bin', keeping.
debug: PATH included '/usr/lib/java/jre/bin', keeping.
debug: Final PATH set to:
/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/local/news/bin
:/usr/bin:/usr/X11R6/bin:/bin:/var/qmail/bin:/usr/local/bin/ezmlm:/usr/local
/sbin:/usr/games:/opt/gnome/bin:/opt/kde3/bin:/usr/lib/java/jre/bin
debug: diag: module installed: DBI, version 1.48
debug: diag: module installed: DB_File, version 1.811
debug: diag: module installed: Digest::SHA1, version 2.10
debug: diag: module installed: IO::Socket::UNIX, version 1.21
debug: diag: module installed: MIME::Base64, version 3.05
debug: diag: module installed: Net::DNS, version 0.52
Good version, I believe.
debug: diag: module not installed: Net::LDAP ('require' failed)
debug: diag: module installed: Razor2::Client::Agent, version 2.72
debug: diag: module installed: Storable, version 2.15
debug: diag: module installed: URI, version 1.35
debug: ignore: using a test message to lint rules
debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
debug: config: read file /etc/mail/spamassassin/init.pre
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/local.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/root/.spamassassin/user_prefs" for user prefs file
debug: config: read file /root/.spamassassin/user_prefs
From here it gets interesting.
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
debug: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
debug: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c)
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
implements 'parse_config'
debug: plugin: Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60)
implements 'parse_config'
Seems the BL plugins loaded OK.
debug: using "/root/.spamassassin" for user state dir
debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: using "/root/.spamassassin" for user state dir
debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
debug: bayes: 14504 untie-ing
debug: bayes: 14504 untie-ing db_toks
debug: bayes: 14504 untie-ing db_seen
debug: Score set 1 chosen.
debug: ---- MIME PARSER START ----
debug: main message type: text/plain
debug: parsing normal part
debug: added part, type: text/plain
debug: ---- MIME PARSER END ----
debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_toks
debug: bayes: 14504 tie-ing to DB file R/O /root/.spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: bayes: Not available for scanning, only 0 spam(s) in Bayes DB < 200
debug: bayes: 14504 untie-ing
debug: bayes: 14504 untie-ing db_toks
debug: bayes: 14504 untie-ing db_seen
debug: metadata: X-Spam-Relays-Trusted:
debug: metadata: X-Spam-Relays-Untrusted:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
implements 'parsed_metadata'
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.52
You do have DNS available.
debug: trying (3) yahoo.com...
debug: looking up NS for 'yahoo.com'
debug: NS lookup of yahoo.com succeeded => Dns available (set
dns_available to hardcode)
debug: is DNS available? 1
And DNS works, at least on a simple check.
debug: decoding: no encoding detected
debug: URIDNSBL: domains to query:
debug: all '*From' addrs: [EMAIL PROTECTED]
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: registering glue method for check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60))
debug: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: SPF: message was delivered entirely via trusted relays, not
required
debug: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8de9e60))
debug: all '*To' addrs:
debug: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: SPF: message was delivered entirely via trusted relays, not
required
debug: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: registering glue method for check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: registering glue method for check_for_spf_helo_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x8dcb25c))
debug: running body-text per-line regexp tests; score so far=-2.623
debug: running uri tests; score so far=-2.623
Registered SPF tests.
debug: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38))
debug: Razor2 is available
debug: entering helper-app run mode
razor2 check skipped: No such file or directory Can't read conf file:
/etc/mail/spamassassin/.razor/razor-agent.conf
Can't run Razor2. It's not available on your machine. So no score.
debug: leaving helper-app run mode
debug: Razor2 results: spam? 0 highest cf score: 0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
implements 'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-2.623
debug: running full-text regexp tests; score so far=-2.623
debug: Razor2 is available
debug: Current PATH is:
/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/local/news/bin
:/usr/bin:/usr/X11R6/bin:/bin:/var/qmail/bin:/usr/local/bin/ezmlm:/usr/local
/sbin:/usr/games:/opt/gnome/bin:/opt/kde3/bin:/usr/lib/java/jre/bin
debug: Pyzor is not available: pyzor not found
Pyzor is also not found. So of course - no pyzor score.
debug: DCCifd is not available: no r/w dccifd socket found.
DCCifd not there. So it is skipped.
debug: executable for dccproc was found at /usr/local/bin/dccproc
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 14505: ruid=0 euid=0
debug: DCC: got response: X-DCC-NIET-Metrics: host1 1080; Body=3682
Fuz1=2216208 Fuz2=2216196
debug: leaving helper-app run mode
debug: DCC: Listed! BODY: 3682 of 999999 FUZ1: 2216208 of 999999 FUZ2:
2216196 of 999999
DCC exists and was run. Not sure what it's report means.
debug: Running tests for priority: 500
debug: RBL: success for 1 of 1 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x84e5f38)
implements 'check_post_dnsbl'
So all the BL tests ou asked for basically failed because the Razor
and Pyzor facilities were not located on your machine. You will have
to install them. (And you should enable other rules you seem to have
disabled.)
debug: running meta tests; score so far=-1.25
debug: running header regexp tests; score so far=0.32
debug: running body-text per-line regexp tests; score so far=0.32
debug: running uri tests; score so far=0.32
debug: running raw-body-text per-line regexp tests; score so far=0.32
debug: running full-text regexp tests; score so far=0.32
debug: Running tests for priority: 1000
debug: running meta tests; score so far=0.32
debug: running header regexp tests; score so far=0.32
debug: using "/root/.spamassassin" for user state dir
debug: lock: 14504 created
/root/.spamassassin/auto-whitelist.lock.host1.booms-edv.de.14504
debug: lock: 14504 trying to get lock on
/root/.spamassassin/auto-whitelist with 0 retries
Thomas
{^_^} Joanne
