SEO

Hello,

I've switched to version 3.x of spamassassin and now I have some trouble.
This is not a basic trouble, I've read all the doc and followed all the
upgrade procedure, spent hours on google.
When I submit a test message to spamassassin like :
spamassassin -D < spam_message
the listing is OK, the subject line is modified with ------Spam------ as
required in local.cf on the listing
But the message is unchanged ! No subject change, no flag.
So, everything seems to work, but I cannot filter the spam.

Anybody has an idea ?
Thank you.

Regards

Albert <albert@ilestpasla.com> wrote:
> Hello,
>
> I've switched to version 3.x of spamassassin and now I have some
> trouble. This is not a basic trouble, I've read all the doc and
> followed all the upgrade procedure, spent hours on google.
> When I submit a test message to spamassassin like :
> spamassassin -D < spam_message
> the listing is OK, the subject line is modified with ------Spam------
> as required in local.cf on the listing
> But the message is unchanged ! No subject change, no flag.
> So, everything seems to work, but I cannot filter the spam.
>
> Anybody has an idea ?
> Thank you.

Tried "spamassassin --lint"?

Regards,
--
*Art

Arthur Hagen has offered us the following clue :

> Albert <albert@ilestpasla.com> wrote:
>> Hello,
>>
>> I've switched to version 3.x of spamassassin and now I have some
>> trouble. This is not a basic trouble, I've read all the doc and
>> followed all the upgrade procedure, spent hours on google.
>> When I submit a test message to spamassassin like :
>> spamassassin -D < spam_message
>> the listing is OK, the subject line is modified with ------Spam------
>> as required in local.cf on the listing
>> But the message is unchanged ! No subject change, no flag.
>> So, everything seems to work, but I cannot filter the spam.
>>
>> Anybody has an idea ?
>> Thank you.
>
> Tried "spamassassin --lint"?
>
> Regards,

This is the output :

[27412] warn: config: cannot open "/etc/mail/spamassassin/secrets.cf":
Permission non accordée
[27412] warn: config: warning: score set for non-existent rule
FUZZY_GUARANTEE
[27412] warn: config: warning: score set for non-existent rule FUZZY_BILLION
[27412] warn: config: warning: score set for non-existent rule FUZZY_XPILL
[27412] warn: config: warning: score set for non-existent rule
FUZZY_PRESCRIPT
[27412] warn: config: warning: score set for non-existent rule
FUZZY_SOFTWARE
[27412] warn: config: warning: score set for non-existent rule
SUBJECT_FUZZY_TION
[27412] warn: config: warning: score set for non-existent rule
FUZZY_PHARMACY
[27412] warn: config: warning: score set for non-existent rule
FUZZY_TRAMADOL
[27412] warn: config: warning: score set for non-existent rule FUZZY_OFFERS
[27412] warn: config: warning: score set for non-existent rule
SUBJECT_FUZZY_VPILL
[27412] warn: config: warning: score set for non-existent rule
FUZZY_MEDICATION
[27412] warn: config: warning: score set for non-existent rule FUZZY_CREDIT
[27412] warn: config: warning: score set for non-existent rule
FUZZY_THOUSANDS
[27412] warn: config: warning: score set for non-existent rule FUZZY_CPILL
[27412] warn: config: warning: score set for non-existent rule
FUZZY_OBLIGATION
[27412] warn: config: warning: score set for non-existent rule
SUBJECT_FUZZY_PENIS
[27412] warn: config: warning: score set for non-existent rule FUZZY_MONEY
[27412] warn: config: warning: score set for non-existent rule
SUBJECT_FUZZY_MEDS
[27412] warn: config: warning: score set for non-existent rule
FUZZY_CELEBREX
[27412] warn: config: warning: score set for non-existent rule FUZZY_FOLLOW
[27412] warn: config: warning: score set for non-existent rule FUZZY_PLEASE
[27412] warn: config: warning: score set for non-existent rule FUZZY_VICODIN
[27412] warn: config: warning: score set for non-existent rule FUZZY_ERECT
[27412] warn: config: warning: score set for non-existent rule FUZZY_VLIUM
[27412] warn: config: warning: score set for non-existent rule FUZZY_MILLION
[27412] warn: config: warning: score set for non-existent rule
FUZZY_AFFORDABLE
[27412] warn: config: warning: score set for non-existent rule FUZZY_REMOVE
[27412] warn: config: warning: score set for non-existent rule FUZZY_ROLEX
[27412] warn: config: warning: score set for non-existent rule FUZZY_AMBIEN
[27412] warn: config: warning: score set for non-existent rule
FUZZY_MORTGAGE
[27412] warn: config: warning: score set for non-existent rule FUZZY_PRICES
[27412] warn: config: warning: score set for non-existent rule
FUZZY_REFINANCE
[27412] warn: config: warning: score set for non-existent rule FUZZY_VIOXX
[27412] warn: config: warning: score set for non-existent rule
SUBJECT_FUZZY_CHEAP
[27412] warn: config: warning: score set for non-existent rule FUZZY_VPILL
[27412] warn: config: warning: score set for non-existent rule FUZZY_PHENT
[27412] warn: config: warning: score set for non-existent rule FUZZY_MILF
[27412] warn: lint: 37 issues detected, please rerun with debug enabled for
more information

It does not seem to show something useful.
When I do "spamassassin < spam_message > output.txt" I get a correct message
in outout.txt with flags and subject changed. The only thing is that I
would like the spam_message itself to be changed.

Albert wrote:
> Hello,
>
> I've switched to version 3.x of spamassassin and now I have some trouble.
> This is not a basic trouble, I've read all the doc and followed all the
> upgrade procedure, spent hours on google.
> When I submit a test message to spamassassin like :
> spamassassin -D < spam_message
> the listing is OK, the subject line is modified with ------Spam------ as
> required in local.cf on the listing
> But the message is unchanged ! No subject change, no flag.
> So, everything seems to work, but I cannot filter the spam.

How do you use spamassassin when you don't test?



//Aho

J.O. Aho has offered us the following clue :

> Albert wrote:
>> Hello,
>>
>> I've switched to version 3.x of spamassassin and now I have some trouble.
>> This is not a basic trouble, I've read all the doc and followed all the
>> upgrade procedure, spent hours on google.
>> When I submit a test message to spamassassin like :
>> spamassassin -D < spam_message
>> the listing is OK, the subject line is modified with ------Spam------ as
>> required in local.cf on the listing
>> But the message is unchanged ! No subject change, no flag.
>> So, everything seems to work, but I cannot filter the spam.
>
> How do you use spamassassin when you don't test?
>
>
>
> //Aho

I use kmail and spamc. Everything was OK with spamassassin 2.x, now it's
broken with 3.1.0. I've cleaned up my Perl versions, etc etc.
What I don't understand is why spamassassin does not modify the mail
message.

Albert wrote:
> Anybody has an idea ?

Have you checked the Header fields in the message? You mail client
should be capable to filter these. Below is an example from my spam box
today.

HTH,
Jan

X-Spam-Status: Yes, score=15.708 tagged_above=2 required=5
tests=[BAYES_80=2,
DATE_IN_FUTURE_96_XX=2.403, HELO_DYNAMIC_IPADDR2=3.818,
HTML_IMAGE_ONLY_32=1.052, HTML_MESSAGE=0.001,
RCVD_IN_BL_SPAMCOP_NET=1.558,
RCVD_IN_NJABL_DUL=1.946, RCVD_IN_SORBS_DUL=2.046, URI_NOVOWEL=0.884]
X-Spam-Score: 15.708
X-Spam-Level: ***************
X-Spam-Flag: YES
X-Spam-Report: Spam detection software, running on the system
"enterprise.ds.de", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Hi, postmaster. I railing of clanking a hasty the
thronged is whiffled She waists was decentlooking of syringe it
recompensed beaches Me unkempt fires is finelooking of insolendy a
talkativeness A reason? the reception raven it bewildered she vermin You
contemplate of geese the instruments and typist or drunk Not sparkles
you currency and enterers me exterior exposures No thanks is gush this
vanished of edges the foreigners If theatres we quieter of disciplined a
highranking is lodger An fetch me lawn you anxious she righty longed
Have people crows of wettest it intact was party Was apron not register
nauseous a wrung or privy And marriage population is danger of subject
an casting [...] Content analysis details: (15.7 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr
2)
2.4 DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date
0.9 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
1.1 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of
words
2.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95%
[score: 0.9347]
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
[218.186.234.175 listed in dnsbl.sorbs.net]
1.6 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?218.186.234.175>]
1.9 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[218.186.234.175 listed in combined.njabl.org]






--
Lasst uns mehr Freiheit wagen! /"\ ASCII ribbon campaign
- Angela Merkel, 30.11.2005 \ / against HTML
X in eMail and news
/ \

Jan Schubert has offered us the following clue :

> Albert wrote:
>> Anybody has an idea ?
>
> Have you checked the Header fields in the message? You mail client
> should be capable to filter these. Below is an example from my spam box
> today.
>
> HTH,
> Jan
>
> X-Spam-Status: Yes, score=15.708 tagged_above=2 required=5
> tests=[BAYES_80=2,
> DATE_IN_FUTURE_96_XX=2.403, HELO_DYNAMIC_IPADDR2=3.818,
> HTML_IMAGE_ONLY_32=1.052, HTML_MESSAGE=0.001,
> RCVD_IN_BL_SPAMCOP_NET=1.558,
> RCVD_IN_NJABL_DUL=1.946, RCVD_IN_SORBS_DUL=2.046, URI_NOVOWEL=0.884]
> X-Spam-Score: 15.708
> X-Spam-Level: ***************
> X-Spam-Flag: YES
> X-Spam-Report: Spam detection software, running on the system

Yes, when I run spamassassin manually, this is OK. I have the subject
re-written and the X-Spam-Flag set on the report from spamassassin in my
console. But the actual mail message is not modified by spamassassin.

This is my local.cf file (no user prefs) and the v310.pre :

local.cf :

# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
################################################## #########################
#
#This setting allows users to create rules (and only rules) in their
#user_prefs files for use with spamd
allow_user_rules 1

# Enable the Bayes system
use_bayes 1

#Bayesian filter
bayes_min_ham_num 100
bayes_min_spam_num 100

# How many hits before a message is considered spam
required_score 4.0

#By setting this option, the header will be tagged with STRING to indicate
that a message is spam
rewrite_header Subject ----SPAM----

#Add report
add_header all Report _REPORT_

#encapsulate spam in an attachment
#report_safe 0 Don't Use Attachments : original message is unchanged
#report_safe 1 Use Attachments : original message is encapsulated in its
original format and added as an attachment (default)
#report_safe 2 Use Text-only Attachments : original message is converted to
text and added as an attachment
report_safe 0

# Use terse version of the spam report
#remove_header all Report

# Enable Bayes auto-learning
bayes_auto_learn 1
bayes_auto_learn_threshold_spam 12.0
bayes_auto_learn_threshold_nonspam 0.1

# bayes_path /var/spamassassin/bayes

# Enable or disable network checks
# skip_rbl_checks 0
# use_razor2 0
# use_dcc 0
# use_pyzor 0

# Mail using languages used in these country codes will not be marked
# as being possibly spam in a foreign language
ok_languages en fr th

# Mail using locales used in these country codes will not be marked
# as being possibly spam in a foreign language
ok_locales en th fr

# auto_whitelist_path /var/spamassassin/auto-whitelist


This is my v310.pre :


# DCC - perform DCC message checks.
#
# DCC is disabled here because it is not open source. See the DCC
# license for more details.
#
#loadplugin Mail::SpamAssassin::Plugin:CC

# Pyzor - perform Pyzor message checks.
#loadplugin Mail::SpamAssassin::Plugin::Pyzor

# Razor2 - perform Razor2 message checks.
#
# Razor2 is disabled here because it is not available for unlimited free
# use. It is currently free for personal use, subject to capacity
# constraints. See the Cloudmark SpamNet Service Policy for more details.
#
#loadplugin Mail::SpamAssassin::Plugin::Razor2

# SpamCop - perform SpamCop message reporting
loadplugin Mail::SpamAssassin::Plugin::SpamCop

# AntiVirus - some simple anti-virus checks, this is not a replacement
# for an anti-virus filter like Clam AntiVirus
loadplugin Mail::SpamAssassin::Plugin::AntiVirus

# AWL - do auto-whitelist checks
#
loadplugin Mail::SpamAssassin::Plugin::AWL

# AutoLearnThreshold - threshold-based discriminator for Bayes auto-learning
#
loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold

# TextCat - language guesser
#
loadplugin Mail::SpamAssassin::Plugin::TextCat

# AccessDB - lookup from-addresses in access database
#
#loadplugin Mail::SpamAssassin::Plugin::AccessDB

# WhitelistSubject - Whitelist/Blacklist certain subject regular expressions
#
loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject

################################################## #########################
# experimental plugins

# DomainKeys - perform DomainKeys verification
#
# External modules required for use, see INSTALL for more information.
#
#loadplugin Mail::SpamAssassin::Plugin:omainKeys

# MIMEHeader - apply regexp rules against MIME headers in the message
#loadplugin Mail::SpamAssassin::Plugin::MIMEHeader

# ReplaceTags
#loadplugin Mail::SpamAssassin::Plugin::ReplaceTags

Albert wrote:
> Jan Schubert has offered us the following clue :
>
>> Albert wrote:
>>> Anybody has an idea ?
>> Have you checked the Header fields in the message? You mail client
>> should be capable to filter these. Below is an example from my spam box
>> today.
>>
>> HTH,
>> Jan
>>
>> X-Spam-Status: Yes, score=15.708 tagged_above=2 required=5
>> tests=[BAYES_80=2,
>> DATE_IN_FUTURE_96_XX=2.403, HELO_DYNAMIC_IPADDR2=3.818,
>> HTML_IMAGE_ONLY_32=1.052, HTML_MESSAGE=0.001,
>> RCVD_IN_BL_SPAMCOP_NET=1.558,
>> RCVD_IN_NJABL_DUL=1.946, RCVD_IN_SORBS_DUL=2.046, URI_NOVOWEL=0.884]
>> X-Spam-Score: 15.708
>> X-Spam-Level: ***************
>> X-Spam-Flag: YES
>> X-Spam-Report: Spam detection software, running on the system
>
> Yes, when I run spamassassin manually, this is OK. I have the subject
> re-written and the X-Spam-Flag set on the report from spamassassin in my
> console. But the actual mail message is not modified by spamassassin.

I guess there is something that isn't right with kmail, could be that it just
send the mail to the spamassassin without taking it back.

I haven't used spamassassin together with a mail-client, I let my procmail
take care of this and each user can setup procmail rules to filter the mail
and of course allow clients to do even further filtering if needed. I haven't
had to do any adjustments, spamassassin has worked the same way since I
installed it the early 2.x and still doing as 3.x.


//Aho

Hi,

Thank you all for your quick reaction and helpful hand.
Finally, I found the answer, so simple :

1- Spamassassin does not rewrite the mail message, but generates a new
version of it that is piped out somewhere if you specify it. The
documentation is very poor, I had to spend hours before I understood.

Foe example : spamassassin < spam_message just outputs a modified mail
message on the terminal and does not rewrite spam_message. You need to do
spamassassin < spam_message > new_spam_message to have something useful.

There is a nice article here :

Once you've installed it, SpamAssassin runs from the shell prompt as
follows: spamassassin < mbox > mbox_spam
Where mbox is your mailbox file maintained by evolution or Kmail. For
evolution you can find your mailbox file
in /home/user/evolution/local/Inbox/ and for Kmail, it's
in /home/User/Mail/inbox
SpamAssassin actually identifies a particular mail as spam and outputs a
corresponding mail with body and subject changed indicating this is a Spam.
So if the new mbox_spam is imported again to your mail client, the spam
mails will be identified with an appropriate subject heading. This behavior
is especially important when SpamAssassin is used on the server side and in
fact is exploited by Kmail.
http://www.pcquest.com/content/topst.../103060502.asp

2- If you use a mail client like Kmail (by the way, a little publicity,
kmail is fantastic), you have to select the option "pipe through" and not
"execute". Of course "execute" makes nothing since the spamassassin output
is lost.
Many web sites about spamassassin + kmail make the mistake !

Regards