Mailing List Archive

Exim not passing email to spamassassin
I'm using Red Hat 7.1 and Exim 3.22
I have tested spamc and it works just fine, spamd is running, however I
can't get Exim to automagically check the emails with spamassassin.
I followed the directions everyone refers to, supplied by 'dman'.
I must be missing something in my Exim config.
Here's the pertinent pieces of my config:

######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# ORDER DOES NOT MATTER #
# Only one appropriate transport is called for each delivery. #
######################################################################

# A transport is used only when referenced from a director or a router that
# successfully handles an address.


# Spam Assassin
spamcheck:
driver = pipe

command = /usr/sbin/exim -oMr spam-scanned -bS
transport_filter = /usr/bin/spamc

bsmtp = all

home_directory = "/tmp"
current_directory = "/tmp"

# must use a privileged user to set $received_protocol on the way back
in!
user = mail
group = mail

return_path_add = false

log_output = true
return_fail_output = true

prefix =
suffix =

# This transport is used for delivering messages over SMTP connections.

remote_smtp:
driver = smtp
# Added by occ
hosts_avoid_tls = *

# This transport is used for local delivery to user mailboxes in traditional
# BSD mailbox format. By default it will be run under the uid and gid of the
# local user, and requires the sticky bit to be set on the /var/mail
directory.
# Some systems use the alternative approach of running mail deliveries under
a
# particular group instead of using the sticky bit. The commented options
below
# show how this can be done.

local_delivery:
driver = appendfile
file = /var/mail/$local_part
delivery_date_add
envelope_to_add
return_path_add
group = mail
mode = 0660


# This transport is used for handling pipe deliveries generated by alias
# or .forward files. If the pipe generates any standard output, it is
returned
# to the sender of the message as a delivery error. Set return_fail_output
# instead of return_output if you want this to happen only when the pipe
fails
# to complete normally. You can set different transports for aliases and
# forwards if you want to - see the references to address_pipe in the
directors
# section below.

address_pipe:
driver = pipe
return_output


# This transport is used for handling deliveries directly to files that are
# generated by aliasing or forwarding.

address_file:
driver = appendfile
delivery_date_add
envelope_to_add
return_path_add


# This transport is used for handling autoreplies generated by the filtering
# option of the forwardfile director.

address_reply:
driver = autoreply





######################################################################
# DIRECTORS CONFIGURATION #
# Specifies how local addresses are handled #
######################################################################
# ORDER DOES MATTER #
# A local address is passed to each in turn until it is accepted. #
######################################################################

# Spam Assassin
spamcheck_director:

# do not use this director when verifying a local-part at SMTP-time
no_verify

# When to scan a message :
# - it isn't already flagged as spam
# - it isn't already scanned
# - it didn't originate locally (as long as I don't harbor spammers
:-))
condition = "${if and { {!def:h_X-Spam-Flag:} {!eq
{$received_protocol}{spam-scanned}} {!eq {$received_protocol}{local}} }
{1}{0
}}"
driver = smartuser
transport = spamcheck

# Local addresses are those with a domain that matches some item in the
# "local_domains" setting above, or those which are passed back from the
# routers because of a "self=local" setting (not used in this
configuration).


# This director handles aliasing using a traditional /etc/aliases file.
# If any of your aliases expand to pipes or files, you will need to set
# up a user and a group for these deliveries to run under. You can do
# this by uncommenting the "user" option below (changing the user name
# as appropriate) and adding a "group" option if necessary. Alternatively,
you
# can specify "user" on the transports that are used. Note that those
# listed below are the same as are used for .forward files; you might want
# to set up different ones for pipe and file deliveries from aliases.

system_aliases:
driver = aliasfile
file = /etc/aliases
search_type = lsearch
# user = exim
file_transport = address_file
pipe_transport = address_pipe


# This director handles forwarding using traditional .forward files.
# If you want it also to allow mail filtering when a forward file
# starts with the string "# Exim filter", uncomment the "filter" option.

# The no_verify setting means that this director will be skipped when
# verifying addresses if sender_verify or receiver_verify is set (though
# they are not set by default). Similarly, no_expn means that this director
# will be skipped if smtp_expn_hosts is set to allow any hosts to use the
# EXPN command.

# The check_ancestor option means that if the forward file generates an
# address that is an ancestor of the current one, the current one gets
# passed on instead. This covers the case where A is aliased to B and B
# has a .forward file pointing to A.

# The three transports specified at the end are those that are used when
# forwarding generates a direct delivery to a file, or to a pipe, or sets
# up an auto-reply, respectively.

userforward:
driver = forwardfile
file = .forward
no_verify
no_expn
check_ancestor
# filter
file_transport = address_file
pipe_transport = address_pipe
reply_transport = address_reply


# This director matches local user mailboxes.

localuser:
driver = localuser
transport = local_delivery





######################################################################
# ROUTERS CONFIGURATION #
# Specifies how remote addresses are handled #
######################################################################
# ORDER DOES MATTER #
# A remote address is passed to each in turn until it is accepted. #
######################################################################

# Remote addresses are those with a domain that does not match any item
# in the "local_domains" setting above.

# Added by OCC 10/09/01
domainlist:
driver = domainlist
search_type = partial-lsearch
route_file = /etc/mail/mailroutes
transport = remote_smtp

# This router routes to remote hosts over SMTP using a DNS lookup with
# default options.

lookuphost:
driver = lookuphost
transport = remote_smtp

# This router routes to remote hosts over SMTP by explicit IP address,
# when an email address is given in "domain literal" form, for example,
# <user@[192.168.35.64]>. The RFCs require this facility. However, it is
# little-known these days, and has been exploited by evil people seeking
# to abuse SMTP relays. Consequently it is commented out in the default
# configuration. If you uncomment this router, you also need to comment out
# "forbid_domain_literals" above, so that Exim can recognize the syntax of
# domain literal addresses.

# domain_literal:
# driver = ipliteral
# transport = remote_smtp

Should I change the domainlookup router to use the spamcheck transport?

Any help would be greatly appreciated

Owen C. Creger CCNA
InfoSec Security Administrator
Creative Solutions, a division of Thomson Professional and Regulatory Inc.
7322 Newman Blvd.
Dexter, MI 48130
email: ocreger@creativesolutions.com
ph: 734-426-5860 ex. 3787
fax: 734-426-5946
cell: 734-223-6270
Exim not passing email to spamassassin [ In reply to ]
-----Original Message-----
From: Owen Creger
Sent: Monday, June 10, 2002 1:40 PM
To: Owen Creger
Subject: RE: [Exim] Exim not passing email to spamassassin


I changed the domainlist router to use spamcheck and now the emails are
checked numerous times :-(
What did I do wrong?

> -----Original Message-----
> From: Owen Creger [mailto:OCreger@CreativeSolutions.com]
> Sent: Monday, June 10, 2002 12:29 PM
> To: 'exim-users@exim.org'
> Subject: [Exim] Exim not passing email to spamassassin
>
>
> I'm using Red Hat 7.1 and Exim 3.22
> I have tested spamc and it works just fine, spamd is running,
> however I
> can't get Exim to automagically check the emails with spamassassin.
> I followed the directions everyone refers to, supplied by 'dman'.
> I must be missing something in my Exim config.
> Here's the pertinent pieces of my config:
>
> ######################################################################
> # TRANSPORTS CONFIGURATION #
> ######################################################################
> # ORDER DOES NOT MATTER #
> # Only one appropriate transport is called for each delivery. #
> ######################################################################
>
> # A transport is used only when referenced from a director or
> a router that
> # successfully handles an address.
>
>
> # Spam Assassin
> spamcheck:
> driver = pipe
>
> command = /usr/sbin/exim -oMr spam-scanned -bS
> transport_filter = /usr/bin/spamc
>
> bsmtp = all
>
> home_directory = "/tmp"
> current_directory = "/tmp"
>
> # must use a privileged user to set $received_protocol on
> the way back
> in!
> user = mail
> group = mail
>
> return_path_add = false
>
> log_output = true
> return_fail_output = true
>
> prefix =
> suffix =
>
> # This transport is used for delivering messages over SMTP
> connections.
>
> remote_smtp:
> driver = smtp
> # Added by occ
> hosts_avoid_tls = *
>
> # This transport is used for local delivery to user mailboxes
> in traditional
> # BSD mailbox format. By default it will be run under the uid
> and gid of the
> # local user, and requires the sticky bit to be set on the /var/mail
> directory.
> # Some systems use the alternative approach of running mail
> deliveries under
> a
> # particular group instead of using the sticky bit. The
> commented options
> below
> # show how this can be done.
>
> local_delivery:
> driver = appendfile
> file = /var/mail/$local_part
> delivery_date_add
> envelope_to_add
> return_path_add
> group = mail
> mode = 0660
>
>
> # This transport is used for handling pipe deliveries
> generated by alias
> # or .forward files. If the pipe generates any standard output, it is
> returned
> # to the sender of the message as a delivery error. Set
> return_fail_output
> # instead of return_output if you want this to happen only
> when the pipe
> fails
> # to complete normally. You can set different transports for
> aliases and
> # forwards if you want to - see the references to address_pipe in the
> directors
> # section below.
>
> address_pipe:
> driver = pipe
> return_output
>
>
> # This transport is used for handling deliveries directly to
> files that are
> # generated by aliasing or forwarding.
>
> address_file:
> driver = appendfile
> delivery_date_add
> envelope_to_add
> return_path_add
>
>
> # This transport is used for handling autoreplies generated
> by the filtering
> # option of the forwardfile director.
>
> address_reply:
> driver = autoreply
>
>
>
>
>
> ######################################################################
> # DIRECTORS CONFIGURATION #
> # Specifies how local addresses are handled #
> ######################################################################
> # ORDER DOES MATTER #
> # A local address is passed to each in turn until it is accepted. #
> ######################################################################
>
> # Spam Assassin
> spamcheck_director:
>
> # do not use this director when verifying a local-part at
> SMTP-time
> no_verify
>
> # When to scan a message :
> # - it isn't already flagged as spam
> # - it isn't already scanned
> # - it didn't originate locally (as long as I don't
> harbor spammers
> :-))
> condition = "${if and { {!def:h_X-Spam-Flag:} {!eq
> {$received_protocol}{spam-scanned}} {!eq
> {$received_protocol}{local}} }
> {1}{0
> }}"
> driver = smartuser
> transport = spamcheck
>
> # Local addresses are those with a domain that matches some
> item in the
> # "local_domains" setting above, or those which are passed
> back from the
> # routers because of a "self=local" setting (not used in this
> configuration).
>
>
> # This director handles aliasing using a traditional
> /etc/aliases file.
> # If any of your aliases expand to pipes or files, you will
> need to set
> # up a user and a group for these deliveries to run under. You can do
> # this by uncommenting the "user" option below (changing the user name
> # as appropriate) and adding a "group" option if necessary.
> Alternatively,
> you
> # can specify "user" on the transports that are used. Note that those
> # listed below are the same as are used for .forward files;
> you might want
> # to set up different ones for pipe and file deliveries from aliases.
>
> system_aliases:
> driver = aliasfile
> file = /etc/aliases
> search_type = lsearch
> # user = exim
> file_transport = address_file
> pipe_transport = address_pipe
>
>
> # This director handles forwarding using traditional .forward files.
> # If you want it also to allow mail filtering when a forward file
> # starts with the string "# Exim filter", uncomment the
> "filter" option.
>
> # The no_verify setting means that this director will be skipped when
> # verifying addresses if sender_verify or receiver_verify is
> set (though
> # they are not set by default). Similarly, no_expn means that
> this director
> # will be skipped if smtp_expn_hosts is set to allow any
> hosts to use the
> # EXPN command.
>
> # The check_ancestor option means that if the forward file
> generates an
> # address that is an ancestor of the current one, the current one gets
> # passed on instead. This covers the case where A is aliased
> to B and B
> # has a .forward file pointing to A.
>
> # The three transports specified at the end are those that
> are used when
> # forwarding generates a direct delivery to a file, or to a
> pipe, or sets
> # up an auto-reply, respectively.
>
> userforward:
> driver = forwardfile
> file = .forward
> no_verify
> no_expn
> check_ancestor
> # filter
> file_transport = address_file
> pipe_transport = address_pipe
> reply_transport = address_reply
>
>
> # This director matches local user mailboxes.
>
> localuser:
> driver = localuser
> transport = local_delivery
>
>
>
>
>
> ######################################################################
> # ROUTERS CONFIGURATION #
> # Specifies how remote addresses are handled #
> ######################################################################
> # ORDER DOES MATTER #
> # A remote address is passed to each in turn until it is accepted. #
> ######################################################################
>
> # Remote addresses are those with a domain that does not
> match any item
> # in the "local_domains" setting above.
>
> # Added by OCC 10/09/01
> domainlist:
> driver = domainlist
> search_type = partial-lsearch
> route_file = /etc/mail/mailroutes
> transport = remote_smtp
>
> # This router routes to remote hosts over SMTP using a DNS lookup with
> # default options.
>
> lookuphost:
> driver = lookuphost
> transport = remote_smtp
>
> # This router routes to remote hosts over SMTP by explicit IP address,
> # when an email address is given in "domain literal" form,
> for example,
> # <user@[192.168.35.64]>. The RFCs require this facility.
> However, it is
> # little-known these days, and has been exploited by evil
> people seeking
> # to abuse SMTP relays. Consequently it is commented out in
> the default
> # configuration. If you uncomment this router, you also need
> to comment out
> # "forbid_domain_literals" above, so that Exim can recognize
> the syntax of
> # domain literal addresses.
>
> # domain_literal:
> # driver = ipliteral
> # transport = remote_smtp
>
> Should I change the domainlookup router to use the spamcheck
> transport?
>
> Any help would be greatly appreciated
>
> Owen C. Creger CCNA
> InfoSec Security Administrator
> Creative Solutions, a division of Thomson Professional and
> Regulatory Inc.
> 7322 Newman Blvd.
> Dexter, MI 48130
> email: ocreger@creativesolutions.com
> ph: 734-426-5860 ex. 3787
> fax: 734-426-5946
> cell: 734-223-6270
>
>
> --
>
> ## List details at
http://www.exim.org/mailman/listinfo/exim-users Exim details at
http://www.exim.org/ ##
Re: Exim not passing email to spamassassin [ In reply to ]
--
On Mon, Jun 10, 2002 at 01:46:48PM -0400, Owen Creger wrote:
| -----Original Message-----
| From: Owen Creger
| Sent: Monday, June 10, 2002 1:40 PM
| To: Owen Creger
| Subject: RE: [Exim] Exim not passing email to spamassassin
|
|
| I changed the domainlist router to use spamcheck and now the emails are
| checked numerous times :-(
| What did I do wrong?

exim 4 is much easier to understand.

exim 3 has two separate sections that handle "outgoing" mail. One of
them, directors, is for outgoing mail that is delivered locally. The
other, routers, is for outgoing mail that isn't being delivered
locally. What you want to do is copy the spamcheck_director into the
top of the routers section.

By changing the domainlist router to use the spamcheck transport
here's what happens :

1) new message arrives.
2) route it -- it isn't for a "local domain", check the routers list
3) "domainlist" router accepts responsiblity for it
4) deliver it -- the router says to use the "spamcheck" transport
5) feed it to the spamcheck transport, we're all done here
6) new message arrives (this "new" message is the output from spamc,
it's really the same message but exim doesn't know that)
7) go to #2
ad inifinitum

The trick to changing step #7 is to set $received_protocol during the
spamcheck transport and then bypassing the spamcheck_router (which you
will create by moving the spamcheck_director).

[snip to rather critial details in the config]
| > command = /usr/sbin/exim -oMr spam-scanned -bS
^^^^^^^^^^^^^^^^^
| > # When to scan a message :
| > # - it isn't already scanned

| > condition = "${if !eq {$received_protocol}{spam-scanned} {1}{0 }}"

| > Should I change the domainlookup router to use the spamcheck
| > transport?

No.


It is important, when configuring exim, to understand how exim handles
addresses and messages (routers, directors, transports and the
interactions between them).

HTH,
-D

--

The righteous hate what is false,
but the wicked bring shame and disgrace.
Proverbs 13:5

GnuPG key : http://dman.ddts.net/~dman/public_key.gpg

--
[ Content of type application/pgp-signature deleted ]
--