Mailing List Archive

Newbie problem
Hallo,

I installed two day ago spamassassins, system is Redhat 8 and Sendmail 8.12.8.

Some mails are declared as spam immediately, other mails are delivered correctly.
My problem is, that there are mails, wich are not declared as spam and they are
not delivered.

The mail is scanned, spamassasin will add the text below and drop them mail back
to the mailqueue. This process runs circuar (40-50 times), until antivir will declare the
mail as virus-infected.

Can anybody please help?

Thanks Józsi

***************

Spam detection software, running on the system "Schlampe", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, see
the administrator of that system for details.

Content preview: Spam detection software, running on the system
"Schlampe", has identified this incoming email as possible spam. The
original message has been attached to this so you can view it (if it
isn't spam) or block similar future email. If you have any questions,
see the administrator of that system for details. [...]

Content analysis details: (107.9 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.5 WS_DEBP_PHRASE BODY: Enthält vermutlich pornographische Phrasen
0.1 HTML_FONTCOLOR_UNKNOWN BODY: HTML font color is unknown to us
0.0 HTML_MESSAGE BODY: HTML included in message
100 USER_IN_BLACKLIST From: address is in the user's black-list
2.0 HG_HORMONE Talks about hormones for human growth
4.3 OBFUSCATING_COMMENT HTML comments which obfuscate text

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.

.... der Telekom Geschäftskundenvertrieb hat
seinen Namen doch nicht etwa aus dem Grunde
weil er aktiv Geschäftskunden vertreibt ???????
Re: Newbie problem [ In reply to ]
Sounds like (and I'm completely guessing here because you didn't specify
what your config is) you have something whacked in your Procmail recipe.

HTH,
Rubin

On Thu, 2004-02-19 at 04:44, jozsef.juni@web.de wrote:
> Hallo,
>
> I installed two day ago spamassassins, system is Redhat 8 and Sendmail 8.12.8.
>
> Some mails are declared as spam immediately, other mails are delivered correctly.
> My problem is, that there are mails, wich are not declared as spam and they are
> not delivered.
>
> The mail is scanned, spamassasin will add the text below and drop them mail back
> to the mailqueue. This process runs circuar (40-50 times), until antivir will declare the
> mail as virus-infected.
>
> Can anybody please help?
>
> Thanks Józsi
>
> ***************
>
> Spam detection software, running on the system "Schlampe", has
> identified this incoming email as possible spam. The original message
> has been attached to this so you can view it (if it isn't spam) or block
> similar future email. If you have any questions, see
> the administrator of that system for details.
>
> Content preview: Spam detection software, running on the system
> "Schlampe", has identified this incoming email as possible spam. The
> original message has been attached to this so you can view it (if it
> isn't spam) or block similar future email. If you have any questions,
> see the administrator of that system for details. [...]
>
> Content analysis details: (107.9 points, 5.0 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> 1.5 WS_DEBP_PHRASE BODY: Enthält vermutlich pornographische Phrasen
> 0.1 HTML_FONTCOLOR_UNKNOWN BODY: HTML font color is unknown to us
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 100 USER_IN_BLACKLIST From: address is in the user's black-list
> 2.0 HG_HORMONE Talks about hormones for human growth
> 4.3 OBFUSCATING_COMMENT HTML comments which obfuscate text
>
> The original message was not completely plain text, and may be unsafe to
> open with some email clients; in particular, it may contain a virus,
> or confirm that your address can receive spam. If you wish to view
> it, it may be safer to save it to a file and open it with an editor.
>
> .... der Telekom Geschäftskundenvertrieb hat
> seinen Namen doch nicht etwa aus dem Grunde
> weil er aktiv Geschäftskunden vertreibt ???????
--
Rubin Bennett <rbennett@thatitguy.com>
RB Technologies
RE: Newbie problem [ In reply to ]
THis is the whole procmail.rc


:0fw
| /usr/bin/spamc
:0
* ^X-Spam-Status: Yes
! spam


J=F3zsi

On 19 Feb 2004 um 8:21 hat Raquel Rice wrote :

> On Thu, 19 Feb 2004 10:44:46 +0100
> jozsef.juni@web.de wrote:
>
> > Hallo,
> >
> > I installed two day ago spamassassins, system is Redhat 8 and
> > Sendmail 8.12.8.
> >
> > Some mails are declared as spam immediately, other mails are
> > delivered correctly. My problem is, that there are mails, wich are
> > not declared as spam and they are not delivered.
> >
> > The mail is scanned, spamassasin will add the text below and drop
> > them mail back to the mailqueue. This process runs circuar (40-50
> > times), until antivir will declare the mail as virus-infected.
> >
> > Can anybody please help?
> >
> > Thanks J=F3zsi
>
> Spamassassin doesn't delete, deliver/not deliver, mail. All it does
> is scan the mail and then, optionally, mark it up. I would say that
> you should look at your Procmail recipes.
>
> --
> Raquel
.... der Telekom Geschäftskundenvertrieb hat
seinen Namen doch nicht etwa aus dem Grunde
weil er aktiv Geschäftskunden vertreibt ???????
Re: Newbie problem [ In reply to ]
On Thu, Feb 19, 2004 at 08:16:11PM +0100, jozsef.juni@web.de is rumored to have said:
>
> THis is the whole procmail.rc
>
>
> :0fw
> | /usr/bin/spamc
> :0
> * ^X-Spam-Status: Yes
> ! spam

You're forwarding the message to a user called "spam". Take out the exclamation point, so your recipe should read:


:0:
* ^X-Spam-Status: Yes
spam


The extra colon after :0 tells procmail to lock the mailbox. If you don't use it, you could corrupt that mailbox if two processes try to write to it at the same time.


--
"I have not failed. I've just found 10,000 ways that won't work."
- Thomas Alva Edison (1847-1931)
Re: Newbie problem [ In reply to ]
Still the same oroblem, Mails are scanned recursiv and then
the virus-scanner catches them:

* * * * * * * * * * * * * * * AntiVir ALERT * * * * * * * * * * * * * * *
This version of AntiVir is licensed for private and non-commercial use.

AntiVir konnte eine verdaechtige Email, die über Ihren Server geschickt
worden ist, nicht auf Viren ueberpruefen:

An archive attached to this E-Mail has reached the maximimum recursion depth of 5

Diese Email wurde nicht ausgeliefert und auf dem Server unter folgender
ID isoliert:

01847-50DE16FF

:-(
Józsi


Am 19 Feb 2004 um 11:26 hat Steve Thomas geschrieben:

> On Thu, Feb 19, 2004 at 08:16:11PM +0100, jozsef.juni@web.de is rumored to have said:
> >
> > THis is the whole procmail.rc
> >
> >
> > :0fw
> > | /usr/bin/spamc
> > :0
> > * ^X-Spam-Status: Yes
> > ! spam
>
> You're forwarding the message to a user called "spam". Take out the exclamation point, so your recipe should read:
>
>
> :0:
> * ^X-Spam-Status: Yes
> spam
>
>
> The extra colon after :0 tells procmail to lock the mailbox. If you don't use it, you could corrupt that mailbox if two processes try to write to it at the same time.
>
>
> --
> "I have not failed. I've just found 10,000 ways that won't work."
> - Thomas Alva Edison (1847-1931)
Re: Newbie problem [ In reply to ]
Try adding the colon?

----- Original Message -----
From: <jozsef.juni@web.de>
To: <spamassassin-users@incubator.apache.org>
Sent: Thursday, 2004 February, 19 21:59
Subject: Re: Newbie problem


> Still the same oroblem, Mails are scanned recursiv and then
> the virus-scanner catches them:
>
> * * * * * * * * * * * * * * * AntiVir ALERT * * * * * * * * * * * * * * *
> This version of AntiVir is licensed for private and non-commercial use.
>
> AntiVir konnte eine verdaechtige Email, die über Ihren Server geschickt
> worden ist, nicht auf Viren ueberpruefen:
>
> An archive attached to this E-Mail has reached the maximimum recursion
depth of 5
>
> Diese Email wurde nicht ausgeliefert und auf dem Server unter folgender
> ID isoliert:
>
> 01847-50DE16FF
>
> :-(
> Józsi
>
>
> Am 19 Feb 2004 um 11:26 hat Steve Thomas geschrieben:
>
> > On Thu, Feb 19, 2004 at 08:16:11PM +0100, jozsef.juni@web.de is rumored
to have said:
> > >
> > > THis is the whole procmail.rc
> > >
> > >
> > > :0fw
> > > | /usr/bin/spamc
> > > :0
> > > * ^X-Spam-Status: Yes
> > > ! spam
> >
> > You're forwarding the message to a user called "spam". Take out the
exclamation point, so your recipe should read:
> >
> >
> > :0:
> > * ^X-Spam-Status: Yes
> > spam
> >
> >
> > The extra colon after :0 tells procmail to lock the mailbox. If you
don't use it, you could corrupt that mailbox if two processes try to write
to it at the same time.
> >
> >
> > --
> > "I have not failed. I've just found 10,000 ways that won't work."
> > - Thomas Alva Edison (1847-1931)
>
>
Re: Newbie problem [ In reply to ]
Darn - premature send I think.
Anyway - maybe try the colon both places:

> > * ^X-Spam-Status: Yes
> > ! spam
becomes
:0fw:
| /usr/bin/spamc
:0:
* ^X-Spam-Status: Yes
! spam

{^_^}
----- Original Message -----
From: <jozsef.juni@web.de>

> Still the same oroblem, Mails are scanned recursiv and then
> the virus-scanner catches them:
>
> * * * * * * * * * * * * * * * AntiVir ALERT * * * * * * * * * * * * * * *
> This version of AntiVir is licensed for private and non-commercial use.
>
> AntiVir konnte eine verdaechtige Email, die über Ihren Server geschickt
> worden ist, nicht auf Viren ueberpruefen:
>
> An archive attached to this E-Mail has reached the maximimum recursion
depth of 5
>
> Diese Email wurde nicht ausgeliefert und auf dem Server unter folgender
> ID isoliert:
>
> 01847-50DE16FF
>
> :-(
> Józsi
>
>
> Am 19 Feb 2004 um 11:26 hat Steve Thomas geschrieben:
>
> > On Thu, Feb 19, 2004 at 08:16:11PM +0100, jozsef.juni@web.de is rumored
to have said:
> > >
> > > THis is the whole procmail.rc
> > >
> > >
> > > :0fw
> > > | /usr/bin/spamc
> > > :0
> > > * ^X-Spam-Status: Yes
> > > ! spam
> >
> > You're forwarding the message to a user called "spam". Take out the
exclamation point, so your recipe should read:
> >
> >
> > :0:
> > * ^X-Spam-Status: Yes
> > spam
> >
> >
> > The extra colon after :0 tells procmail to lock the mailbox. If you
don't use it, you could corrupt that mailbox if two processes try to write
to it at the same time.
> >
> >
> > --
> > "I have not failed. I've just found 10,000 ways that won't work."
> > - Thomas Alva Edison (1847-1931)
>
>