Mailing List Archive

Hi,

On Sat, 7 Feb 2004 12:01:19 +0200 "Óscar Girão" <oscar@igofast.com> wrote:

> I've just installed qmail+qmail-scanner+spamassassin+pyzor+etc
> and it doesn't seem to filter the spam emails!!!

1. Verify that SpamAssassin is working, independent of qmail-scanner.
See the SpamAssassin docs on how to do that.

2. Once you've verified that SpamAssassin is working, you may get better
answers on the qmail-scanner list. It's likely the problem is with
qmail-scanner, not SpamAssassin and there are more qmail-scanner experts
on that list than on this list.

It's not that we don't want to help; this just isn't the best place to
get support for qmail-scanner.

> Can someone help me sending a spam email to me oscar@igofast.com
> and help me figure out why it doesn't work.

Most people here don't send spam, at least not intentionally - and if
you don't have a steady stream of spam coming in, why do you need
SpamAssassin? :)

-- Bob

Hi,

The problem is that I receive lots of spam!!! I don't understand why.
Please check this email header:
Return-Path: <c.bingham_ce@atkingroup.co.uk>
Delivered-To: brithol.com-brithol@brithol.com
Received: (qmail 28409 invoked by uid 500); 7 Feb 2004 08:32:36 -0000
Received: from c.bingham_ce@atkingroup.co.uk by brithol by uid 92 with
qmail-scanner-1.20
(spamassassin: 2.63. Clear:RC:1(127.0.0.1):.
Processed in 0.024219 secs); 07 Feb 2004 08:32:36 -0000
X-Qmail-Scanner-Mail-From: c.bingham_ce@atkingroup.co.uk via brithol
X-Qmail-Scanner: 1.20 (Clear:RC:1(127.0.0.1):. Processed in 0.024219 secs)
Received: from localhost (HELO brithol) (127.0.0.1)
by localhost with SMTP; 7 Feb 2004 08:32:36 -0000
Received: from bcs.cl (d57-244-213.home.cgocable.net [24.57.244.213])
by localhost (VaMailArmor-2.0.1.16) id 28398-488F727D;
Sat, 07 Feb 2004 10:32:35 +0200
Message-ID: <PKMEFECMKOILGKODBNPFODHBLFAA.c.bingham_ce@atkingroup.co.uk>
From: "Cecelia Bingham" <c.bingham_ce@atkingroup.co.uk>
To: brithol@brithol.com
Subject: Buy Codeine Tylenol3, Codeine Tylenol3, Viaga cheap
Date: Sat, 07 Feb 2004 21:44:34 +0000
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: base64
X-AntiVirus: checked by Vexira MailArmor (version: 2.0.1.16; VAE: 6.23.0.3;
VDF: 6.23.0.60; host: brithol

And this is the email:

Subject: Buy Codeine Tylenol3, Codeine Tylenol3, Viaga cheap
Buy Codeine&reg; (Tylenol3) Online!

Buying it online is easy and lgal

Codeine&reg; (Tylenol3) is a Pain reliever

Why suffer the embarrassment of asking your local doctor
for it?



Click
Here to Order Now


No moreIt seems that the message just passed all the filters.Shouldn't it be
filtered?ThanksOscar
----- Original Message -----
From: "Bob Apthorpe" <apthorpe+sa@cynistar.net>
To: <spamassassin-users@incubator.apache.org>
Sent: Saturday, February 07, 2004 2:51 PM
Subject: Re: HELP! My spam filters don't work


Hi,

On Sat, 7 Feb 2004 12:01:19 +0200 "Óscar Girão" <oscar@igofast.com> wrote:

> I've just installed qmail+qmail-scanner+spamassassin+pyzor+etc
> and it doesn't seem to filter the spam emails!!!

1. Verify that SpamAssassin is working, independent of qmail-scanner.
See the SpamAssassin docs on how to do that.

2. Once you've verified that SpamAssassin is working, you may get better
answers on the qmail-scanner list. It's likely the problem is with
qmail-scanner, not SpamAssassin and there are more qmail-scanner experts
on that list than on this list.

It's not that we don't want to help; this just isn't the best place to
get support for qmail-scanner.

> Can someone help me sending a spam email to me oscar@igofast.com
> and help me figure out why it doesn't work.

Most people here don't send spam, at least not intentionally - and if
you don't have a steady stream of spam coming in, why do you need
SpamAssassin? :)

-- Bob

On Sat, 7 Feb 2004, Óscar Girão wrote:

> The problem is that I receive lots of spam!!! I don't understand why.

We all do. That's why we use SpamAssassin.

> Please check this email header:
>
> Return-Path: <c.bingham_ce@atkingroup.co.uk>
> Delivered-To: brithol.com-brithol@brithol.com
> Received: (qmail 28409 invoked by uid 500); 7 Feb 2004 08:32:36 -0000
> Received: from c.bingham_ce@atkingroup.co.uk by brithol by uid 92 with
> qmail-scanner-1.20
> (spamassassin: 2.63. Clear:RC:1(127.0.0.1):.
> Processed in 0.024219 secs); 07 Feb 2004 08:32:36 -0000

Unless you've got a *beast* of a scanning box, 0.024 seconds
seems a bit on the quick side for a SpamAssassin check (the DNS
checks alone would require that much). It looks like SA isn't
getting called.

> X-Qmail-Scanner-Mail-From: c.bingham_ce@atkingroup.co.uk via brithol
> X-Qmail-Scanner: 1.20 (Clear:RC:1(127.0.0.1):. Processed in 0.024219 secs)
> Received: from localhost (HELO brithol) (127.0.0.1)
> by localhost with SMTP; 7 Feb 2004 08:32:36 -0000
> Received: from bcs.cl (d57-244-213.home.cgocable.net [24.57.244.213])
> by localhost (VaMailArmor-2.0.1.16) id 28398-488F727D;
> Sat, 07 Feb 2004 10:32:35 +0200

That's a zombie-relay. Some poor bloke on a cable-modem had his
machine compromised by a worm that allows spammers to relay through
his system.

> Message-ID: <PKMEFECMKOILGKODBNPFODHBLFAA.c.bingham_ce@atkingroup.co.uk>
> From: "Cecelia Bingham" <c.bingham_ce@atkingroup.co.uk>
> To: brithol@brithol.com
> Subject: Buy Codeine Tylenol3, Codeine Tylenol3, Viaga cheap
> Date: Sat, 07 Feb 2004 21:44:34 +0000
> MIME-Version: 1.0
> Content-Type: text/html
> Content-Transfer-Encoding: base64
> X-AntiVirus: checked by Vexira MailArmor (version: 2.0.1.16; VAE: 6.23.0.3;
> VDF: 6.23.0.60; host: brithol

I notice that SpamAssassin didn't inject any of its headers into
the mix. Double-check to make sure that SA is, in fact, getting
called.

+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+

Hi!

How can I check if qmail-scanner is calling SA and if not how
to force it?

tks
Oscar

----- Original Message -----
From: "Carl R. Friend" <crfriend@rcn.com>
To: "Óscar Girão" <oscar@igofast.com>
Cc: <spamassassin-users@incubator.apache.org>
Sent: Saturday, February 07, 2004 5:48 PM
Subject: Re: HELP! My spam filters don't work


On Sat, 7 Feb 2004, Óscar Girão wrote:

> The problem is that I receive lots of spam!!! I don't understand why.

We all do. That's why we use SpamAssassin.

> Please check this email header:
>
> Return-Path: <c.bingham_ce@atkingroup.co.uk>
> Delivered-To: brithol.com-brithol@brithol.com
> Received: (qmail 28409 invoked by uid 500); 7 Feb 2004 08:32:36 -0000
> Received: from c.bingham_ce@atkingroup.co.uk by brithol by uid 92 with
> qmail-scanner-1.20
> (spamassassin: 2.63. Clear:RC:1(127.0.0.1):.
> Processed in 0.024219 secs); 07 Feb 2004 08:32:36 -0000

Unless you've got a *beast* of a scanning box, 0.024 seconds
seems a bit on the quick side for a SpamAssassin check (the DNS
checks alone would require that much). It looks like SA isn't
getting called.

> X-Qmail-Scanner-Mail-From: c.bingham_ce@atkingroup.co.uk via brithol
> X-Qmail-Scanner: 1.20 (Clear:RC:1(127.0.0.1):. Processed in 0.024219 secs)
> Received: from localhost (HELO brithol) (127.0.0.1)
> by localhost with SMTP; 7 Feb 2004 08:32:36 -0000
> Received: from bcs.cl (d57-244-213.home.cgocable.net [24.57.244.213])
> by localhost (VaMailArmor-2.0.1.16) id 28398-488F727D;
> Sat, 07 Feb 2004 10:32:35 +0200

That's a zombie-relay. Some poor bloke on a cable-modem had his
machine compromised by a worm that allows spammers to relay through
his system.

> Message-ID: <PKMEFECMKOILGKODBNPFODHBLFAA.c.bingham_ce@atkingroup.co.uk>
> From: "Cecelia Bingham" <c.bingham_ce@atkingroup.co.uk>
> To: brithol@brithol.com
> Subject: Buy Codeine Tylenol3, Codeine Tylenol3, Viaga cheap
> Date: Sat, 07 Feb 2004 21:44:34 +0000
> MIME-Version: 1.0
> Content-Type: text/html
> Content-Transfer-Encoding: base64
> X-AntiVirus: checked by Vexira MailArmor (version: 2.0.1.16; VAE:
6.23.0.3;
> VDF: 6.23.0.60; host: brithol

I notice that SpamAssassin didn't inject any of its headers into
the mix. Double-check to make sure that SA is, in fact, getting
called.

+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+

On Sat, 2004-02-07 at 09:07, Óscar Girão wrote:
> Hi!
>
> How can I check if qmail-scanner is calling SA and if not how
> to force it?
>

Turn debugging on in qmail-scanner. Then you'll see a
/var/spool/qscanner/qmail-queue.log file that tells you what's going
on. My guess is that either you didn't include SpamAssassin in the list
of scanners to call, or you didn't set qmail-smtpd's memory limits high
enough. The qmail-scanner documentation covers both of these issues.

- Jon

--
jon@tgpsolutions.com

Administrator, tgpsolutions
http://www.tgpsolutions.com

On Sat, 7 Feb 2004, Óscar Girão wrote:

> How can I check if qmail-scanner is calling SA and if not how
> to force it?

This is really a question for the qmail-scanner folks rather
than the SpamAssassin people. SpamAssassin is a general-purpose
scanner; how it is called is heavily dependent on the environment
one is using it in.

The qmail-scanner list would be your best bet for help at this
point in time. Once the call from qmail-scanner is operational,
then would be the time to look to the SA folks for assistance.
Until the call actually generates SA headers we're kind of helpless.

+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+