Topic: Using SpamAssassin...

[sonoracomm]

Hi Patrick,

I have implemented this script as you suggested.  It looks like just the ticket.

I created an IMAP folder called LearnAsSpam and I dropped a few spams in it.

I then went to the SME command line...as root...and ran this command to test:

Code: [Select]

perl /usr/bin/LearnAsSpam.pl

It seems to learn the spams, though I'm not really sure.  

Code: [Select]

Learning Spammail: /home/e-smith/files/users/gcooper/Maildir/.LearnAsSpam/cur/1150381198.P23845Q20M668252.mail\:2,S
Result of sa-learn:
Result of delete:

I looked for some evidence by running:

Code: [Select]

sa-learn -D --dump magic

But it terminated with this:

Code: [Select]

debug: bayes: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks
ERROR: Bayes dump returned an error, please re-run with -D for more information

Do you have any idea how I could verify the learning is working or how I should tweak the script to delete the processed messages?

Thanks much,

G

[idyll]

Yes, you need to be loged in as the specific user you wish to check. I get the same error string if I run the command as root. I login as myself, the user and issue the command.

Example...

-bash-3.00$ sa-learn -D --dump magic

<blah>
<blah>

(near the bottom is the one you seek, nspam)

0.000          0          3          0  non-token data: bayes db version
0.000          0         345          0  non-token data: nspam
0.000          0          0          0  non-token data: nham
0.000          0       1875          0  non-token data: ntokens
0.000          0 1142713049          0  non-token data: oldest atime
0.000          0 1143119655          0  non-token data: newest atime
0.000          0          0          0  non-token data: last journal sync atime
0.000          0          0          0  non-token data: last expiry atime
0.000          0          0          0  non-token data: last expire atime delta
0.000          0          0          0  non-token data: last expire reduction count
debug: bayes: 6761 untie-ing
debug: bayes: 6761 untie-ing db_toks
debug: bayes: 6761 untie-ing db_seen
-bash-3.00$

I am not reading or posting here much anymore as I have had my fill of delusional disorders of the subtype grandiose. But your note and your postings are always positive and solid contributions.

I hope this helps.

regards,

patrick

[sonoracomm]

Thanks again, Patrick!

My problem was twofold.  I had not followed instructions exactly pertaining to the enabling of the bash shell...and running the script as the user.

Now if I run 'perl /usr/bin/LearnAsSpam.pl' as root, the messages are deleted.  And if I run 'sa-learn -D --dump magic' as the regular user, it spits out the proper results.

I had forgotten that I had set the shell to rssh in an attempt to make things more secure.  Didn't work.

Thanks much,

G

p.s.  I updated the howto I wrote to add optional Bayesian filtering.  Though it's more trouble, it seems worth it to me.

http://www.sonoracomm.com/index.php?option=com_content&task=view&id=49&Itemid=32

[idyll]

Solid addition to the end user documentation.

I am sure there will be hundreds of people who appreciate your efforts over time.

regards,

patrick

[sonoracomm]

Me again...

Sorry for dragging this out (or beating a dead horse...).

It seems the LearnAsSpam script is working fine and provides an important function.

I'm now wondering how dificult it might be to expand it to offer a whitelisting function?  Though fairly rare, I am finding that I need to be able to whitelist sender addresses/domains to eliminate problems with valid mail misclassified as spam.  I looked at the LearnAsSpam script, but I don't understand it.

It would be nice if we could have a separate IMAP folder where we could copy messages that would add to the whitelist.

I saw in another thread a db command for adding to the (global?) whitelist.  Maybe this could be integrated into the LearnAsSpam script?

http://forums.contribs.org/index.php?topic=32248.0

I suspect other folks more proficient with SA have already looked at this issue.  What have you all done for a whitelist?

Thanks,

G

[azche24]

Hi,

i installed and modified according to your wonderful howto and now i get

Code: [Select]

Learning Spammail: /home/e-smith/files/users/alex/Maildir/.LearnAsSpam/cur/1152264515.P19159Q9M989657.castor\:2,a
bayes: expire_old_tokens: locker: safe_lock: cannot create lockfile /var/spool/spamd/.spamassassin/bayes.mutex: Keine Berechtigung

bayes: locker: safe_lock: cannot create lockfile /var/spool/spamd/.spamassassin/bayes.mutex: Keine Berechtigung
Result of sa-learn: Learned tokens from 0 message(s) (1 message(s) examined)

if i run "LearnAsSpam.pl" from the shell as root. The same error came with the original cronjob, so i modified "root" to "spamd". It seems this did not help.

Spam is deleted, but when running

Code: [Select]

sa-learn -D --dump magic
i get the same "db not present error" as stated here.

[azche24]

Hi, again,

i surveyed some further and the LearnAsSpam.pl Script mentioned here will not work.

For what reason?

When the script does su - <mailboxuser> at the end it is not able to write to the databases in /var/spool/spamd/.spamassassin/... as it should.

There must be a PATH statement wrong in this script. Charlie Brady stated earlier, that the .spamassassin/ directory is only writable by unprivileged user spamd; i can prove that. So only root checking admin-mailbox is able to learn spam in this kind of configuration. Which makes a lot of sense to me for security reasons.

I was able to login as root and do

Code: [Select]

sa-learn --spam *

in the admin's spamdirectory.

I can not imagine how to get this script working without breaking security. Any ideas?

[judgej]

...Is this what you are after?

I don't think so. He is looking for a way to allow an end user to report a piece of spam to the server, so the server can start learning from its mistakes. The questino is not about how spamassasion processes spam once it has caught it.

-- JJ

[brianr]

Hi,

i installed and modified according to your wonderful howto and now i get

Code: [Select]

Learning Spammail: /home/e-smith/files/users/alex/Maildir/.LearnAsSpam/cur/1152264515.P19159Q9M989657.castor\:2,a
bayes: expire_old_tokens: locker: safe_lock: cannot create lockfile /var/spool/spamd/.spamassassin/bayes.mutex: Keine Berechtigung

bayes: locker: safe_lock: cannot create lockfile /var/spool/spamd/.spamassassin/bayes.mutex: Keine Berechtigung
Result of sa-learn: Learned tokens from 0 message(s) (1 message(s) examined)

if i run "LearnAsSpam.pl" from the shell as root. The same error came with the original cronjob, so i modified "root" to "spamd". It seems this did not help.

Spam is deleted, but when running

Code: [Select]

sa-learn -D --dump magic
i get the same "db not present error" as stated here.

I just got this for a few days, I deleted the offending bayes.mutex, and the script seems to run fine again now..

[sonoracomm]

Hi all,

I've now had the problem described above happen several times.  I keep deleting the bayes.mutex file, but the problem returns again in short order.

Is anyone else having this problem?

Does anyone know why it happens?

A Google search just seems to bring up Brian's posts.

Thanks in advance,

G

[brianr]

Look here:

http://forums.contribs.org/index.php?topic=32158.msg140483#msg140483

[robwellesley]

burnat

>...Should you also run:  svc -t /service/qpsmtpd ?

Yes
]

Ray,

if you look at the email-update event (#ll in the directory) you'll see that qpsmtp is sent a sighup as part of the event.  This is the smeas an svc -t, yes?

Rob

[raem]

robwellesley

> the email-update event ....
> ....qpsmtp is sent a sighup...same as an svc -t ?

It appears to achieve the same end result


abbreviated messages log file:

Sep 22 01:45:19 server3 esmith::event[4797]: Processing event: email-update  
Sep 22 01:45:19 server3 esmith::event[4797]: Running event handler: /etc/e-smith/events/actions/generic_template_expand

Sep 22 01:45:31 server3 esmith::event[4797]: expanding /var/service/sqpsmtpd/runenv  
Sep 22 01:45:31 server3 esmith::event[4797]: expanding /var/service/qpsmtpd/runenv  

Sep 22 01:46:27 server3 esmith::event[4797]: adjusting supervised qmail (sighup)  
Sep 22 01:46:27 server3 esmith::event[4797]: adjusting supervised qmail (up)  
Sep 22 01:46:27 server3 esmith::event[4797]: adjusting supervised sqpsmtpd (sighup)  
Sep 22 01:46:27 server3 esmith::event[4797]: adjusting supervised sqpsmtpd (up)  
Sep 22 01:46:28 server3 esmith::event[4797]: adjusting supervised qpsmtpd (sighup)  
Sep 22 01:46:28 server3 esmith::event[4797]: adjusting supervised qpsmtpd (up)  




svc applies all the options to each service in turn. Here are the options:

-u: Up. If the service is not running, start it. If the service stops, restart it.
-d: Down. If the service is running, send it a TERM signal and then a CONT signal. After it stops, do not restart it.
-o: Once. If the service is not running, start it. Do not restart it if it stops.
-p: Pause. Send the service a STOP signal.
-c: Continue. Send the service a CONT signal.
-h: Hangup. Send the service a HUP signal.
-a: Alarm. Send the service an ALRM signal.
-i: Interrupt. Send the service an INT signal.
-t: Terminate. Send the service a TERM signal.
-k: Kill. Send the service a KILL signal.
-x: Exit. supervise will exit as soon as the service is down. If you use this option on a stable system, you're doing something wrong; supervise is designed to run forever.

[timn]

I have followed the how to and installed the cron jobs and perl scripts etc as described. However the first time the cron job for sa-update ran last night I got a Cron Daemon email to root which stated that

/etc/cron.daily/sa-update:

sa-update: importing default keyring to '/etc/mail/spamassassin/sa-update-keys'...
/etc/cron.daily/sa-update: line 1: svc: command not found

I also got an email from sa-update which indicated the updates went through OK and ends with

[28907] dbg: channel: applying changes to /var/lib/spamassassin/3.001003/updates_spamassassin_org...
[28907] dbg: channel: update complete
[28907] dbg: diag: updates complete, exiting with code 0

So why wasn't svc found? should this be email-update in the script.

I can run he svc command as per the script from a root shell prompt.

[brianr]

I haven't had a spamassassin update detected recently, infact since the recent set of SME7 updates, but I have had problems with cron and permisssions (in /etc/cron.d), so I think perhaps Cron has been updated and the rules have changed.  E.G. /etc/cron.daily scripts are no longer run under root?  This is purely speculative - perhaps someone who knows about the recent centos/sme updates can confirm or deny this.