Topic: spam filter is being bypassed

[Shawn]

Hi.

I am having some difficulty understanding how mailfront, amavis, and qmail interact.

I have sucessfully
- configured local mail for ISP mail addresses, thanks to Brandon Friedman's How-to
- configured fetchmail, using Vincent's program, to collect from pop accounts
- configured assp for spam filtering

Everything was working well.

Then, I installed Amavis and Clamd, thanks to Damien Curtain, using his Amavis perl module. This worked too. Mail was being scanned by Clam.

However, now assp seems to get bypassed. Mailfront answers on port 25, just as it was before I installed Amavis, and if I shut down assp, mailfront doesn't answer (as expected).

To get assp working again, I disabled Amavis using the following commands:
/sbin/e-smith/db configuration delprop smtpfront-qmail filter
/sbin/e-smith/signal-event email-update

But, even though Amavis doesn't scan the mail anymore, neither does assp.

Is there a way to run assp and Amavis together?

What can I do to get messages scanned by assp again? I am not sure how it is being bypassed.

I am using SME v.5.6 U2, server-only.

Thanks.

Shawn

[Shawn]

Hi.

I found that the problem was with the fetchmail script. Although the fetchmail man page seems to say that fetchmail will send mail to port 25, mail was actually going to the new smtp port I had set in /etc/services. (Now assp is listening on port 25, and smtp is on port 125.)

To point fetchmail to the correct port, I modified the following file from Vincent's script:
/etc/e-smith/templates-custom/etc/fetchmail/90fetchmail  

I changed the following line:
$mdbg="-d0 --silent --syslog ";

to this:
$mdbg="-d0 --silent --syslog --smtphost 127.0.0.1/25 ";

Then expanded the template:
/sbin/e-smith/expand-template /etc/fetchmail

Now fetchmail collects the mail, sends it to assp on port 25, then it gets scanned by clamav. Whew!


FYI, the assp script needs some tweaking to work with fetchmail.

First, you need to modify the config.pl script to remove 127.0.0.1 from the $acceptAllMail= line. If you don't, fetchmail messages won't get scanned for spam, and all addresses will be added to your whitelist, even those from spammers. (This script, currently version 0.1.5, equates whitelist addresses with acceptable relays.)

  (from my config.pl)
  # denies relaying for hosts besides these
  # these hosts also contribute to the whitelist
  $acceptAllMail="192.168.0.";

Next you need to modify the assp.pl script to allow relaying from 127.0.0.1 . If you don't, then some things don't work right. See the new part below:
   if($acceptAllMail && $ip=~/^($acceptAllMail)/io) {
    $Con{$client}->{relayok}=1;
    mlog($client,"relaing ok");
    print DEBUG "$client relaying ok: $ip\n" if $DEBUG;
   }
   #New part starts here
   if ($ip eq '127.0.0.1') {
    $Con{$client}->{relayok}=1;
    mlog(0,"127.0.0.1 relaying ok");
    print DEBUG "$client relaying ok: $ip\n" if $DEBUG;
   }
   #New part ends here



I also found a couple of good clamav how-to's if anyone is having trouble installing it.
http://www.star-support.com/downloads/mitel/contrib/clamav/
http://www.tech-geeks.org/contrib/loveless/clamav/clam_install_notes.txt


Shawn

[Shawn]

Hi.

My previous post did not totally fix the assp problem. Here is a new method that seems to work. I posted this message to the assp forum on sourceforge.net, but am posting here for convenience.

Here is what I ended up doing:

I added a second IP address to the NIC, on a different subnet. I am only going to use this address on the local machine, so I don't think my router needs to know about it.

ifconfig eth0:0 192.168.1.2
killall -HUP named

I put back the 127.0.0.1 address that I had removed from the config.pl script.

# denies relaying for hosts besides these
# these hosts also contribute to the whitelist
$acceptAllMail="192.168.0.|127.0.0.1";

I deleted the changes I had made to assp.pl shown in the previous post. Now assp.pl is "stock" I believe.

I renamed my old whitelist file because it contained spam addresses.

Next, I pointed fetchmail to the correct port, by adding the option --smtphost 192.168.1.2/25 to the fetchmail command.  Note, this is the IP address on the new subnet.

I am not sure why it works, unless I am misunderstanding the fetchmail man page, but maillog.txt shows that it is receiving mail *from* the new ip.

Apr-4-03 21:42:56 Starting
Apr-4-03 21:45:14 relaying check
Apr-4-03 21:45:14 Connected: 192.168.1.2:3740
Apr-4-03 21:45:15 192.168.1.2 message ok

This message was scanned, not whitelisted, and it even gets a header field of X-Assp-Spam-Prob: 0.50000

It looks good to me so far.

Hope this helps.

Shawn