Spam not being flagged revisited

[Julian Field]

At 16:42 22/05/2002, you wrote:
>I received four more messages, where the Spamscore was greater than the
>threshold but the message was not marked as spam.  I am including one
>header, as the rest are similar  Everthing in spam.whitelist is
>commented out and only my local IP address is specified in
>mailscanner.conf.   I don't see how this is a whitelist problem.  Any
>ideas?

I have just wiped my spam.whitelist.conf and commented out all "Accept Spam
From" lines in mailscanner.conf.
I then set
         Use SpamAssassin = yes
         Always Include SpamAssassin Report = yes
and restarted MailScanner.

Using the 2 SpamAssassin test messages sample-spam.txt and
sample-nonspam.txt that they supply for the purpose, I get these results:
sample-spam.txt
>X-MailScanner-SpamCheck: SpamAssassin (score=17, required 5,
>FROM_HAS_MIXED_NUMS, INVALID_MSGID, INVALID_DATE, MSGID_HAS_NO_AT,
>SMTPD_IN_RCVD, UNDISC_RECIPS, NO_REAL_NAME, HOME_EMPLOYMENT,
>ONCE_IN_LIFETIME, CALL_FREE, REMOVE_SUBJ, LINES_OF_YELLING,
>LINES_OF_YELLING_2, LINES_OF_YELLING_3, RCVD_IN_OSIRUSOFT_COM)

sample-nonspam.txt
>X-MailScanner-SpamCheck: not spam, SpamAssassin (score=-2.8, required 5,
>GAPPY_TEXT, LINES_OF_YELLING, PGP_SIGNATURE)

I then set
         Use SpamAssassin = yes
         Always Include SpamAssassin Report = no
and restarted MailScanner.

Using the same pair of messages again, I get
sample-spam.txt
>X-MailScanner-SpamCheck: SpamAssassin (score=17, required 5,
>FROM_HAS_MIXED_NUMS, INVALID_MSGID, INVALID_DATE, MSGID_HAS_NO_AT,
>SMTPD_IN_RCVD, UNDISC_RECIPS, NO_REAL_NAME, HOME_EMPLOYMENT,
>ONCE_IN_LIFETIME, CALL_FREE, REMOVE_SUBJ, LINES_OF_YELLING,
>LINES_OF_YELLING_2, LINES_OF_YELLING_3, RCVD_IN_OSIRUSOFT_COM)

sample-nonspam.txt
>(no SpamCheck header at all)

So either
         a) something weird is happening that is affecting your system and
not mine
or      b) we are running different code.

(b) is the most likely. I've got 1 more little feature to test out (RBL
checks timeout setting), then I'll release the code again. Any of you
having problems can then upgrade to that version and we'll see if your
problems go away.

>Return-Path: <susanepapelej at jippii.fi>
>Received: from mail1.alluneedhosting.com ([208.46.132.87])
>         by vulcan.bepinc.com (8.11.6/8.11.6) with SMTP id g4M9DW103272
>         for <darian at bepinc.com>; Wed, 22 May 2002 04:13:32 -0500
>To: darian at bepinc.com
>Date: Wed, 22 May 2002 05:11:15 -0500
>Message-ID: <1022058675.2071 at localhost.localdomain>
>X-Mailer: Becky! ver. 2.00.03
>From: susanepapelej at jippii.fi
>Sender: <susanjqhnomac at jippii.fi>
>X-Sender: <susanqbiyhrhn at jippii.fi>
>Reply-To: <susanhhfnsjye at jippii.fi>
>Subject: INC 500 Co. Seeks Mgrs. / High $$ Paid!
>X-VirusScan: Found to be clean
>X-MailScanner-SpamCheck: not spam, SpamAssassin (score=9.8, required 5,
>         INVALID_DATE_ODD_MONTH, PLING, CLICK_BELOW, NORMAL_HTTP_TO_IP,
>         WEB_BUGS, CLICK_HERE_LINK, CTYPE_JUST_HTML)
>Status:
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
>Behalf Of Mike Wallis
>Sent: Tuesday, May 21, 2002 10:24 AM
>To: MAILSCANNER at JISCMAIL.AC.UK
>Subject: Spam not being flagged
>
>
>I just upgraded to 3.15-3 and noticed something odd while testing.
>
>---begin---
>X-MailScanner: Found to be clean
>X-MailScanner-SpamCheck: not spam, SpamAssassin (score=7, required 5,
>         SUBJ_HAS_Q_MARK, EXCUSE_3, EXCUSE_7, OPT_IN, CLICK_BELOW,
>         SUBJ_REMOVE)
>---end---
>
>In this particular instance, I forwarded myself some spam (the original
>generated a much higher score) and thought it rather odd that a score in
>excess of the required score would get a 'not spam' designation.
>
>Any ideas?
>
>--
>Mike Wallis
>mw at unixsecurity.org

--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ