I find awl not very good when used in multiuser configs.. May be better in a user soecific env but never works very well for me using a standard ms setup<span></span><br><br>On Thursday, 20 June 2013, Duncan, Brian M. wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I already do that in a sense.. I don’t have it call out, but I export all my SMTP aliases from AD and add them to the access file on my sendmail servers and
reject all other mail to my domain, so the rest is discarded to non existent users, and it saves with dealing with all the NDR’s<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Well it looks like I bought myself some time. Even though I have NOT figured out what is going on here, since I disabled auto white listing the other day,
it looks like the majority of these Spam messages that were making it through before because they were NOT hitting on these different URIBLS are getting tagged from Bayes hits now. And since the AWL is not factoring into it, 98% of them are getting labeled
as Spam.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I am probably just going to rebuild my primary mail server and re-install Mailscanner and Spamassassin in a few weeks and see if this problem goes away.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I still think there is something unique with these particular Spam emails. These messages I am talking about, I have NEVER seen URIBL_BLACK ever fire on.
(But does fire on it when I manually scan with spamassassin–test-mode)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Yesterday I had plenty of other emails where it does fire on that rule:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">[root@venus log]# cat maillog.1 | grep -i "URIBL_BLACK" | wc -l<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">2971<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#1f497d">BRIAN M. DUNCAN<br>
Data Security Administrator<br>
Katten Muchin Rosenman LLP<br>
525 W. Monroe Street / Chicago, IL 60661-3693<br>
p / (312) 577-8045 f / (312) 577-4490<br>
<a href="javascript:_e({}, 'cvml', 'brian.duncan@kattenlaw.com');" target="_blank">brian.duncan@kattenlaw.com</a> / <a href="http://www.kattenlaw.com" target="_blank">www.kattenlaw.com</a><br>
</span><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="javascript:_e({}, 'cvml', 'mailscanner-bounces@lists.mailscanner.info');" target="_blank">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="javascript:_e({}, 'cvml', 'mailscanner-bounces@lists.mailscanner.info');" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>]
<b>On Behalf Of </b>Martin Hepworth<br>
<b>Sent:</b> Wednesday, June 19, 2013 5:30 AM<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: Certain Spamassassin rules do not seem to be firing all of the time<u></u><u></u></span></p>
</div>
<p><u></u> <u></u></p>
<div>
<p style="margin-bottom:12.0pt">maybe you can use sendmail to call-out for valid recipients first, I find this drops HUGE amounts of traffic dead before it gets anywhere near MailScanner, easily 50% and maybe higher<br>
<br>
<a href="http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:sendmail:how_to:reject_non_existent_users" target="_blank">http://wiki.mailscanner.info/doku.php?id=documentation:configuration:mta:sendmail:how_to:reject_non_existent_users</a><u></u><u></u></p>
</div>
<div>
<p><br clear="all">
<u></u><u></u></p>
<div>
<p>-- <br>
Martin Hepworth, CISSP<br>
Oxford, UK<u></u><u></u></p>
</div>
<p style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p>On 18 June 2013 19:40, Duncan, Brian M. <<a>brian.duncan@kattenlaw.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Yeah I know it’s very weird and I can’t track it down. </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Yesterday, I tried removing the NET:DNS perl module (.65 is what MailScanner (and I believe SpamAssassin
use by default) and compiling 0.72 in the hopes that it had something to do with that. Nope, still happening today. Fortunately it only seems to be letting a few Spam in overall. It just happens when there is a black listed domain that is used in a URL
that is sent by a non-blacklisted gateway where I get caught by this issue.</span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I am using Sendmail. Yes there is a .spamassassin directory in root, where the bayes db’s are located
and autowhitelist db’s (I have autowhite list disabled for the moment) The user_prefs file has no directives set in it, they are all #’ed out.</span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I don’t specify a run as user in my MailScanner.conf, and according to ps all the MailScanner processes
are running as root, and my spamassassin –test-mode I have run as root.</span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I turned on skip_rbl_checks 1 yesterday, since I detect RBL’ed hosts using MailScanner I figured
it was kind of pointless to do it again with SpamAssassin.. </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I also tried tweaking rbl_timeout to 60 seconds instead of 30, what is was before. Because I did
find someone else reporting a similar issue to mine.. back in 2007 someone was reporting this same behavior that rules were not hitting when using Amavis with Spamassassin, but then when you ran them through Spamassassin they worked, and I believe it was the
same types of rules I am not hitting on through MailScanner. And the issue wound up being Net:DNS.</span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><a href="http://www.gossamer-threads.com/lists/spamassassin/users/102307?do=post_view_threaded#102307" target="_blank">http://www.gossamer-threads.com/lists/spamassassin/users/102307?do=post_view_threaded#102307</a></span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">If I can’t figure this out, I might attempt a fresh install of Cent OS 6.4 and fresh install of Ma</span></p></div></div>
</div></div></div>
</div>
</blockquote><br><br>-- <br>-- <br>Martin Hepworth, CISSP<br>Oxford, UK<br>