Milter-greylist

Hi,

After I install and run milter-greylist in our fc3
linux email server, the number of spam emails reduced
significantly.  I greatly appreciate this wonderful
program.  I watched the performance for a while, and
now I have 2 questions.  To avoid consusion, I ask
them in different mail.  Here is the first one.

In my fc3 linux email server, I installed
milter-greylist (v1.6), spammassassin (3.0.2) and
clamav (0.83-1).  They are all working well.  

I set the spamassassin at each user's level that if
the score is higher than 15, the email will be
filtered into a folder "almost-spam", if the score is
between 5 to 15, it will be filtered into
"probably-spam", if the score is less than 5, it is
normal email.  Users can change these criterial
numbers if they want, and use their .procmailrc to
filter the emails (the system's /etc/procmailrc only
filter the virus).  Here I copy part of the normal
email's header:

Return-Path: <xxx@...>
Received: from web53501.mail.yahoo.com
(web53501.mail.yahoo.com [206.190.37.62])
......
X-Greylist: Delayed for 00:06:38 by
milter-greylist-1.6 (aaa.bbb.eee [a.b.c.d]); Sat, 02
Apr 2005 21:23:00 -0600 (CST)
X-Virus-Status: No
X-Virus-Checker-Version: clamassassin 1.2.2 with
clamscan / ClamAV 0.83/802/Sat Apr 2 08:49:46 2005
X-Spam-Checker-Version: SpamAssassin 3.0.2
(2004-11-16) on aaa.bbb.eee 
X-Spam-Level:
X-Spam-Status: No, score=0.4 required=5.0
tests=DNS_FROM_RFC_ABUSE
     autolearn=no version=3.0.2
...

Please notice the order: first X-Greylist..., second
X-Virus..., last X-Spam...

Now, users still receive some "almost-spam" and
"probably-spam" emails -- much less than before. I can
understand this.  However, the strange thing is the
header of those emails show no X-Greylist..., no
X-Virus..., but only the part X-Spam... e.g.:

.....
Message-Id:
<011001c538e8$b8c271f0$7d4f0d82@...>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.2
(2004-11-16) on aaa.bbb.eee 
X-Spam-Level: ***************
X-Spam-Status: Yes, score=15.7 required=5.0
tests=FORGED_RCVD_HELO,......
......

It seems that SpamAssassin "first checks" it, once
finds it as a spam, then milter-greylist doesn't do
anything.  It is not like what I expect:
milter-greylist checks it first, then virus check,
then spamassassin as shown in the normal email's
header. In this fc3 linux, only milter-greylist has
entries in sendmail.mc as indicated in the
instruction, clamav and spamassassin have no entries
in sendmail.mc.  Why does spammassassin act first if
it is a spam, but act last if it is not a spam
(according to the user's rule numbers for
spamassassin)?  How to let milter-greylist always do
something so that those mails may not appear in user's
account at all? -- I could stop spamassassin, but I
don't want to do that way.  I feel that it is better
to have milter-greylist and spamassassin both working,
as well as clamav.

Any idea and/or suggestion?

Thanks!

Harvey


		
__________________________________ 
Yahoo! Messenger 
Show us what our next emoticon should look like. Join the fun. 
http://www.advision.webevents.yahoo.com/emoticontest

On Mon, Apr 04, 2005 at 07:03:25AM -0700, H Li wrote:
> In this fc3 linux, only milter-greylist has
> entries in sendmail.mc as indicated in the
> instruction, clamav and spamassassin have no entries
> in sendmail.mc. 

You mean you start them through procmail?
If this what you do, then all mails are first seen by milter-greylist,
then by your procmail machinery.

I don't explain why the X-Greylist header does not appear.

Do the logs tell something interesting?

-- 
Emmanuel Dreyfus
manu@...

On Mon, 4 Apr 2005, Emmanuel Dreyfus wrote:

> You mean you start them through procmail?
> If this what you do, then all mails are first seen by milter-greylist,
> then by your procmail machinery.
>
> I don't explain why the X-Greylist header does not appear.
>
> Do the logs tell something interesting?

I've seen this also.  If an entry is already whitelisted, then 
milter-greylist does not add any headers.  Can anyone confirm?
It'd be nice if it at least added some header to say it's whitelisted...

ray
-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Ray DeJean  				       	 http://www.r-a-y.org
Systems Engineer                    Southeastern Louisiana University
IBM Certified Specialist  	      AIX Administration, AIX Support
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

At 07:17 AM 4/4/05, you wrote:

>On Mon, 4 Apr 2005, Emmanuel Dreyfus wrote:
>
>> You mean you start them through procmail?
>> If this what you do, then all mails are first seen by milter-greylist,
>> then by your procmail machinery.
>>
>> I don't explain why the X-Greylist header does not appear.
>>
>> Do the logs tell something interesting?
>
>I've seen this also.  If an entry is already whitelisted, then 
>milter-greylist does not add any headers.  Can anyone confirm?
>It'd be nice if it at least added some header to say it's whitelisted...

  That's configurable and always adding the header is supposed to be the default.

--- Emmanuel Dreyfus <manu@...> wrote:
> On Mon, Apr 04, 2005 at 07:03:25AM -0700, H Li
> wrote:
> > In this fc3 linux, only milter-greylist has
> > entries in sendmail.mc as indicated in the
> > instruction, clamav and spamassassin have no
> entries
> > in sendmail.mc. 
> 
> You mean you start them through procmail?
> If this what you do, then all mails are first seen
> by milter-greylist,
> then by your procmail machinery.
> 
> I don't explain why the X-Greylist header does not
> appear.
> 
> Do the logs tell something interesting?
> 
> -- 
> Emmanuel Dreyfus
> manu@...
> 

I have clamd and spammassassind running as daemons.
Then, the /etc/procmailrc has:

# Let clamassassin to check viruses:
:0fw
| /usr/local/bin/clamassassin

# if infected, put them in a special folder:
:0:
* ^X-Virus-Status: Yes
/opt/virusfiles

# if not, let it go through spamassassin:
# each user run his own.

Then, users .procmailrc has (I set them all the same,
but then they can change it if a user wants):

:0 fw
* < 256000
| /usr/bin/spamc -f

:0:
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
$MAILDIR/almost-spam

:0:
* ^X-Spam-Status: Yes
$MAILDIR/probably-spam

So, as you said, I expect greylist should show up
anyway, but they don't for almost-spam and
probably-spam emails, only for normal emails.  

The system log does not show anything about normal
emails, but only for normal emails: delayed or not
auto-whitelist, etc.

Also, all autowhitelisted normal emails show
X-Greylist:..., no exception, no problem.

Harvey

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

--- H Li <hvli@...> wrote:
> 
> 
> So, as you said, I expect greylist should show up
> anyway, but they don't for almost-spam and
> probably-spam emails, only for normal emails.  
> 
> The system log does not show anything about normal
> emails, but only for normal emails: delayed or not
> auto-whitelist, etc.
> 
> Also, all autowhitelisted normal emails show
> X-Greylist:..., no exception, no problem.
> 
> Harvey
> 

Sorry for a typo above:

It should be:

The system log does not show anything about
almost-spam and probably-spam emails, but only for
normal emails: delayed or not, auto-whitelist, etc.

Harvey


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Personals - Better first dates. More second dates. 
http://personals.yahoo.com

On Mon, Apr 04, 2005 at 07:03:25AM -0700, H Li wrote:
> Now, users still receive some "almost-spam" and
> "probably-spam" emails -- much less than before. I can
> understand this.  However, the strange thing is the
> header of those emails show no X-Greylist..., no
> X-Virus..., but only the part X-Spam... e.g.:

SpamAssassin created a new e-mail which contains the original one
as attachment. That's probably why your "X-Greylist" headers vanish.

	Kind regards

-- 
Matthias Scheler                                  http://scheler.de/~matthias/

--- Matthias Scheler <tron@...> wrote:
> On Mon, Apr 04, 2005 at 07:03:25AM -0700, H Li
> wrote:
> > Now, users still receive some "almost-spam" and
> > "probably-spam" emails -- much less than before. I
> can
> > understand this.  However, the strange thing is
> the
> > header of those emails show no X-Greylist..., no
> > X-Virus..., but only the part X-Spam... e.g.:
> 
> SpamAssassin created a new e-mail which contains the
> original one
> as attachment. That's probably why your "X-Greylist"
> headers vanish.
> 
> 	Kind regards
> 
> -- 
> Matthias Scheler                                 
> http://scheler.de/~matthias/
> 

That makes sense in logic.  If so, it means that those
spams "escaped" from greylist filter at the first
place, then spamassassin caught it, created a new
message, and put it in almost-spam or probably-spam
folder.  I will stop spamassassin to see what I will
see.

Harvey


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Helps protect you from nasty viruses. 
http://promotions.yahoo.com/new_mail