Milter-greylist

Alexandre Santos <vanaxel79@...> writes:

> Im trying to integrate the milter-greylist with spamassassin
> (spamass-milter), i´m not shore if i´ve configure the pamass-milter
> right.

You have at least two problems.

> I add this acl in greylist.conf for the spamd.
>
> spamdsock unix "/var/run/spamd.sock"
> dacl blacklist spamd > 8 msg "Message blocked for spam content."
> dacl greylist spamd > 5 msg "Message greylist for spam content."
> dacl whitelist spamd < 2 msg "Message whitlist for spam content."
> racl greylist default
>
> I´m geting this log:
> Jun  8 11:16:15 smtp-3 milter-greylist: SPF return code 1
> Jun  8 11:16:15 smtp-3 milter-greylist: SPF lookup performed in 0.006049s
> Jun  8 11:16:15 smtp-3 spamass-milter[16859]: Could not retrieve sendmail macro "i"!.  Please add it to confMILTER_MACROS_ENVFROM for better spamassassin results

You didn't say what MTA you are using.  The fix for this depends on the MTA.
If you are running postfix then
  http://www.postfix.org/MILTER_README.html
may be helpful.  An example:

# Add _ for spamass-milter per http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510665
# Add i because spamass-milter complains, but to no avail.
milter_connect_macros = i j {daemon_name} v _
# {if_name} (recommended, not in source)

> Jun  8 11:16:15 smtp-3 milter-greylist: (unknown id): addr = clover.wormly.com[66.228.123.50], from = <tos@example.com>, rcpt = <tim@...>
> Jun  8 11:16:15 smtp-3 milter-greylist: Mail from=<tos@..., rcpt=<tim@...>, addr=clover.wormly.com[66.228.123.50] is matched by entry racl 145 whitelist default
> Jun  8 11:16:15 smtp-3 milter-greylist: (unknown id): skipping greylist because this is the default action, (from=<tos@...>, rcpt=<tim@example.com>, addr=clover.wormly.com[66.228.123.50]) ACL 145
> Jun  8 11:16:16 smtp-3 milter-greylist: spamd read failed: Connection reset by peer
> Jun  8 11:16:16 smtp-3 milter-greylist: ACL evaluation failure

This is probably your real issue.  It looks like milter-greylist cannot
talk to spamassassin.  Make sure the milter-greylist user/group can
read/write the spamassassin socket.

> It looks like the milter-greylist process the message fist and then the spamd.

this should be controlled by your MTA config.  So if you are going to
filter via spamassassin via milter-greylist, why are you running a
spamass-milter?

> And the message " Could not retrieve sendmail macro "i" ", how can I resolve this?


FWIW, I decided not to base greylisting on spam scores.  Basically, I
greylist for a long time (many hours) for hosts in any kind of
blocklist, don't greylist hosts in DNSWL, and greylist most others for 2
minutes.  This tends to keep my system from spending cycles processing a
lot of junk.

I´ve got this to work, i´ve do what you have sad remove de spamss-milter out off the way. Now i have this problem:

Jun  8 15:57:38 smtp-3 spamd[19012]: spamd: got connection over /var/run/spamd.sock 
Jun  8 15:57:38 smtp-3 spamd[19012]: spamd: checking message (unknown) for (unknown):500
Jun  8 15:57:38 smtp-3 spamd[19012]: spamd: clean message (-91.6/0.1) for (unknown):500 in 0.4 seconds, 359 bytes. 
Jun  8 15:57:38 smtp-3 spamd[19012]: spamd: result: . -91 - DRUGS_ERECTILE,DRUG_ED_CAPS,MISSING_DATE,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,SPF_NEUTRAL,TO_NO_BRKTS_DIRECT,USER_IN_WHITELIST scantime=0.4,size=359,user=(unknown),uid=500,required_score=0.1,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamd.sock,mid=(unknown),autolearn=no 

the milter are not sending all the needed information to the spamd, any ideas 

Another thing i,ve tried to change the log file to /var/log/milter-greylist.log, i´ve do that in greylist.conf like this:

stat "|logger -p local2.info" \(...) and add the local2 to syslog. The logs are duplicated in maillog, is there any other change i have to do to stop the logs to go to maillog to?

Thanks

________________________________

From: Alexandre Santos <vanaxel79@...>
To: milter-greylist@yahoogroups.com
Sent: Tue, June 8, 2010 3:16:52 PM
Subject: Re: [milter-greylist] milter-greylist+spamass-milter

  
Thanks,

Here is my seting in Postfix

milter_default_ action = accept
milter_protocol = 6
milter_mail_ macros = i {auth_author} {auth_type} {auth_authen}
smtpd_milters = unix:/var/run/ spamd.sock, unix:/var/milter- greylist/ milter-greylist. sock

>> It looks like the milter-greylist process the message fist and then the spamd.

>this should be controlled by your MTA config.  So if you are going to
>filter via spamassassin via milter-greylist, why are you running a
>spamass-milter?

I´ve tried to use only milter-greylist and spamassassin, but i have this error:

Jun  8 15:14:53 smtp-3 milter-greylist: spamd read failed: Connection reset by peer
Jun  8 15:14:53 smtp-3 milter-greylist: ACL evaluation failure

Thanks



________________________________
From: Greg Troxel <gdt@...>
To: milter-greylist@ yahoogroups. com
Sent: Tue, June 8, 2010 12:34:54 PM
Subject: Re: [milter-greylist] milter-greylist+ spamass-milter


Alexandre Santos <vanaxel79@yahoo. com> writes:

> Im trying to integrate the milter-greylist with spamassassin
> (spamass-milter) , i´m not shore if i´ve configure the pamass-milter
> right.

You have at least two problems.

> I add this acl in greylist.conf for the spamd.
>
> spamdsock unix "/var/run/spamd. sock"
> dacl blacklist spamd > 8 msg "Message blocked for spam content."
> dacl greylist spamd > 5 msg "Message greylist for spam content."
> dacl whitelist spamd < 2 msg "Message whitlist for spam content."
> racl greylist default
>
> I´m geting this log:
> Jun  8 11:16:15 smtp-3 milter-greylist: SPF return code 1
> Jun  8 11:16:15 smtp-3 milter-greylist: SPF lookup performed in 0.006049s
> Jun  8 11:16:15 smtp-3 spamass-milter[ 16859]: Could not retrieve sendmail macro "i"!.  Please add it to confMILTER_MACROS_ ENVFROM for better spamassassin results

You didn't say what MTA you are using.  The fix for this depends on the MTA.
If you are running postfix then
  http://www.postfix. org/MILTER_ README.html
may be helpful.  An example:

# Add _ for spamass-milter per http://bugs. debian.org/ cgi-bin/bugrepor t.cgi?bug= 510665
# Add i because spamass-milter complains, but to no avail.
milter_connect_ macros = i j {daemon_name} v _
# {if_name} (recommended, not in source)

> Jun  8 11:16:15 smtp-3 milter-greylist: (unknown id): addr = clover.wormly. com[66.228.123. 50], from = <tos@example. com>, rcpt = <tim@example. com>
> Jun  8 11:16:15 smtp-3 milter-greylist: Mail from=<tos@example. com, rcpt=<tim@example. com>, addr=clover. wormly.com[ 66.228.123. 50] is matched by entry racl 145 whitelist default
> Jun  8 11:16:15 smtp-3 milter-greylist: (unknown id): skipping greylist because this is the default action, (from=<tos@example. com>, rcpt=<tim@example. com>, addr=clover. wormly.com[ 66.228.123. 50]) ACL 145
> Jun  8 11:16:16 smtp-3 milter-greylist: spamd read failed: Connection reset by peer
> Jun  8 11:16:16 smtp-3 milter-greylist: ACL evaluation failure

This is probably your real issue.  It looks like milter-greylist cannot
talk to spamassassin.  Make sure the milter-greylist user/group can
read/write the spamassassin socket.

> It looks like the milter-greylist process the message fist and then the spamd.

this should be controlled by your MTA config.  So if you are going to
filter via spamassassin via milter-greylist, why are you running a
spamass-milter?

> And the message " Could not retrieve sendmail macro "i" ", how can I resolve this?


FWIW, I decided not to base greylisting on spam scores.  Basically, I
greylist for a long time (many hours) for hosts in any kind of
blocklist, don't greylist hosts in DNSWL, and greylist most others for 2
minutes.  This tends to keep my system from spending cycles processing a
lot of junk.

milter_mail_macros = i {auth_author} {auth_type} {auth_authen}

change to milter_connect_macros

  I´ve tried to use only milter-greylist and spamassassin, but i have this error:

  Jun  8 15:14:53 smtp-3 milter-greylist: spamd read failed: Connection reset by peer
  Jun  8 15:14:53 smtp-3 milter-greylist: ACL evaluation failure

Yes - it seems that milter-greylist cannot talk to spamd.

------- Original message -------
> From: Alexandre Santos <vanaxel79@yahoo.com>
> To: milter-greylist@yahoogroups.com
> Sent: 8.6.'10,  17:37
> 
> Jun  8 16:29:30 smtp spamd[19140]: spamd: checking message (unknown) for (unknown):500

Left unknown should be the message-id, right unknown the
name of the user connected to the spamd socket.  The latter is
not supported by milter-greylist (a patch exists somewhere in the
archives) while the former should definitely work and is only
unknown if you're using a recent postfix version and the
received message has no message-id header (recent postfix
versions don't sanitize the mid any more prior passing the
message content to the milter subsystem, afair).

Petar

--- In milter-greylist@yahoogroups.com, "Petar Bogdanovic" <petar@...> wrote:
>
> ------- Original message -------
> > From: Alexandre Santos <vanaxel79@...>
> > To: milter-greylist@yahoogroups.com
> > Sent: 8.6.'10,  17:37
> > 
> > Jun  8 16:29:30 smtp spamd[19140]: spamd: checking message (unknown) for (unknown):500
> 
> Left unknown should be the message-id, right unknown the
> name of the user connected to the spamd socket.  The latter is
> not supported by milter-greylist (a patch exists somewhere in the
> archives) while the former should definitely work and is only
> unknown if you're using a recent postfix version and the
> received message has no message-id header (recent postfix
> versions don't sanitize the mid any more prior passing the
> message content to the milter subsystem, afair).
> 
> Petar
>
I haven´t found the pach in the archives, can you help me and give me the link.

best regards

... Why do you need spamd to report its UID every time it scans a message? Also, the patch I mentioned injects the queue-id instead of the spamd UID into that

Petar Bogdanovic <petar@...> wrote:

> Why do you need spamd to report its UID every time it scans a message?
> Also, the patch I mentioned injects the queue-id instead of the spamd
> UID into that particular field.
> 
>               Petar Bogdanovic
> 
> P.S. Message (+patch) attached.

Checked in.

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@...