Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: exim: users

SPAMASSASSIN UNIX socket

 

 

First page Previous page 1 2 Next page Last page  View All exim users RSS feed   Index | Next | Previous | View Threaded


majid.alavizadeh at gmail

Nov 24, 2009, 1:49 AM

Post #1 of 26 (3020 views)
Permalink
SPAMASSASSIN UNIX socket

Hi

This is spamassassin configuraton in exim.conf. I get this error on main.log.


malware acl condition: spamd: unable to connect to UNIX socket
/var/run/spamassassin/spamd.sock (No such file or directory)


--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 1:55 AM

Post #2 of 26 (2963 views)
Permalink
SPAMASSASSIN UNIX socket [In reply to]

Hi

This is spamassassin configuraton in exim.conf. I get this error on main.log.

exim.conf: spamd_address = /var/run/spamassassin/spamd.sock

error: malware acl condition: spamd: unable to connect to UNIX socket
/var/run/spamassassin/spamd.sock (No such file or directory)




--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


addw at phcomp

Nov 24, 2009, 2:01 AM

Post #3 of 26 (2976 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 01:19:29PM +0330, majid alavizadeh wrote:
> Hi
>
> This is spamassassin configuraton in exim.conf. I get this error on main.log.
>
>
> malware acl condition: spamd: unable to connect to UNIX socket
> /var/run/spamassassin/spamd.sock (No such file or directory)

Is spamd running ?

--
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG: http://www.ukuug.org/
#include <std_disclaimer.h>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 2:36 AM

Post #4 of 26 (2950 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

YES

service spamassassin status is running.




On Tue, Nov 24, 2009 at 1:31 PM, Alain Williams <addw [at] phcomp> wrote:
> On Tue, Nov 24, 2009 at 01:19:29PM +0330, majid alavizadeh wrote:
>> Hi
>>
>> This is spamassassin configuraton in exim.conf. I get this error on main.log.
>>
>>
>>  malware acl condition: spamd: unable to connect to UNIX socket
>> /var/run/spamassassin/spamd.sock (No such file or directory)
>
> Is spamd running ?
>
> --
> Alain Williams
> Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
> +44 (0) 787 668 0256  http://www.phcomp.co.uk/
> Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
> Past chairman of UKUUG: http://www.ukuug.org/
> #include <std_disclaimer.h>
>



--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


john.burnham at gmail

Nov 24, 2009, 2:51 AM

Post #5 of 26 (2947 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

2009/11/24 majid alavizadeh <majid.alavizadeh [at] gmail>

> YES
>
> service spamassassin status is running.
>
> So, how is it configured ? Is it configured to use a unix domain path or is
it configured to use a TCP socket ? If it's using a domain path does it
match the path mentioned in the error message ?

If you're not sure - try reading the spamd man page. It's even available
online at

http://spamassassin.apache.org/full/3.1.x/doc/spamd.html

J
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


Frank.Elsner at TU-Berlin

Nov 24, 2009, 2:51 AM

Post #6 of 26 (2949 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, 24 Nov 2009 14:06:21 +0330 majid alavizadeh wrote:
> YES
>
> service spamassassin status is running.

And listening on the socket?


--Frank Elsner

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


addw at phcomp

Nov 24, 2009, 2:51 AM

Post #7 of 26 (2951 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 02:06:21PM +0330, majid alavizadeh wrote:
> YES
>
> service spamassassin status is running.

What OS are you running ?

What is spamd listening on ? It may very well be listening on a socket, on a linux
system the following will give you a clue:
netstat -ap|grep spam



BTW: please post your reply *AFTER* what you are replying to. A reply before the question
makes not sense at all.


> On Tue, Nov 24, 2009 at 1:31 PM, Alain Williams <addw [at] phcomp> wrote:
> > On Tue, Nov 24, 2009 at 01:19:29PM +0330, majid alavizadeh wrote:
> >> Hi
> >>
> >> This is spamassassin configuraton in exim.conf. I get this error on main.log.
> >>
> >>
> >>  malware acl condition: spamd: unable to connect to UNIX socket
> >> /var/run/spamassassin/spamd.sock (No such file or directory)
> >
> > Is spamd running ?

--
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG: http://www.ukuug.org/
#include <std_disclaimer.h>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


odhiambo at gmail

Nov 24, 2009, 3:01 AM

Post #8 of 26 (2947 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 1:36 PM, majid alavizadeh <
majid.alavizadeh [at] gmail> wrote:

> YES
>
> service spamassassin status is running.
>
>
Can you pls check your clamd.conf and tell us what you have for LocalSocket
parameter?

--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254733744121/+254722743223
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
"If you have nothing good to say about someone, just shut up!."
-- Lucky Dube
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 3:07 AM

Post #9 of 26 (2955 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

spamd 28171 root 5u IPv4 81499 TCP
localhost.localdomain:783 (LISTEN)
spamd 28174 root 5u IPv4 81499 TCP
localhost.localdomain:783 (LISTEN)
spamd 28175 root 5u IPv4 81499 TCP
localhost.localdomain:783 (LISTEN)




On Tue, Nov 24, 2009 at 2:21 PM, Alain Williams <addw [at] phcomp> wrote:
> On Tue, Nov 24, 2009 at 02:06:21PM +0330, majid alavizadeh wrote:
>> YES
>>
>> service spamassassin status is running.
>
> What OS are you running ?
>
> What is spamd listening on ? It may very well be listening on a socket, on a linux
> system the following will give you a clue:
>        netstat -ap|grep spam
>
>
>
> BTW: please post your reply *AFTER* what you are replying to. A reply before the question
> makes not sense at all.
>
>
>> On Tue, Nov 24, 2009 at 1:31 PM, Alain Williams <addw [at] phcomp> wrote:
>> > On Tue, Nov 24, 2009 at 01:19:29PM +0330, majid alavizadeh wrote:
>> >> Hi
>> >>
>> >> This is spamassassin configuraton in exim.conf. I get this error on main.log.
>> >>
>> >>
>> >>  malware acl condition: spamd: unable to connect to UNIX socket
>> >> /var/run/spamassassin/spamd.sock (No such file or directory)
>> >
>> > Is spamd running ?
>
> --
> Alain Williams
> Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
> +44 (0) 787 668 0256  http://www.phcomp.co.uk/
> Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
> Past chairman of UKUUG: http://www.ukuug.org/
> #include <std_disclaimer.h>
>



--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


peter at bowyer

Nov 24, 2009, 3:08 AM

Post #10 of 26 (2947 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

2009/11/24 Odhiambo Washington <odhiambo [at] gmail>:
> On Tue, Nov 24, 2009 at 1:36 PM, majid alavizadeh <
> majid.alavizadeh [at] gmail> wrote:
>
>> YES
>>
>> service spamassassin status is running.
>>
>>
> Can you pls check your clamd.conf and tell us what you have for LocalSocket
> parameter?

I doubt that would help - the problem is with Spamassassin, not ClamAV.


--
Peter Bowyer
Email: peter [at] bowyer
Follow me on Twitter: twitter.com/peeebeee

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


addw at phcomp

Nov 24, 2009, 3:12 AM

Post #11 of 26 (2951 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 02:37:09PM +0330, majid alavizadeh wrote:
> spamd 28171 root 5u IPv4 81499 TCP
> localhost.localdomain:783 (LISTEN)
> spamd 28174 root 5u IPv4 81499 TCP
> localhost.localdomain:783 (LISTEN)
> spamd 28175 root 5u IPv4 81499 TCP
> localhost.localdomain:783 (LISTEN)

OK: so it is listening on a socket, so you need to have something like
this in your exim config:

spamd_address = 127.0.0.1 783


BTW: please read what people send to you and don't put your comments
BEFORE the mail that you are replying to.



> On Tue, Nov 24, 2009 at 2:21 PM, Alain Williams <addw [at] phcomp> wrote:
> > On Tue, Nov 24, 2009 at 02:06:21PM +0330, majid alavizadeh wrote:
> >> YES
> >>
> >> service spamassassin status is running.
> >
> > What OS are you running ?
> >
> > What is spamd listening on ? It may very well be listening on a socket, on a linux
> > system the following will give you a clue:
> >        netstat -ap|grep spam
> >
> >
> >
> > BTW: please post your reply *AFTER* what you are replying to. A reply before the question
> > makes not sense at all.

--
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG: http://www.ukuug.org/
#include <std_disclaimer.h>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


odhiambo at gmail

Nov 24, 2009, 3:18 AM

Post #12 of 26 (2947 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 2:08 PM, Peter Bowyer <peter [at] bowyer> wrote:

> 2009/11/24 Odhiambo Washington <odhiambo [at] gmail>:
> > On Tue, Nov 24, 2009 at 1:36 PM, majid alavizadeh <
> > majid.alavizadeh [at] gmail> wrote:
> >
> >> YES
> >>
> >> service spamassassin status is running.
> >>
> >>
> > Can you pls check your clamd.conf and tell us what you have for
> LocalSocket
> > parameter?
>
> I doubt that would help - the problem is with Spamassassin, not ClamAV.
>

Just realized it:)

So the value passed to spamd with --socketpath=, should match the value
of spamd_address = in exim.conf.
If --socketpath= was not passed to spamd, then spamd is listening on a TCP
socket as is the case and so this fellow needed not to have changed the
default "spamd_address = 127.0.0.1 783".


--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254733744121/+254722743223
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
"If you have nothing good to say about someone, just shut up!."
-- Lucky Dube
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 4:14 AM

Post #13 of 26 (2954 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

I change spamd_address:
spamd_address: = 127.0.0.1 783

New error:

spam acl condition: warning - spamd connection to 127.0.0.1, port 783
failed: Connection refused

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


odhiambo at gmail

Nov 24, 2009, 4:22 AM

Post #14 of 26 (2944 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 3:14 PM, majid alavizadeh <
majid.alavizadeh [at] gmail> wrote:

> I change spamd_address:
> spamd_address: = 127.0.0.1 783
>
^
With that colon in the configuration file???? I hope not.


>
> New error:
>
> spam acl condition: warning - spamd connection to 127.0.0.1, port 783
> failed: Connection refused
>

Now, suppose you run the following test and show us what you get: telnet
127.0.0.1 783
Below is what I get:-)

[wash [at] FreeBSD- ~]$ telnet 127.0.0.1 783
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.




--
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254733744121/+254722743223
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
"If you have nothing good to say about someone, just shut up!."
-- Lucky Dube
--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


addw at phcomp

Nov 24, 2009, 4:26 AM

Post #15 of 26 (2946 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

On Tue, Nov 24, 2009 at 03:44:00PM +0330, majid alavizadeh wrote:
> I change spamd_address:
> spamd_address: = 127.0.0.1 783
>
> New error:
>
> spam acl condition: warning - spamd connection to 127.0.0.1, port 783
> failed: Connection refused

What happens when you try to connect by hand:

nc 127.0.0.1 783

Is it still listening (netstat -ltp) ?

--
Alain Williams
Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
Past chairman of UKUUG: http://www.ukuug.org/
#include <std_disclaimer.h>

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 4:38 AM

Post #16 of 26 (2948 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

nc 127.0.0.1 783
123
SPAMD/1.0 76 Bad header line: 123



On Tue, Nov 24, 2009 at 3:56 PM, Alain Williams <addw [at] phcomp> wrote:
> On Tue, Nov 24, 2009 at 03:44:00PM +0330, majid alavizadeh wrote:
>> I change spamd_address:
>> spamd_address:  = 127.0.0.1 783
>>
>> New error:
>>
>>  spam acl condition: warning - spamd connection to 127.0.0.1, port 783
>> failed: Connection refused
>
> What happens when you try to connect by hand:
>
>        nc 127.0.0.1 783
>




--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 4:43 AM

Post #17 of 26 (2952 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

# nc 127.0.0.1 783
123
SPAMD/1.0 76 Bad header line: 123
# netstat -ltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State PID/Program name
tcp 0 0 localhost.localdomain:2208 *:*
LISTEN 2401/hpiod
tcp 0 0 *:mysql *:*
LISTEN 4469/mysqld
tcp 0 0 *:pop3 *:*
LISTEN 6195/cyrus-master
tcp 0 0 localhost.localdomain:783 *:*
LISTEN 3793/spamd.pid
tcp 0 0 *:imap *:*
LISTEN 4306/imapd

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


nmw at ion

Nov 24, 2009, 4:44 AM

Post #18 of 26 (2943 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

majid alavizadeh wrote:
> I change spamd_address:
> spamd_address: = 127.0.0.1 783
>
> New error:
>
> spam acl condition: warning - spamd connection to 127.0.0.1, port 783
> failed: Connection refused
>

Do you have a firewall blocking port 783 on all interfaces, by any chance?

Try it manually using spamc. Either feed it a file (even an email if you
have one in a file):

spamc -d localhost -p 783 < some_file

or type something at the terminal (and random garbage will do, all
you're testing is the connection to spamd):

spamc -d localhost -p 783

enter some random text and press ctrl-d to give EOF.


--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw [at] ion
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 5:05 AM

Post #19 of 26 (2946 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

firewall is of and i can telnet via 783


I type "spamc -d localhost -p 783 < TEST" (Test contains 'X') and
some random text in ssh command with this result:


spamc -d localhost -p 783 < TEST

sdasda
sdas
dasd
asdasdads

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mail.farahost.biz
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.9 required=5.0 tests=EMPTY_MESSAGE,MISSING_DATE,
MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,
NO_RECEIVED,NO_RELAYS,TVD_SPACE_RATIO autolearn=no version=3.2.5
X-Spam-Report:
* 0.0 MISSING_MID Missing Message-Id: header
* 0.0 MISSING_DATE Missing Date: header
* -0.0 NO_RELAYS Informational: message was not relayed via SMTP
* 2.5 MISSING_HB_SEP Missing blank line between message header and body
* 1.6 MISSING_HEADERS Missing To: header
* 2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
* 1.3 MISSING_SUBJECT Missing Subject: header
* 0.6 EMPTY_MESSAGE Message appears to have no textual parts and no
* Subject: text
* -0.0 NO_RECEIVED Informational: message has no Received headers
* 0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822
* headers

Subject: [SPAM]
X-Spam-Prev-Subject: (nonexistent)








>
>  spamc -d localhost -p 783 < some_file
>
> or type something at the terminal (and random garbage will do, all
> you're testing is the connection to spamd):
>
>  spamc -d localhost -p 783
>
> enter some random text and press ctrl-d to give EOF.
>




--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


james at digitalciti

Nov 24, 2009, 6:11 AM

Post #20 of 26 (2947 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

This may just be a spamd issue, you have SA listening via TCP not
local unix socket, so in that case you can specify the listening IP
(bind IP) as well as hosts allowed to connect to that IP. For example
in my SA installation which runs on its own dedicated machine, I have
to connect via TCP to the remote host, so I control access by
specifying what IP's are allowed to connect to the process by way of
switches in the SA startup script.
Example:
/usr/local/bin/spamd -i 123.123.123.1 -A 123.123.123.2
-i binds to 123.123.123.1
-A allows host 123.123.123.2 to connect to it
If you're running this on localhost and specifying either one of those
flags w/o the other might be a problem.
Maybe -i 127.0.0.1 -A 127.0.0.1 will fix your issue, assuming the -i
is being specified in your spamd startup script. In this case make
sure you connect to 127.0.0.1 783 in your exim config.
If this doesn't solve your problem, I'd start looking at the SA logs
and see what errors it might be throwing.
Thanks,
James
majid alavizadeh wrote:

firewall is of and i can telnet via 783


I type "spamc -d localhost -p 783 < TEST" (Test contains 'X') and
some random text in ssh command with this result:


spamc -d localhost -p 783 < TEST

sdasda
sdas
dasd
asdasdads

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mail.farahost.biz
X-Spam-Level: ********
X-Spam-Status: Yes, score=8.9 required=5.0 tests=EMPTY_MESSAGE,MISSING_DATE,
MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_M
ESSAGE,
NO_RECEIVED,NO_RELAYS,TVD_SPACE_RATIO autolearn=no version=3.2.5
X-Spam-Report:
* 0.0 MISSING_MID Missing Message-Id: header
* 0.0 MISSING_DATE Missing Date: header
* -0.0 NO_RELAYS Informational: message was not relayed via SMTP
* 2.5 MISSING_HB_SEP Missing blank line between message header and bod
y
* 1.6 MISSING_HEADERS Missing To: header
* 2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
* 1.3 MISSING_SUBJECT Missing Subject: header
* 0.6 EMPTY_MESSAGE Message appears to have no textual parts and no
* Subject: text
* -0.0 NO_RECEIVED Informational: message has no Received headers
* 0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822
* headers

Subject: [SPAM]
X-Spam-Prev-Subject: (nonexistent)










spamc -d localhost -p 783 < some_file

or type something at the terminal (and random garbage will do, all
you're testing is the connection to spamd):

spamc -d localhost -p 783

enter some random text and press ctrl-d to give EOF.







--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


nmw at ion

Nov 24, 2009, 6:18 AM

Post #21 of 26 (2935 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

majid alavizadeh wrote:
> firewall is of and i can telnet via 783
>
>
> I type "spamc -d localhost -p 783 < TEST" (Test contains 'X') and
> some random text in ssh command with this result:
>
>
> spamc -d localhost -p 783 < TEST
>
> sdasda
> sdas
> dasd
> asdasdads
>
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mail.farahost.biz
> X-Spam-Level: ********
> X-Spam-Status: Yes, score=8.9 required=5.0 tests=EMPTY_MESSAGE,MISSING_DATE,
> MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,
> NO_RECEIVED,NO_RELAYS,TVD_SPACE_RATIO autolearn=no version=3.2.5
> X-Spam-Report:
> * 0.0 MISSING_MID Missing Message-Id: header
> * 0.0 MISSING_DATE Missing Date: header
> * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
> * 2.5 MISSING_HB_SEP Missing blank line between message header and body
> * 1.6 MISSING_HEADERS Missing To: header
> * 2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
> * 1.3 MISSING_SUBJECT Missing Subject: header
> * 0.6 EMPTY_MESSAGE Message appears to have no textual parts and no
> * Subject: text
> * -0.0 NO_RECEIVED Informational: message has no Received headers
> * 0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822
> * headers
>
> Subject: [SPAM]
> X-Spam-Prev-Subject: (nonexistent)
>
>
>
>
>
>
>
>
>> spamc -d localhost -p 783 < some_file
>>
>> or type something at the terminal (and random garbage will do, all
>> you're testing is the connection to spamd):
>>
>> spamc -d localhost -p 783
>>
>> enter some random text and press ctrl-d to give EOF.
>>
>
>

Ok, so spamd is definitely running, and listening on the correct port.

The default spamd setup for Exim is the default for spamd, i.e.
localhost on port 783. spamd_address should not be necessary. What
happens if you remove the spamd_address from exim.conf?

Try running Exim in interactive debug mode and entering a random message
(Exim will produce copious output) [my input is preceded by **]:

# exim -bh 1.2.3.4 -d-all+acl
...
220 mail.ion.le.ac.uk ESMTP Exim 4.63 Tue, 24 Nov 2009 14:07:26 +0000
** ehlo some.domain
250-mail.ion.le.ac.uk Hello some.domain [1.2.3.4]
250-SIZE 20971520
250-EXPN
250-PIPELINING
250-STARTTLS
250 HELP
** mail from:someone [at] somewher
250 OK
** rcpt to:nmw [at] ion
...
250 Accepted
** data
354 Enter message, ending with "." on a line by itself
** some random garbage
** .
...

[.somewhere in the output there should be the ACL check for spam]

check spam = nobody
trying server 127.0.0.1, port 783
check condition = ${if and { { <{$message_size}{100k}} {
>{$spam_score_int}{150}} } {1}{0} }
= 0
deny: condition test failed
processing "warn"
check condition = ${if <{$message_size}{100k}{1}{0}}
= 1
check set acl_m2 = X-Spam-Report: $spam_report
= X-Spam-Report: Spam detection software, running on
the system "mail.ion.le.ac.uk", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: some random garbage [...]
Content analysis details: (6.2 points, 5.5 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.0 MISSING_MID Missing Message-Id: header
0.0 MISSING_DATE Missing Date: header
1.3 MISSING_HEADERS Missing To: header
3.0 BAYES_80 BODY: Bayesian spam probability is 80 to 95%
[score: 0.9044]
1.8 MISSING_SUBJECT Missing Subject: header
0.1 RDNS_NONE Delivered to trusted network by a host with
no rDNS
check set acl_m1 = X-Spam-Level: $spam_bar
= X-Spam-Level: ++++++
check set acl_m0 = X-Spam-Status: No, score=$spam_score
= X-Spam-Status: No, score=6.2
check set acl_c0 = No
check spam = nobody:true
warn: condition test succeeded
processing "warn"
check condition = ${if <{$message_size}{100k}{1}{0}}
= 1
check spam = nobody
check set acl_m0 = X-Spam-Status: Yes, score=$spam_score
= X-Spam-Status: Yes, score=6.2
check set acl_c0 = Yes
warn: condition test succeeded
processing "accept"
accept: condition test succeeded


--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw [at] ion
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


Christian.Schmidt at chemie

Nov 24, 2009, 7:11 AM

Post #22 of 26 (2937 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

majid alavizadeh, 24.11.2009 (d.m.y):

> I change spamd_address:
> spamd_address: = 127.0.0.1 783
>
> New error:
>
> spam acl condition: warning - spamd connection to 127.0.0.1, port 783
> failed: Connection refused

Which arguments is spamd started with? Please take a look at tme
manual pages to determine the options which allo access for localhost.

Gruss/Regards,
Christian Schmidt

--
Try the Moo Shu Pork. It is especially good today.

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 10:23 PM

Post #23 of 26 (2908 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

using ACL "acl_check_data"
processing "accept"
check condition = ${if >={$message_size}{100000} {1}}
=
accept: condition test failed
processing "warn"
check spam = nobody/defer_ok
trying server 127.0.0.1, port 783
LOG: MAIN PANIC
spam acl condition: warning - spamd connection to 127.0.0.1, port
783 failed: Connection refused
LOG: MAIN PANIC
spam acl condition: all spamd servers failed
warn: condition test failed
processing "accept"
check condition = ${if !def:spam_score_int {1}}
= 1
check add_header = X-Spam-Note: SpamAssassin invocation failed
accept: condition test succeeded
>>Headers added by DATA ACL:
X-Spam-Note: SpamAssassin invocation failed
>>
unspool_mbox(): unlinking
'/var/spool/exim/scan/1NDELG-0004VO-6D/1NDELG-0004VO-6D.eml'




On Tue, Nov 24, 2009 at 5:48 PM, Nigel Wade <nmw [at] ion> wrote:
> majid alavizadeh wrote:
>> firewall is of and i can telnet via 783
>>
>>
>> I type "spamc -d localhost -p 783 < TEST" (Test contains 'X') and
>> some random text in ssh command with this result:
>>
>>
>> spamc -d localhost -p 783 < TEST
>>
>> sdasda
>> sdas
>> dasd
>> asdasdads
>>
>> X-Spam-Flag: YES
>> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on mail.farahost.biz
>> X-Spam-Level: ********
>> X-Spam-Status: Yes, score=8.9 required=5.0 tests=EMPTY_MESSAGE,MISSING_DATE,
>>         MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,
>>         NO_RECEIVED,NO_RELAYS,TVD_SPACE_RATIO autolearn=no version=3.2.5
>> X-Spam-Report:
>>         *  0.0 MISSING_MID Missing Message-Id: header
>>         *  0.0 MISSING_DATE Missing Date: header
>>         * -0.0 NO_RELAYS Informational: message was not relayed via SMTP
>>         *  2.5 MISSING_HB_SEP Missing blank line between message header and body
>>         *  1.6 MISSING_HEADERS Missing To: header
>>         *  2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
>>         *  1.3 MISSING_SUBJECT Missing Subject: header
>>         *  0.6 EMPTY_MESSAGE Message appears to have no textual parts and no
>>         *      Subject: text
>>         * -0.0 NO_RECEIVED Informational: message has no Received headers
>>         *  0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822
>>         *      headers
>>
>> Subject: [SPAM]
>> X-Spam-Prev-Subject: (nonexistent)
>>
>>
>>
>>
>>
>>
>>
>>
>>>  spamc -d localhost -p 783 < some_file
>>>
>>> or type something at the terminal (and random garbage will do, all
>>> you're testing is the connection to spamd):
>>>
>>>  spamc -d localhost -p 783
>>>
>>> enter some random text and press ctrl-d to give EOF.
>>>
>>
>>
>
> Ok, so spamd is definitely running, and listening on the correct port.
>
> The default spamd setup for Exim is the default for spamd, i.e.
> localhost on port 783. spamd_address should not be necessary. What
> happens if you remove the spamd_address from exim.conf?
>
> Try running Exim in interactive debug mode and entering a random message
> (Exim will produce copious output) [my input is preceded by **]:
>
> # exim -bh 1.2.3.4 -d-all+acl
> ...
> 220 mail.ion.le.ac.uk ESMTP Exim 4.63 Tue, 24 Nov 2009 14:07:26 +0000
> ** ehlo some.domain
> 250-mail.ion.le.ac.uk Hello some.domain [1.2.3.4]
> 250-SIZE 20971520
> 250-EXPN
> 250-PIPELINING
> 250-STARTTLS
> 250 HELP
> ** mail from:someone [at] somewher
> 250 OK
> ** rcpt to:nmw [at] ion
> ...
> 250 Accepted
> ** data
> 354 Enter message, ending with "." on a line by itself
> ** some random garbage
> ** .
> ...
>
> [.somewhere in the output there should be the ACL check for spam]
>
> check spam = nobody
> trying server 127.0.0.1, port 783
> check condition = ${if and { { <{$message_size}{100k}} {
>>{$spam_score_int}{150}} } {1}{0} }
>                = 0
> deny: condition test failed
> processing "warn"
> check condition = ${if <{$message_size}{100k}{1}{0}}
>                = 1
> check set acl_m2 = X-Spam-Report: $spam_report
>                 = X-Spam-Report: Spam detection software, running on
> the system "mail.ion.le.ac.uk", has
>        identified this incoming email as possible spam.  The original message
>        has been attached to this so you can view it (if it isn't spam) or label
>        similar future email.  If you have any questions, see
>        the administrator of that system for details.
>        Content preview:  some random garbage [...]
>        Content analysis details:   (6.2 points, 5.5 required)
>        pts rule name              description
>        ---- ----------------------
> --------------------------------------------------
>        0.0 MISSING_MID            Missing Message-Id: header
>        0.0 MISSING_DATE           Missing Date: header
>        1.3 MISSING_HEADERS        Missing To: header
>        3.0 BAYES_80               BODY: Bayesian spam probability is 80 to 95%
>        [score: 0.9044]
>        1.8 MISSING_SUBJECT        Missing Subject: header
>        0.1 RDNS_NONE              Delivered to trusted network by a host with
> no rDNS
> check set acl_m1 = X-Spam-Level: $spam_bar
>                 = X-Spam-Level: ++++++
> check set acl_m0 = X-Spam-Status: No, score=$spam_score
>                 = X-Spam-Status: No, score=6.2
> check set acl_c0 = No
> check spam = nobody:true
> warn: condition test succeeded
> processing "warn"
> check condition = ${if <{$message_size}{100k}{1}{0}}
>                = 1
> check spam = nobody
> check set acl_m0 = X-Spam-Status: Yes, score=$spam_score
>                 = X-Spam-Status: Yes, score=6.2
> check set acl_c0 = Yes
> warn: condition test succeeded
> processing "accept"
> accept: condition test succeeded
>
>
> --
> Nigel Wade, System Administrator, Space Plasma Physics Group,
>            University of Leicester, Leicester, LE1 7RH, UK
> E-mail :    nmw [at] ion
> Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555
>
> --
> ## List details at http://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
>



--
M Alavizadeh

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


majid.alavizadeh at gmail

Nov 24, 2009, 10:33 PM

Post #24 of 26 (2901 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

Hi Nigel!

I change "nobody" to "spamd" user and after try again this error appears:

accept: condition test failed
processing "warn"
check add_header = X-Spam-Score: $spam_score ($spam_bar)\n
= X-Spam-Score: 1.4 (+)

warn: condition test succeeded
processing "drop"
check condition = ${if >{$spam_score_int}{60} {1}}
=
drop: condition test failed
end of ACL "acl_check_data": implicit DENY
>>Headers added by DATA ACL:
X-Spam-Score: 1.4 (+)
>>
unspool_mbox(): unlinking
'/var/spool/exim/scan/1NDESu-0004b3-OP/1NDESu-0004b3-OP.eml'
550 Administrative prohibition
LOG: MAIN REJECT
H=localhost (mylocaldomain) [127.0.0.1] F=<sender [at] somedomai>
rejected after DATA

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


wbh at conducive

Nov 25, 2009, 1:29 AM

Post #25 of 26 (2888 views)
Permalink
Re: SPAMASSASSIN UNIX socket [In reply to]

majid alavizadeh wrote:
> Hi Nigel!
>
> I change "nobody" to "spamd" user and after try again this error appears:
>
> accept: condition test failed
> processing "warn"
> check add_header = X-Spam-Score: $spam_score ($spam_bar)\n
> = X-Spam-Score: 1.4 (+)
>
> warn: condition test succeeded
> processing "drop"
> check condition = ${if >{$spam_score_int}{60} {1}}
> =
> drop: condition test failed
> end of ACL "acl_check_data": implicit DENY
>>> Headers added by DATA ACL:
> X-Spam-Score: 1.4 (+)
> unspool_mbox(): unlinking
> '/var/spool/exim/scan/1NDESu-0004b3-OP/1NDESu-0004b3-OP.eml'
> 550 Administrative prohibition
> LOG: MAIN REJECT
> H=localhost (mylocaldomain) [127.0.0.1] F=<sender [at] somedomai>
> rejected after DATA
>

Among other considerations, both the exim daemon 'children' (EG: no longer
running as 'root', but as some other euid:egid).. AND the spam daemon (AND
perhaps a ClamAV daemon)

... need r/w privileges to the socket (or IP stack) AND the spool files.

Likewise to their respective logs, PID files, et al.

Not to forget the mailstore files (the exim daemon + the POP/IMAP daemon, but
ordinarily not the Spam or AV daemons).

'ls -l <each of the above dirtrees>' and the issue may become obvious.

- Check UID and GID in /etc/master.passwd and /etc/group (or equivalent..)

Consider making the above players members of the same group or groups, adjusting
ownerships accordingly.

Watch out that these are not in conflict with, for example, a vestigial sendmail
binary invoked by cron that might change said ownerships, 'crippling' exim once
a day... (edit /etc/mail/mailer.conf to redirect such invocations to Exim..)

;-)

HTH,

Bill



--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

First page Previous page 1 2 Next page Last page  View All exim users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.