[Dspam-user] scanned several times

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

[Dspam-user] scanned several times

Rick Leir
This is what I think is happening. The incoming message was scanned by dspam several times, once before it got to our internal mailing list, and secondly after the mailing list sent it to me.  Now it has 2 sets of dspam headers.

X-DSPAM-Signature: 5367c3d722001198720193
...
X-DSPAM-Signature: 5367c3de22001657727144

Now when I retrain the message, and dspam should be looking for nn7144 in my account, instead dspam looks for nn0193 which is not in my account (it is in the account for the mailing list).  The log gets this:

May  5 13:02:59 hera dspam[2200]: Signature retrieval for '5367c3d722001198720193' failed

We are using Postfix to pipe messages to dspam, and I will look at the Postfix doco to help me configure it right, so dspam only sees messages when they are going to a real user. 

Another option would be that dspam could look at all the signatures, not just the first one.

Another option is that dspam could know when it is scanning a message destined for a mailing list, and not add headers at that time.
Thanks
Rick

Rick Leir, Senior Developer
http://CirrusComputing.com/ 





------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Tom Hendrikx
On 05/05/2014 07:31 PM, Rick Leir wrote:

> This is what I think is happening. The incoming message was scanned by
> dspam several times, once before it got to our internal mailing list,
> and secondly after the mailing list sent it to me.  Now it has 2 sets of
> dspam headers.
>
> X-DSPAM-Signature: 5367c3d722001198720193
> ...
> X-DSPAM-Signature: 5367c3de22001657727144
>
> Now when I retrain the message, and dspam should be looking for nn7144
> in my account, instead dspam looks for nn0193 which is not in my account
> (it is in the account for the mailing list).  The log gets this:
>
> May  5 13:02:59 hera dspam[2200]: Signature retrieval for
> '5367c3d722001198720193' failed
>
> We are using Postfix to pipe messages to dspam, and I will look at the
> Postfix doco to help me configure it right, so dspam only sees messages
> when they are going to a real user.
>
> Another option would be that dspam could look at all the signatures, not
> just the first one.
>
> Another option is that dspam could know when it is scanning a message
> destined for a mailing list, and not add headers at that time.
> Thanks
> Rick
>
> Rick Leir, Senior Developer
> http://CirrusComputing.com/ 
>

Typically, the mailing list functionality and the end-user funcionality
should be separated. When an incoming message to the mailing list enters
your mail stack, it should be scanned, and if it's spam, it should not
be sent to the mailing list users. typical mailing ;list behaviour. You
can retrain if it was a FP by using that available header. So far so
good for mailing list functionality.

Then the mailing list mail should be sent to end users. If the end user
is using a spam filtering engine (f.i. dspam), the mail server should
make sure to remove stuff that will confuse the filtering process.
Typically, you should remove any dspam (signature) header from incoming
messages, since they aren't added by your setup. I use postfix header
checks to rename DSPAM headers to X-External-Dspam-blahblah to make sure
they don't mess up my system. You should also do this before the mailing
list gets external mail, since some people setup DSPAM for outgoing mail
too, but still add headers.

When you've setup both functionalities in one postfix config, you'd
better be splitting that up. F.i. using a multi instance setup in
Postfix, thus having a dedicated mailing list instance.

Regards,
        Tom



------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user

signature.asc (902 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Rick Leir
On Tue, 2014-05-06 at 09:30 +0200, Tom Hendrikx wrote:
You can retrain if it was a FP by using that available header.

Thanks Tom, your explanation was a big help!  Can you expand on 'available header' please?  We retrain using  a script that calls
    /usr/bin/dspam --client --user $SUDO_USER@$(hostname -d) --class=$1 --source=error

Rick Leir, Senior Developer
http://CirrusComputing.com/ 





------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Tom Hendrikx
Hi Rick,

You should just make sure that at all times, only one dspam header is
available. After the message targeted at the mailinglist is received by
postfix, classified by DSPAM and handed of to the mailing list software,
it should have DSPAM headers in there, right?

On 05/06/2014 09:49 AM, Rick Leir wrote:

> On Tue, 2014-05-06 at 09:30 +0200, Tom Hendrikx wrote:
>> Youcan retrain if it was a FP by using that available header.
>
> Thanks Tom, your explanation was a big help!  Can you expand on
> 'available header' please?  We retrain using  a script that calls
>     /usr/bin/dspam --client --user $SUDO_USER@$(hostname -d) --class=$1
> --source=error
>
> Rick Leir, Senior Developer
> http://CirrusComputing.com/ 
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
> • 3 signs your SCM is hindering your productivity
> • Requirements for releasing software faster
> • Expert tips and advice for migrating your SCM now
> http://p.sf.net/sfu/perforce
>
>
>
> _______________________________________________
> Dspam-user mailing list
> [hidden email]
> https://lists.sourceforge.net/lists/listinfo/dspam-user
>


------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user

signature.asc (902 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Rick Leir
On Tue, 2014-05-06 at 10:03 +0200, Tom Hendrikx wrote:
Hi Rick,

You should just make sure that at all times, only one dspam header is
available. After the message targeted at the mailinglist is received by
postfix, classified by DSPAM and handed of to the mailing list software,
it should have DSPAM headers in there, right?
Recap: two or more sets of dspam headers are on messages that came to us via local mailing lists (local meaning that mailman is on the same server as postfix).  The duplicate headers made it impossible to retrain a message.

The fix: in main.cf, add the line:
   header_checks = regexp:/etc/postfix/header_checks.regexp

Create the header_checks.regexp file containing:

/^(X-DSPAM-Resu[A-z]*): (.+)$/ REPLACE X-prev${1}: ${2}
/^(X-DSPAM-Proc[A-z]*): (.+)$/ REPLACE X-prev${1}: ${2}
/^(X-DSPAM-Conf[A-z]*): (.+)$/ REPLACE X-prev${1}: ${2}
/^(X-DSPAM-Prob[A-z]*): (.+)$/ REPLACE X-prev${1}: ${2}
/^(X-DSPAM-Sign[A-z]*): (.+)$/ REPLACE X-prev${1}: ${2}

Restart postfix.
Tom, thanks so much.
_______________________________________________ Dspam-user mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/dspam-user

Rick Leir, Senior Developer
http://CirrusComputing.com/ 





------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Rick Leir
In reply to this post by Tom Hendrikx
On Tue, 2014-05-06 at 09:30 +0200, Tom Hendrikx wrote:
checks to rename DSPAM headers to X-External-Dspam-blahblah to make sure
they don't mess up my system. You should also do this before the mailing
list gets external mail, since some people setup DSPAM for outgoing mail
too, but still add headers.
Good plan, we will go with this.  It sounds as if all dspam installations should be renaming headers, so maybe it should be built into dspam. I did not see it in the doco, tho I admit I was reading too fast at the time.

Rick Leir, Senior Developer
http://CirrusComputing.com/ 





------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Tom Hendrikx
On 05/08/2014 12:39 PM, Rick Leir wrote:
> On Tue, 2014-05-06 at 09:30 +0200, Tom Hendrikx wrote:
>> checks to rename DSPAM headers to X-External-Dspam-blahblah to make sure
>> they don't mess up my system. You should also do this before the mailing
>> list gets external mail, since some people setup DSPAM for outgoing mail
>> too, but still add headers.
> Good plan, we will go with this.  It sounds as if all dspam
> installations should be renaming headers, so maybe it should be built
> into dspam. I did not see it in the doco, tho I admit I was reading too
> fast at the time.

Hi,

Dspam doesn't do this. OTOH, dspam-milter does strip those headers (not
renaming them, though) :)

Tom


------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user

signature.asc (902 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: [Dspam-user] scanned several times

Rick Leir
On Thu, 2014-05-08 at 13:18 +0200, Tom Hendrikx wrote:
On 05/08/2014 12:39 PM, Rick Leir wrote:
> On Tue, 2014-05-06 at 09:30 +0200, Tom Hendrikx wrote:
>> checks to rename DSPAM headers to X-External-Dspam-blahblah to make sure
>> they don't mess up my system. You should also do this before the mailing
>> list gets external mail, since some people setup DSPAM for outgoing mail
>> too, but still add headers.
> Good plan, we will go with this.  It sounds as if all dspam
> installations should be renaming headers, so maybe it should be built
> into dspam. I did not see it in the doco, tho I admit I was reading too
> fast at the time.

Hi,

Dspam doesn't do this. OTOH, dspam-milter does strip those headers (not
renaming them, though) :)
dspam-milter seems to have a history going back to 2012.  Our system was set up before then.  Does it have advantages other than stripping out headers?  Yes! Now I found your announcement (thanks!) at
http://comments.gmane.org/gmane.mail.spam.dspam.user/19003

Tom
Rick Leir, Senior Developer
http://CirrusComputing.com/ 





------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
• 3 signs your SCM is hindering your productivity
• Requirements for releasing software faster
• Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Dspam-user mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/dspam-user
Loading...