[SAtalk] SA with Communigate Pro 3.5.9

[Todd Schuldt]

I have found out through other sources that SA strips out the envelope-to header when it creates it’s new message when report-safe is turned on – why in heaven does it do that????  It’s not like SA needs to strip it out in order to change the message….   Todd   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Schuldt Sent: Thursday, July 17, 2003 2:14 PM To: [EMAIL PROTECTED] Subject: [SAtalk] SA with Communigate Pro 3.5.9   Is there a setting I missed either in CGP, scanspam.sh or spamassassin/local.cf?   ----------------------- System Red Hat 7.3/Communigate Pro 3.5.9   Test method:  Personal account on giant.net using pine to send mail test message with +5.00 score.  Local domain address in TO: field.  CC field contains personal account #2 on Yahoo.com domain.  Note: all email references below are not the actual account names.   After following the instructions for adding SpamAssassin to CGP located at http://www.communigatefaq.com/cgatefaq/SpamAssassin it still exhibits the behavior of relaying the spam to non-local domain accounts when the spam trigger threshold is reached and a spam alert message is generated.  If the threshold is not exceeded the system behaves normally and simply adds the x-headers to the inbound message.  Apparently this potential exists because of SA's use of the PIPE area to resubmit the modified message.  PIPE is considered a local client and CGP apparently reprocesses the file as outbound using the server-wide rules or my SA is not correctly re-identifying the file as inbound only once it places it back in PIPE.   Exact rules used:   Data: Header-field - is not - X-Spam-Status* Any Recipient - in - [EMAIL PROTECTED]     ; So only this account has SA access til this is solved, will be [EMAIL PROTECTED] Message size - is less than - 250000 Any route - is - LOCAL*   Action: Execute, [STDERR] [FILE] [RETPATH] [RCPT] /var/CommuniGate/scanspam.sh Discard     ** Original message is received via CC by [EMAIL PROTECTED] from [EMAIL PROTECTED] then 15 seconds later this one arrives at [EMAIL PROTECTED] from my server:   X-Apparently-To: [EMAIL PROTECTED] via 216.136.224.79; 17 Jul 2003 11:36:14 -0700 (PDT) Return-Path: <[EMAIL PROTECTED]> Received: from 66.133.81.240 (EHLO ised.org) (66.133.81.240) by mta181.mail.scd.yahoo.com with SMTP; 17 Jul 2003 11:36:13 -0700 (PDT) Received: by ised.org (CommuniGate Pro PIPE 4.0.6) with PIPE id 887019; Thu, 17 Jul 2003 13:36:13 -0500 Received: from localhost [127.0.0.1] by ised.org with SpamAssassin (2.55 1.174.2.19-2003-05-19-exp); Thu, 17 Jul 2003 13:35:59 -0500 From: [EMAIL PROTECTED] | This is spam | Add to Address Book To: [EMAIL PROTECTED] CC: [EMAIL PROTECTED] Subject:  *****SPAM***** HELLO Date: Thu, 17 Jul 2003 13:48:09 -0500 (CDT) Message-Id: <[EMAIL PROTECTED]> X-Spam-Flag: YES X-Spam-Status: Yes, hits=21.2 required=5.0 tests=CANNOT_BE_SPAM,EXCUSE_15,HR_3113,IMPOTENCE,MORTGAGE_PITCH, MORTGAGE_RATES,NO_EXPERIENCE,NO_REAL_NAME,PENIS_ENLARGE, TAKE_ACTION_NOW,THIS_AINT_SPAM,WE_HATE_SPAM,WORK_AT_HOME version=2.55 X-Spam-Level: ********************* X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_3F16EC8F.46609FB4"   This mail is probably spam.  The original message has been attached along with this report, so you can recognize or block similar unwanted mail in future.  See http://spamassassin.org/tag/ for more details. * snip rest *