Here is the log. I don't have the message, but as you can see it did not
match the blacklist.
-------log------
Apr 24 04:39:43 mail postfix/smtpd[25746]: connect from
castile.calmra.com[72.11.146.117]
Apr 24 04:39:44 mail postfix/smtpd[25746]: AE20883C:
client=castile.calmra.com[72.11.146.117]
Apr 24 04:39:45 mail postfix/cleanup[26437]: AE20883C:
message-id=<[EMAIL PROTECTED]>
Apr 24 04:39:45 mail postfix/qmgr[4304]: AE20883C:
from=<[EMAIL PROTECTED]>, size=2034, nrcpt=1 (queue active)
Apr 24 04:39:45 mail spamd[14218]: connection from localhost.localdomain
[127.0.0.1] at port 48918
Apr 24 04:39:45 mail spamd[14218]: info: setuid to filter succeeded
Apr 24 04:39:45 mail spamd[14218]: processing message
<[EMAIL PROTECTED]> for filter:501.
Apr 24 04:39:46 mail spamd[14218]: clean message (4.8/5.0) for
filter:501 in 1.2 seconds, 2000 bytes.
Apr 24 04:39:46 mail spamd[14218]: result: . 4 -
ALL_TRUSTED,AWL,BAYES_20,DNS_FROM_AHBL_RHSBL,HTML_50_60,HTML_IMAGE_ONLY_
12,HTML_IMAGE_RATIO_02,HTML_MESSAGE,MIME_HTML_MOSTLY,MPART_ALT_DIFF,URIB
L_OB_SURBL,URIBL_SBL,URIBL_WS_SURBL
scantime=1.2,size=2000,mid=<[EMAIL PROTECTED]>,bayes=0.0627053670
923895,autolearn=no
----local.cf snippet----
blacklist_from [EMAIL PROTECTED]
SA is being called from Postfix using spamc.sh which calls spamc. The
script is a slightly modified version of the one outlined on Advosys.ca.
Spamd is launched via an init.d script "spamd -d -c -m5".
----master.cf snippet-----
10.1.1.1:smtp inet n - n - - smtpd
-o content_filter=filter
filter unix - n n - - pipe
flags=Rq user=filter argv=/usr/local/bin/spamc.sh -f ${sender} --
${recipient}
----spamc.sh snippet-----
cat | /usr/bin/spamc -f -u filter
Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant
Buchanan Associates - People. Process. Technology.
-----Original Message-----
From: Craig McLean [mailto:[EMAIL PROTECTED]
Sent: Friday, April 29, 2005 10:50 AM
To: Ron Shuck
Cc: users@spamassassin.apache.org
Subject: Re: Blacklist Not Working
*** PGP SIGNATURE VERIFICATION ***
*** Status: Good Signature from Invalid Key
*** Alert: Please verify signer's key before trusting signature.
*** Signer: Craig McLean (Local Address) <[EMAIL PROTECTED]>
(0x2D95C09E)
*** Signed: 4/29/2005 10:50:12 AM
*** Verified: 4/29/2005 11:38:55 AM
*** BEGIN PGP VERIFIED MESSAGE ***
Well that looks fine to me. Would it be possible for you to post the
headers from a message that fails to trigger against the blacklist, and
the real line from local.cf that you expect it to hit? Also how is SA
being called (i.e. spamd, milter, procmail..)?
Cheers,
Craig.
Ron Shuck wrote:
| I am using SpamAssassin 3.0.2. I have entries in
| /etc/mail/spamassassin/local.cf like blacklist_from [EMAIL PROTECTED] I
| have restarted SpamAssassin, but I have received messages from
| domain.com and USERS_IN_BLACKLIST is not one of the tests notated in
| the header. I have modified the init.d script for SpamAssassin to
| include -D, and there are no errors in the startup.
|
|
|
| Ron Shuck, CISSP, GCIA, CCSE - Managing Consultant Buchanan Associates
| - People. Process. Technology.
|
| -----Original Message-----
| From: Craig McLean [mailto:[EMAIL PROTECTED]
| Sent: Friday, April 29, 2005 10:30 AM
| To: Ron Shuck
| Cc: users@spamassassin.apache.org
| Subject: Re: Blacklist Not Working
|
| >>> PGP SIGNATURE VERIFICATION ***
| >>> Status: Good Signature from Invalid Key
| >>> Alert: Please verify signer's key before trusting signature.
| >>> Signer: Craig McLean (Local Address) <[EMAIL PROTECTED]>
| (0x2D95C09E)
| >>> Signed: 4/29/2005 10:29:54 AM
| >>> Verified: 4/29/2005 10:30:51 AM
| >>> BEGIN PGP VERIFIED MESSAGE ***
|
| Ron Shuck wrote:
| | Has anyone ever seen a situation where entries in the black_list are
| | not being used or matching?
|
| Yes.
|
| Kind Regards,
| Craig.
| P.S Perhaps you could be more specific?
|
| >>> END PGP VERIFIED MESSAGE ***
|
|
|
*** END PGP VERIFIED MESSAGE ***
