Topic: Spam Assassin & Amavis-ng + Clam Antivirus

[trevor]

Hello Everyone... I'm hoping someone out there can help me figure out what's going on. I just got done rebuilding my e-smith (SME) box with 6.0b3. I've installed a number of contribs including SpamAssassin 2.60 and Amavis-ng + Clam Antivirus. Both programs are working great -- just not together!

When I have SpamAssassin enabled through the web panel it works very well.

     X-Spam-Flag: YES
     X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
     X-Spam-Report:
   *  0.9 FROM_ENDS_IN_NUMS From: ends in numbers
   *  0.1 SUBJ_FREE_CAP Subject contains "FREE" in CAPS
   *  2.4 SUBJ_GUARANTEED Subject GUARANTEED
   *  0.5 SUB_FREE_OFFER Subject starts with "Free"
   *  1.1 BANG_GUARANTEE BODY: Something is emphatically guaranteed
   *  0.0 LINES_OF_YELLING BODY: A WHOLE LINE OF     YELLING DETECTED
   *  0.6 SUBJ_ALL_CAPS Subject is all capitals
   *  0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
   *      [65.31.221.187 listed in dnsbl.sorbs.net]
   *  2.5 RCVD_IN_DYNABLOCK RBL: Sent directly from dynamic      IP address
   *      [Dynamic/Residential IP range listed by]
   [easynet.nl DynaBlock - http://dynablock.easynet.nl/errors.html]
   *  1.3 PLING_PLING Subject has lots of exclamation marks
   *  0.4 MANY_EXCLAMATIONS Subject has many exclamations
   *  0.3 UPPERCASE_25_50 message body is 25-50% uppercase
     X-Spam-Status: Yes, hits=10.1 required=5.0      tests=BANG_GUARANTEE,
FROM_ENDS_IN_NUMS,LINES_OF_YELLING,MANY_EXCLAMATIONS,PLING_PLING,
RCVD_IN_DYNABLOCK,RCVD_IN_SORBS,SUBJ_ALL_CAPS,SUBJ_FREE_CAP,
SUBJ_GUARANTEED,SUB_FREE_OFFER,UPPERCASE_25_50      autolearn=no
   version=2.60
     X-Spam-Level: **********


When SpamAssassin is disabled, Clam works like's it's supposed to:  
     X-Virus-Scanned: by amavis-ng-0.1.6.4-03dc on


There is nothing unusual in the Clam logs but in the maillog I see these entries:

     spamd[9449]: info: setuid to qmaild succeeded
     spamd[9449]: Creating default_prefs [/var/qmail/.spamassassin/user_prefs]
     spamd[9449]: Cannot write to /var/qmail/.spamassassin/user_prefs: No such file or directory
     spamd[9449]: Couldn't create readable default_prefs for [/var/qmail/.spamassassin/user_prefs]
     spamd[9449]: processing message <20031123032342.25757.qmail@web40805.mail.yahoo.com> for     qmaild:401.
     spamd[9449]: identified spam (10.0/5.0) for qmaild:401 in 4.3 seconds, 671 bytes.
     spamd[2409]: connection from localhost [127.0.0.1] at port 33607
     spamd[9647]: info: setuid to qmaild succeeded
     spamd[9647]: Creating default_prefs [/var/qmail/.spamassassin/user_prefs]
     spamd[9647]: Cannot write to /var/qmail/.spamassassin/user_prefs: No such file or directory
     spamd[9647]: Couldn't create readable default_prefs for [/var/qmail/.spamassassin/user_prefs]
     spamd[9647]: processing message <20031123032911.36830.qmail@web40811.mail.yahoo.com> for qmaild:401.
     spamd[9647]: identified spam (10.1/5.0) for qmaild:401 in 1.6 seconds, 683 bytes.


Any ideas if this is the problem? Any help would be greatly appreciated!!!

Thanks.  (sorry this is long -- want to make sure all the info is here)


------------------------------------------------
Here are the RPM's I'm using:
     perl-Mail-SpamAssassin-2.60-1.i386.rpm
     spamassassin-2.60-1.i386.rpm
     spamassassin-tools-2.60-1.i386.rpm
     e-smith-spamassassin-0.6.2beta-1jp2.60.noarch.rpm (web panel)

     ALL RPM's listed at http://pagefault.org/howto/amavis_clam.shtml
     clamav-0.60-p13.i386.rpm
     clamav-libs-0.60-p13.i386.rpm

     perl-Archive-Tar-1.02-1.i386.rpm
     perl-Archive-Zip-1.05-1.i386.rpm
     perl-Compress-Zlib-1.21-1.i386.rpm
     perl-Config-IniFiles-2.38-1.i386.rpm
     perl-Convert-TNEF-0.17-1.i386.rpm
     perl-Convert-UUlib-0.31-1.i386.rpm
     perl-File-MMagic-1.19-1.i386.rpm
     perl-IO-stringy-2.108-1.i386.rpm
     perl-MIME-tools-5.411a-1.i386.rpm
     perl-libnet-1.13-1.i386.rpm
     arc-5.21e-4.i386.rpm
     lha-1.14i-4.2rm.i386.rpm
     unarj-2.43-6.1rm.i386.rpm
     unrar-2.71-1.1rm.i386.rpm
     zoo-2.10-4.1rm.i386.rpm
------------------------------------------------

[Shane]

You need to edit your "amavis.conf" and change line 56 ( or there abouts) to read

qmail-queue = /var/qmail/bin/qmail-spamc

This will allow the message to be virus scanned then handed to SA.

[Trevor]

That was it.  You ROCK!!!  Thanks!

[Lloyd Keen]

Trev,
Where did you get the e-smith spamassassin rpm from??

[Trevor]

SpamAssassin RPM's:
http://spamassassin.org/released/RPMs/
(Ref: http://spamassassin.org/downloads.html)

e-smith web panel:
http://mirror.contribs.org/smeserver/contribs/mblotwijk/Contribs/SpamAssassin/

This is on sme 6.0b3 -- don't know if it will work on previous version though I think I read in a post it will.

[Ruthy Camden]

Hi Trevor,

Thanks for posting your experience on SA & Amavis -ng.

Where can I find the Amavis rpm?

Regards,
Ruthy

[Noz]

> Where can I find the Amavis rpm?

Excellent howto / rpms here...
www.pagefault.org

Installed last night on 6.0B3.  Works on 5.6 too
NTB
8o)

[Lloyd Keen]

Thanks Shane for the tip on editing the amavis.conf file, it's been bugging me for a while and thanks Trev for the pointer to the latest S/A web panel (and for starting this thread). I did ask this same question a while ago but couldn't resolve it see http://forums.contribs.org/index.php?topic=18796.msg74184#msg74184. Anyway, thanks guys.

[Shane]

Esmith makes a great mail toaster as you now know.

Glad to be a help