Spamassassin (via procmail) is not checking for Spam, Viruses

Virtualmin
1

I have enabled spam and virus checking but messages do not get checked. The SA headers do not show up.

I have enabled spam checking for the server and user.
Globally I enabled SpamAssassin Server and ClamAV Server

It seems /etc/procmailrc does not enter the domain specific procmailrc in /etc/webmin/virtual-server/procmail/ folder

Help on fixing this is highly appreciated :smiley:

SYSTEM INFORMATION
OS type and version Debian Linux 10
Webmin version 2.021
Virtualmin version 7.7 Pro
Related packages SUGGESTED
2

I have done some fiddling around with logging in procmailrc and found it may have to do with: “< /dev/null” needed for lookup-domain.pl . Variable VIRTUALMIN is never assigned.
@staff Is there a way to overcome this error?

:0 wi
VIRTUALMIN=|/etc/webmin/virtual-server/lookup-domain.pl $LOGNAME < /dev/null
EXITCODE=$?
:0 wi
* RESULT=|logger --tag ‘pm’ --stderr “ln:${LOGNAME}, vm:${VIRTUALMIN}”
:0
* ?/usr/bin/test “$EXITCODE” = “73”

Adrie

3

Does anything useful get logged to /var/log/procmail.log when you receive email?

4

It showed that VIRTUALMIN did not get an id assigned.

I have put a shell wrapper around lookup-domain.pl to overcome the use of the redirect of stdin and lo-and-behold now virtualmin id’s are visible for LOGNAME’s with spanscanning enabled.

wrapper: /usr/local/bin/lookup-domain.sh

#!/bin/sh

exec /etc/webmin/virtual-server/lookup-domain.pl "$@" </dev/null

Modified procmailrc

VIRTUALMIN=|/usr/local/bin/lookup-domain.sh $LOGNAME
---
VIRTUALMIN=|/etc/webmin/virtual-server/lookup-domain.pl $LOGNAME < /dev/null

logs in procmail.log

<13>Jun  3 19:55:59 pm: ln:post-rcan.nl, vm:151351812522082
From bounce+0945cd.01f960-virtuminprof=rcan.nl@forum.virtualmin.com  Sat Jun  3 19:55:57 2023
 Subject: Spamassassin (via procmail) is not checking for Spam, Viruses
  Folder: /usr/lib/dovecot/deliver                                         7484
Time:1685814960 From:noreply@forum.virtualmin.com To:virtuminprof@rcan.nl User:post-rcan.nl Size:7484 Dest:/usr/lib/dovecot/deliver Mode:None
5

Why is Dovecot’s LDA showing up in this?

6

It’s odd that the </dev/null is needed, because the lookup-domain command really does need to take the email as input in order to check the total size and potentially reject the message if the user is over quota.

Unless perhaps in your case the recipient is running out of quota??

7

The < /dev/null was there already, not added by me.
When I run lookup-domain.pl from the shell it waits for input from stdin and entering Ctl-d or adding < /dev/null is needed.

Feeding the e-mail to lookup-domain.pl seems odd to me for a lookup-domain function (?).

Anyway, are you suggesting I remove < /dev/null ?

PS. No the recipient are not running out of quota.

8

Interesting question.

It does help to see what is processed at delivery

9

The </dev/null shouldn’t be needed in /etc/procmailrc , and Virtualmin doesn’t add it. The line should be something like :

VIRTUALMIN=|/etc/webmin/virtual-server/lookup-domain.pl --exitcode 73 $LOGNAME

The lookup-domain command actually does more than looking up a domain, which is why it needs the email as input (which Procmail provides).

10

Jamie, thanks for your input. That is working fine.

Which is popping up another question, because few messages are captured. To help scanning I forward messages to spamtrap@

Will this do or should I feed it differently to that address?

11

No, forwarding to that address is fine!

12

That’s nice.

Is there any logs of the workings of the spam-/hamtrap ? The sa-learn dump does not increment counters of nspam or nham the n I feed junk.
If I execute sa-learn from the shell I can see it incrementing nspam counter.

13

You can run the spamtrap processor in debug mode by running /etc/webmin/virtual-server/spamtrap.pl --debug as root

14

Thanks.

I looked at it and I think it is not executing it well.
The logs show that sa-learn is considering the address I forward the message from and the recipient : spamtrap@, not the original sender and recipient.
It indicates that the message is learnt as spam but I doubt it means the original message. I als forwarded as attachment but that looks similar.

15

How did you do the forwarding exactly? The issue might be that we’re not extracting the original address from forwarded emails correctly


16

I forward the message via the IOS or macOS Mail client. The latter I tried forwarding as attachment but that did not change behaviour.

It would be nice to have a folder watched by sa-learn to drag spam to.

17

Can you post the logs you’re getting from spamtrap.pl that show the wrong address?

18

Sent you with DM

19

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.