Userberechtigungen bei Spamassassin und Amavis

[ghostadmin]

Beim X-Header fehlt Bayes und Razor/Pyzor kommt ganz selten.

Typisch z.B.

X-Spam-Status: No, score=-0.1 required=3 tests=[DKIM_SIGNED=0.1,
	DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001,
	LOTS_OF_MONEY=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001]
	autolearn=unavailable

In /etc/cron.daily/spamassassin (steht standardmäßig so drin)

su debian-spamd -c "sa-update --gpghomedir /var/lib/spamassassin/sa-update-keys"

/var/lib/spamassassin/

ls -l 
insgesamt 8
drwxr-xr-x 3 debian-spamd debian-spamd 4096 Jun 15 14:37 3.003002
drwx------ 2 debian-spamd debian-spamd 4096 Jun 15 14:37 sa-update-keys

/etc/default/spamassassin (da habe ich -u amavis hinzugefügt)

OPTIONS="-u amavis --create-prefs --max-children 5 -H /etc/spamassassin -s /var/log/spamd/spamd.log"

ps aux | grep spamd

root      3963  0.0  1.8  44676 37432 ?        Ss   Mai29   5:19 /usr/sbin/spamd -u amavis --create-prefs --max-children 5 -H /etc/spamassassin -s /var/log/spamd/spamd.log -d --pidfile=/var/run/spamd.pid
amavis    3968  0.0  1.7  44676 35316 ?        S    Mai29   0:02 spamd child
amavis    3969  0.0  1.7  44676 35316 ?        S    Mai29   0:01 spamd child

/etc/spamassassin/local.cf

use_bayes 1
bayes_auto_learn 1
bayes_path /var/lib/amavis/.spamassassin/bayes
use_pyzor 1
pyzor_options --homedir /etc/spamassassin
use_razor2 1
razor_config /etc/spamassassin/razor/razor-agent.conf

/etc/spamassassin/razor/razor-agent.conf

....
..
razorhome = /etc/spamassassin/razor

/etc/spamassasin

-rw-r--r-- 1 amavis root  939 Jan  1  2010 65_debian.cf
-rw-r--r-- 1 amavis root 1299 Jan  1  2010 init.pre
-rw-r--r-- 1 amavis root 2288 Jun 15 14:18 local.cf
-rw-r--r-- 1 amavis root 2214 Mär 25  2010 local.cf.dpkg-dist
drwxr-xr-x 2 amavis root 4096 Jun 15 15:18 razor
drwxr-xr-x 2 amavis root 4096 Aug 25  2013 sa-update-hooks.d
drwx------ 2 amavis root 4096 Aug 30  2013 sa-update-keys
-rw------- 1 amavis root   23 Dez  1  2013 servers
-rw-r--r-- 1 amavis root 2524 Mai 29 09:39 v310.pre
-rw-r--r-- 1 amavis root 1194 Mär 25  2010 v312.pre
-rw-r--r-- 1 amavis root 2416 Jan  1  2010 v320.pre
-rw-r--r-- 1 amavis root 1237 Mär 25  2010 v330.pre

echo "ENLARGE YOUR PENIS" | spamc
Received: from localhost by server.intern.net
        with SpamAssassin (version 3.3.2);
        Sun, 15 Jun 2014 17:32:48 +0200
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on server.intern.net
X-Spam-Flag: YES
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.9 required=5.0 tests=EMPTY_MESSAGE,MISSING_DATE,
        MISSING_FROM,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,NO_HEADERS_MESSAGE,
        NO_RECEIVED,NO_RELAYS autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_539DBCA0.1E5391B5"

This is a multi-part message in MIME format.

------------=_539DBCA0.1E5391B5
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Software zur Erkennung von "Spam" auf dem Rechner

    server.intern.net

hat die eingegangene E-mail als m?gliche "Spam"-Nachricht identifiziert.
Die urspr?ngliche Nachricht wurde an diesen Bericht angeh?ngt, so dass
Sie sie anschauen k?nnen (falls es doch eine legitime E-Mail ist) oder
?hnliche unerw?nschte Nachrichten in Zukunft markieren k?nnen.
Bei Fragen zu diesem Vorgang wenden Sie sich bitte an

    the administrator of that system

Vorschau: [...]

Inhaltsanalyse im Detail:   (7.9 Punkte, 5.0 ben?tigt)

Pkte Regelname              Beschreibung
---- ---------------------- --------------------------------------------------
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
 1.2 MISSING_HEADERS        Empf?ngeradresse ("To") fehlt
 0.1 MISSING_MID            Missing Message-Id: header
 1.8 MISSING_SUBJECT        Betreff ("Subject") fehlt
 2.3 EMPTY_MESSAGE          Message appears to have no textual parts and no
                            Subject: text
 1.0 MISSING_FROM           Missing From: header
-0.0 NO_RECEIVED            Informational: message has no Received headers
 1.4 MISSING_DATE           Datumskopfzeile fehlt
 0.0 NO_HEADERS_MESSAGE     Message appears to be missing most RFC-822 headers



------------=_539DBCA0.1E5391B5
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

ENLARGE YOUR PENIS

------------=_539DBCA0.1E5391B5--

spamassassin -D < /usr/share/doc/spamassassin/examples/sample-spam.txt

Jun 15 17:40:07.800 [8834] dbg: learn: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1
Jun 15 17:40:07.800 [8834] dbg: learn: auto-learn: message score: 1004.89, computed score for autolearn: 1.985
Jun 15 17:40:07.801 [8834] dbg: learn: auto-learn? ham=0.1, spam=12, body-points=1.985, head-points=1.985, learned-points=3.5
Jun 15 17:40:07.801 [8834] dbg: learn: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
Jun 15 17:40:07.802 [8834] dbg: check: is spam? score=1004.89 required=5
Jun 15 17:40:07.803 [8834] dbg: check: tests=BAYES_99,GTUBE,NO_RECEIVED,NO_RELAYS,PYZOR_CHECK
Jun 15 17:40:07.803 [8834] dbg: check: subtests=__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTE,__CT_TEXT_PLAIN,__DKIM_DEPENDABLE,__FILL_THIS_FORM_PARTIAL_RAW,__GATED_THROUGH_RCVD_REMOVER,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MSGID,__HAS_SUBJECT,__HAS_TO,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_OK_HOST,__NONEMPTY_BODY,__NOT_A_PERSON,__NOT_SPOOFED,__SANE_MSGID,__SENDER_BOT,__TOCC_EXISTS,__TO_EQ_FROM_DOM,__TO_EQ_FROM_DOM_1,__TVD_MIME_ATT_TP,__UNUSABLE_MSGID
Jun 15 17:40:07.805 [8834] dbg: timing: total 6515 ms - init: 4405 (67.6%), parse: 3 (0.0%), extract_message_metadata: 55 (0.8%), get_uri_detail_list: 1.53 (0.0%), tests_pri_-1000: 30 (0.5%), compile_gen: 384 (5.9%), compile_eval: 100 (1.5%), tests_pri_-950: 24 (0.4%), tests_pri_-900: 25 (0.4%), tests_pri_-400: 54 (0.8%), check_bayes: 30 (0.5%), tests_pri_0: 1683 (25.8%), dkim_load_modules: 93 (1.4%), check_dkim_signature: 2 (0.0%), check_dkim_adsp: 165 (2.5%), check_spf: 67 (1.0%), check_razor2: 345 (5.3%), check_pyzor: 187 (2.9%), tests_pri_500: 220 (3.4%)
Received: from localhost by server.intern.net
        with SpamAssassin (version 3.3.2);
        Sun, 15 Jun 2014 17:40:07 +0200
From: Sender <sender@example.net>
To: Recipient <recipient@example.net>
Subject: Test spam mail (GTUBE)
Date: Wed, 23 Jul 2003 23:30:00 +0200
Message-Id: <GTUBE1.1010101@example.net>
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on server.intern.net
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=1004.9 required=5.0 tests=BAYES_99,GTUBE,NO_RECEIVED,
        NO_RELAYS,PYZOR_CHECK autolearn=no version=3.3.2
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_539DBE57.175E078D"

This is a multi-part message in MIME format.

------------=_539DBE57.175E078D
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Software zur Erkennung von "Spam" auf dem Rechner

    server.intern.net

hat die eingegangene E-mail als m?gliche "Spam"-Nachricht identifiziert.
Die urspr?ngliche Nachricht wurde an diesen Bericht angeh?ngt, so dass
Sie sie anschauen k?nnen (falls es doch eine legitime E-Mail ist) oder
?hnliche unerw?nschte Nachrichten in Zukunft markieren k?nnen.
Bei Fragen zu diesem Vorgang wenden Sie sich bitte an

    the administrator of that system

Vorschau: This is the GTUBE, the Generic Test for Unsolicited Bulk Email
   If your spam filter supports it, the GTUBE provides a test by which you can
   verify that the filter is installed correctly and is detecting incoming spam.
   You can send yourself a test mail containing the following string of characters
   (in upper case and with no white spaces and line breaks): [...]

Inhaltsanalyse im Detail:   (1004.9 Punkte, 5.0 ben?tigt)

Pkte Regelname              Beschreibung
---- ---------------------- --------------------------------------------------
 3.5 BAYES_99               BODY: Spamwahrscheinlichkeit nach Bayes-Test: 99-100%
                            [score: 0.9978]
-0.0 NO_RELAYS              Informational: message was not relayed via SMTP
1000 GTUBE                  BODY: Test zur Pr?fung von Anti-Spam-Software
 1.4 PYZOR_CHECK            Gelistet im Pyzor-System (http://pyzor.sf.net/)
-0.0 NO_RECEIVED            Informational: message has no Received headers

Lasse ich obiges mit user amavis laufen:

Jun 15 17:48:45.282 [9766] dbg: bayes: tie-ing to DB file R/O /var/lib/amavis/.spamassassin/bayes_toks
Jun 15 17:48:45.283 [9766] warn: bayes: cannot open bayes databases /var/lib/amavis/.spamassassin/bayes_* R/O: tie failed: Keine Berechtigung

/var/lib/amavis/.spamassasin

ls -l
insgesamt 5340
-rw------- 1 root   root       552 Jun 15 17:40 bayes_journal
-rw------- 1 amavis amavis 1343488 Jun 15 02:49 bayes_seen
-rw------- 1 root   root   5107712 Jun 15 17:37 bayes_toks
-rw-r--r-- 1 amavis amavis    1869 Aug 25  2013 user_prefs

Damit gleichzeitig von sa-learn auf Mails und bayes db zugegriffen werden kann, wird via cron von root folgendes ausgeführt:

sa-learn --no-sync --spam ...
sa-learn --no-sync --ham ...
sa-lwarn --sync

Wie müssen die Berechtigungen verteilt werden?
Folgende User sind involviert:
root
amavis
debian-spamd
vmail <- virtual user der mails speichert

---------- Beitrag hinzugefügt um 23:46 ---------- Vorheriger Beitrag um 17:57 ----------

Hab die bayes files erstmal auf user amavis geändert. Bis jetzt tuts.