[AMaViS-user] amavis and blacklist senders

Discussion:

(too old to reply)

Stefan Varga

2005-11-03 06:55:06 UTC

Dear amavis users,

My configuration is:
amavisd-new-20040824, with postfix, clamav and spamassassin.

I want to blacklist some sender...i want to use lookup tables for this
purpose..

<cut> # from amavisd.conf
@whitelist_sender_maps = (\%whitelist_sender, \@whitelist_sender_acl,
\$whitelist_sender_re);
@blacklist_sender_maps = (\%blacklist_sender, \@blacklist_sender_acl,
\$blacklist_sender_re);
read_hash(\%whitelist_sender, '/var/amavis/whitelist');
read_hash(\%blacklist_sender, '/var/amavis/blacklist');
</cut>

cat /var/amavis/blacklist
orangemail.sk

I dont want to become mail from orangemail.sk..
but amavisd does not look to blacklist maps..

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) RETURNED FROM SA check, time left: 29 s

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) prolong_timer after spam_scan_SA: remaining time = 480 s

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) spam_scan: hits=0.285 tests=NO_REAL_NAME

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) prolong_timer after spam_scan: remaining time = 480 s

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup: (scalar) matches, result="5"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (spam_kill_level) => true, "***@bisb.sk" matches, result="5", matching_key="(constant:5)"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) header: Received: from sgw01.bis.sk ([127.0.0.1])\n by localhost (sgw01.bis.sk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP\n id 01514-01 for <***@bisb.sk>; Thu, 3 Nov 2005 07:37:38 +0100 (CET)

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup_acl(***@bisb.sk) matches key ".bisb.sk", result=1

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (local_domains) => true, "***@bisb.sk" matches, result="1",matching_key=".bisb.sk"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) query_keys: ***@bisb.sk, imap@, bisb.sk, .bisb.sk, .sk, .

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup_hash(***@bisb.sk), no matches

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (bypass_virus_checks) => undef, "***@bisb.sk" does not match

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) query_keys: ***@bisb.sk, imap@, bisb.sk, .bisb.sk, .sk, .

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup_hash(***@bisb.sk), no matches

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (bypass_spam_checks) => undef, "***@bisb.sk" does not match

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup: (scalar) matches, result="2"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (spam_tag_level) => true, "***@bisb.sk" matches, result="2", matching_key="(constant:2)"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup: (scalar) matches, result="5"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) lookup (spam_tag2_level) => true, "***@bisb.sk" matches, result="5", matching_key="(constant:5)"

Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01) headers CLUSTERING: NEW CLUSTER <***@bisb.sk>: hits=0.285, tag=0, tag2=0, subj=0, subj_u=0, local=1, bl=

Please point my to right configuration of amavis, to easily manage my
blacklist sender lookup tables...
Thank you.
Stefan

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
AMaViS-user mailing list
AMaViS-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Mark.Martinec+ (Mark Martinec)

2005-11-03 11:04:48 UTC

Permalink

Stefan,

Post by Stefan Varga
@whitelist_sender_maps = (\%whitelist_sender, \@whitelist_sender_acl,
\$whitelist_sender_re);
@blacklist_sender_maps = (\%blacklist_sender, \@blacklist_sender_acl,
\$blacklist_sender_re);
read_hash(\%whitelist_sender, '/var/amavis/whitelist');
read_hash(\%blacklist_sender, '/var/amavis/blacklist');
cat /var/amavis/blacklist
orangemail.sk

It looks alright.

Post by Stefan Varga
I dont want to receive mail from orangemail.sk..for example
but amavisd does not look to blacklist maps..
Nov 3 07:37:39 sgw01 amavis[1514]: [ID 702911 mail.info] (01514-01)
RETURNED FROM SA check, time left: 29 s

...

The relevant log entries are before the ones you have shown,
i.e. before the spam scanning occurs.

Post by Stefan Varga
amavisd-new-20040824, with postfix, clamav and spamassassin.

I would recommend to upgrade first to 2.3.3, which (among others) provides
a more informative log report as far as lookups are concerned.

If the problem persists, please send me a log at level 5.
The relevant entries come shortly after virus scanning, e.g.:

prolong_timer after virus_scan: ...
...
lookup (bypass_virus_checks) ...
...
lookup (bypass_spam_checks) ...
...
wbl: checking sender <...>
...
lookup (blacklist_sender) ...

Mark

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
AMaViS-user mailing list
AMaViS-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Elijah Savage

2005-11-03 23:01:42 UTC

Permalink

Post by Mark.Martinec+ (Mark Martinec)
Stefan,

It looks alright.

...
The relevant log entries are before the ones you have shown,
i.e. before the spam scanning occurs.

Post by Stefan Varga
amavisd-new-20040824, with postfix, clamav and spamassassin.

I would recommend to upgrade first to 2.3.3, which (among others) provides
a more informative log report as far as lookups are concerned.
If the problem persists, please send me a log at level 5.
prolong_timer after virus_scan: ...
...
lookup (bypass_virus_checks) ...
...
lookup (bypass_spam_checks) ...
...
wbl: checking sender <...>
...
lookup (blacklist_sender) ...
Mark

Here is how I do it

read_hash(\%whitelist_sender, '/var/amavis/whitelist');
read_hash(\%blacklist_sender, '/var/amavis/blacklist');

#less /var/amavis/blacklist

***@spam.com

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
AMaViS-user mailing list
AMaViS-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/

Elijah Savage

2005-11-03 23:56:13 UTC

Permalink

Post by Elijah Savage

Post by Mark.Martinec+ (Mark Martinec)
Stefan,

It looks alright.

...
The relevant log entries are before the ones you have shown,
i.e. before the spam scanning occurs.

Post by Stefan Varga
amavisd-new-20040824, with postfix, clamav and spamassassin.

I would recommend to upgrade first to 2.3.3, which (among others)
provides
a more informative log report as far as lookups are concerned.
If the problem persists, please send me a log at level 5.
prolong_timer after virus_scan: ...
...
lookup (bypass_virus_checks) ...
...
lookup (bypass_spam_checks) ...
...
wbl: checking sender <...>
...
lookup (blacklist_sender) ...
Mark

Here is how I do it
read_hash(\%whitelist_sender, '/var/amavis/whitelist');
read_hash(\%blacklist_sender, '/var/amavis/blacklist');
#less /var/amavis/blacklist
-------------------------------------------------------

I would also like to add that I rarely use hard blacklist or whitelist
anymore I use the soft whitelist and blacklist, something I learned from
the experts on this list and like it a lot better.

# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING

@score_sender_maps = ({ # a by-recipient hash lookup table,
# results from all matching recipient tables are
summed

'amavis-user-***@lists.sourceforge.net'=> -3.0,

-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
AMaViS-user mailing list
AMaViS-***@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/