AMaViS - A Mail Virus Scanner

Hi Gary,

Gary V <mr88talent@...> ha escrito:

>> $spam_quarantine_to =3D "spam\@$mydomain";
>
> Try the explicit method:
> $spam_quarantine_to =3D 'spam@...';
> (with single quotes when being literal)

Same problem.


>
> What happens if you simply send an email to spam@...?

I can send email to spam@... without problems. AFAIK, the mailbox =20
is working.


>> I've disabled spam/virus/etc check for the spam@... account:
>>
>> @bypass_spam_checks_maps   =3D ( [ "spam@..." ] );
>> ...
>
> Should not need to do this. Mail destined for quarantine should not be
> scanned again (at least not when using Postifx).

Perhaps I need to re-check my postfix config again :-/


>> Is this the correct way to do what I want (basically all spam, viruses
>> to spam@...)?
>
> If you want viruses to go there too, you would have to set:
> $virus_quarantine_to =3D 'spam@...';

I have:

$spam_quarantine_to       =3D
$virus_quarantine_to      =3D
$banned_quarantine_to     =3D
$bad_header_quarantine_to =3D 'spam@...';

>> BTW, this is amavisd-new-2.5.3-r2 running on a Gentoo box.
>>
>
> AFAIK 2.5.3 has not been released

Heh, I'm sorry. It was late...
The installed version is 2.5.2. There was an 2.3.3-r2 available on =20
Gentoo repositories.


> Gary V


Many thanks Gary. I'll recheck everything again.

Oh BTW; Is there a way to see what options are passed to amavis? =20
Something like postfix's "postconf"?


Regards,
Norberto


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

On 8/20/07, Norberto Bensa <nbensa@...> wrote:
> Hi Gary,
>
> Gary V <mr88talent@...> ha escrito:
>
> >> $spam_quarantine_to = "spam\@$mydomain";
> >
> > Try the explicit method:
> > $spam_quarantine_to = 'spam@...';
> > (with single quotes when being literal)
>
> Same problem.

Show the error and a few lines before it.

>
>
> >
> > What happens if you simply send an email to spam@...?
>
> I can send email to spam@... without problems. AFAIK, the mailbox
> is working.
>

Then Postfix should be OK. What have you set these to?

#$virus_quarantine_method          = 'local:virus-%m';     # default
#$spam_quarantine_method           = 'local:spam-%m.gz';   # default
#$banned_files_quarantine_method   = 'local:banned-%m';    # default
#$bad_header_quarantine_method     = 'local:badh-%m';      # default

Leave them at default.

>
> >> I've disabled spam/virus/etc check for the spam@... account:
> >>
> >> @bypass_spam_checks_maps   = ( [ "spam@..." ] );
> >> ...
> >
> > Should not need to do this. Mail destined for quarantine should not be
> > scanned again (at least not when using Postifx).
>
> Perhaps I need to re-check my postfix config again :-/
>

Or not. If you can send mail to spam@... then Postfix should be OK.

>
> >> Is this the correct way to do what I want (basically all spam, viruses
> >> to spam@...)?
> >
> > If you want viruses to go there too, you would have to set:
> > $virus_quarantine_to = 'spam@...';
>
> I have:
>
> $spam_quarantine_to       =
> $virus_quarantine_to      =
> $banned_quarantine_to     =
> $bad_header_quarantine_to = 'spam@...';
>

Should work.

> >> BTW, this is amavisd-new-2.5.3-r2 running on a Gentoo box.
> >>
> >
> > AFAIK 2.5.3 has not been released
>
> Heh, I'm sorry. It was late...
> The installed version is 2.5.2. There was an 2.3.3-r2 available on
> Gentoo repositories.
>
>
> > Gary V
>
>
> Many thanks Gary. I'll recheck everything again.
>
> Oh BTW; Is there a way to see what options are passed to amavis?
> Something like postfix's "postconf"?

http://marc.info/?l=amavis-user&m=117757891604611

>
> Regards,
> Norberto
>

-- 
Gary V

Norberto Bensa <nbensa@...> ha escrito:

>>>
>>> @bypass_spam_checks_maps   = ( [ "spam@..." ] );
>>> ...
>>
>> Should not need to do this. Mail destined for quarantine should not be
>> scanned again (at least not when using Postifx).
>
> Perhaps I need to re-check my postfix config again :-/


It was a combination of $notify_method and a bad postfix configuration.

I had:

$notify_method = 'smtp:[127.0.0.1}:10026';

and in postfix's main.cf:

content_filter = smtp-amavis:[127.0.0.1]:10024

and master.cf

127.0.0.1:10026 inet    n       -       y       -       -       smtpd

with NO "content_filter ="


So content was scanned twice :-/


Everything is working now.

Thanks Gary.


Best regards everyone,
Norberto





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Ot=E1vio,

> How can I have different statistics about inbound and outbound email
> traffic with amavisd-new ? I'm using amavisd-new 2.5.2, postgres 8.1
> and postfix 2.4.3.

# amavisd-agent

=2E..
ContentCleanMsgs                      2326    231/h     9.7 % (InMsgs)
ContentCleanMsgsInbound               1538    153/h    66.1 % (ContentClean=
Msgs)
ContentCleanMsgsInternal               339     34/h    14.6 % (ContentClean=
Msgs)
ContentCleanMsgsOutbound               484     48/h    20.8 % (ContentClean=
Msgs)
ContentCleanTagMsgs                    478     48/h     2.0 % (InMsgs)
ContentCleanTagMsgsInbound             453     45/h    94.8 % (ContentClean=
TagMsgs)
ContentCleanTagMsgsInternal              7      1/h     1.5 % (ContentClean=
TagMsgs)
ContentCleanTagMsgsOutbound             18      2/h     3.8 % (ContentClean=
TagMsgs)
ContentSpamMsgs                      21030   2090/h    87.8 % (InMsgs)
ContentSpamMsgsInbound               20845   2072/h    99.1 % (ContentSpamM=
sgs)
ContentSpamMsgsInternal                 72      7/h     0.3 % (ContentSpamM=
sgs)
ContentSpamMsgsOutbound                113     11/h     0.5 % (ContentSpamM=
sgs)
ContentSpammyMsgs                       32      3/h     0.1 % (InMsgs)
ContentSpammyMsgsInbound                29      3/h    90.6 % (ContentSpamm=
yMsgs)
ContentSpammyMsgsOutbound                3      0/h     9.4 % (ContentSpamm=
yMsgs)
ContentVirusMsgs                        38      4/h     0.2 % (InMsgs)
ContentVirusMsgsInbound                 38      4/h   100.0 % (ContentVirus=
Msgs)
InMsgs                               23943   2379/h   100.0 % (InMsgs)
InMsgsInbound                        22939   2280/h    95.8 % (InMsgs)
InMsgsInternal                         418     42/h     1.7 % (InMsgs)
InMsgsOutbound                         621     62/h     2.6 % (InMsgs)

  Mark

On 8/20/07, Mark Martinec <Mark.Martinec+amavis@...> wrote:
> Ot=E1vio,
>
> > How can I have different statistics about inbound and outbound email
> > traffic with amavisd-new ? I'm using amavisd-new 2.5.2, postgres 8.1
> > and postfix 2.4.3.
>
> # amavisd-agent
>
> ...
> ContentCleanMsgs                      2326    231/h     9.7 % (InMsgs)
> ContentCleanMsgsInbound               1538    153/h    66.1 % (ContentCle=
anMsgs)
> ContentCleanMsgsInternal               339     34/h    14.6 % (ContentCle=
anMsgs)
> ContentCleanMsgsOutbound               484     48/h    20.8 % (ContentCle=
anMsgs)
> ContentCleanTagMsgs                    478     48/h     2.0 % (InMsgs)
> ContentCleanTagMsgsInbound             453     45/h    94.8 % (ContentCle=
anTagMsgs)
> ContentCleanTagMsgsInternal              7      1/h     1.5 % (ContentCle=
anTagMsgs)
> ContentCleanTagMsgsOutbound             18      2/h     3.8 % (ContentCle=
anTagMsgs)
> ContentSpamMsgs                      21030   2090/h    87.8 % (InMsgs)
> ContentSpamMsgsInbound               20845   2072/h    99.1 % (ContentSpa=
mMsgs)
> ContentSpamMsgsInternal                 72      7/h     0.3 % (ContentSpa=
mMsgs)
> ContentSpamMsgsOutbound                113     11/h     0.5 % (ContentSpa=
mMsgs)
> ContentSpammyMsgs                       32      3/h     0.1 % (InMsgs)
> ContentSpammyMsgsInbound                29      3/h    90.6 % (ContentSpa=
mmyMsgs)
> ContentSpammyMsgsOutbound                3      0/h     9.4 % (ContentSpa=
mmyMsgs)
> ContentVirusMsgs                        38      4/h     0.2 % (InMsgs)
> ContentVirusMsgsInbound                 38      4/h   100.0 % (ContentVir=
usMsgs)
> InMsgs                               23943   2379/h   100.0 % (InMsgs)
> InMsgsInbound                        22939   2280/h    95.8 % (InMsgs)
> InMsgsInternal                         418     42/h     1.7 % (InMsgs)
> InMsgsOutbound                         621     62/h     2.6 % (InMsgs)
>
>   Mark
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> AMaViS-user mailing list
> AMaViS-user@...
> https://lists.sourceforge.net/lists/listinfo/amavis-user
> AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
> AMaViS-HowTos:http://www.amavis.org/howto/
>

Mark,

Thank you indeed this is great. But I have one more question: can I
have different rules for inbound and outbound traffic ?

thanks,

--=20
 | --
 | Ot=E1vio Fernandes <otaviof | gmail | com>
 | FreeBSD 6.2 Release && GNU/Linux User: 283.396
 | (( Especial Programa=E7=E3o )) http://geekbr.podcastbrasil.com/
 | --

> For some reason I'm stuggling with this too. At log_level 5 I get:
> 
> Aug 20 11:45:21 mail amavis[1104]: (01104-01) skipping banned check:
> no applicable lookup tables
> Aug 20 11:45:21 mail amavis[1104]: (01104-01) banned check: any=0, all=N (1)
> 
> and mail passes clean.

Indeed the code I've posted is extracted from your excelent docs 
available at: http://www200.pair.com/mecham/spam/ (thanks Gary ;))

I've checked the syntax and it seems ok. In fact, log shows that mails 
are filtered under Amavisd-new, but banned rule doesn't work properly.

At log_level 5 I get exactly the same message aqs you.

:S

Maybe Mark will answer it...

-- 
Thanks,
Jordi Espasa Clofent

On 8/20/07, Jordi Espasa Clofent <jordi.espasa@...> wrote:
> > For some reason I'm stuggling with this too. At log_level 5 I get:
> >
> > Aug 20 11:45:21 mail amavis[1104]: (01104-01) skipping banned check:
> > no applicable lookup tables
> > Aug 20 11:45:21 mail amavis[1104]: (01104-01) banned check: any=0, all=N (1)
> >
> > and mail passes clean.
>
> Indeed the code I've posted is extracted from your excelent docs
> available at: http://www200.pair.com/mecham/spam/ (thanks Gary ;))
>
> I've checked the syntax and it seems ok. In fact, log shows that mails
> are filtered under Amavisd-new, but banned rule doesn't work properly.
>
> At log_level 5 I get exactly the same message aqs you.
>
> :S
>
> Maybe Mark will answer it...
>
> --
> Thanks,
> Jordi Espasa Clofent
>

That particular sample I took directly from:
http://www.ijs.si/software/amavisd/amavisd-new-docs.html#pbanks-ex

I have not tested extensively, but it does not seem to pay any
attention to anything I place in banned_filename_maps

-- 
Gary V

> > I've checked the syntax and it seems ok. In fact, log shows that mails
> > are filtered under Amavisd-new, but banned rule doesn't work properly.
> >
> > At log_level 5 I get exactly the same message aqs you.
> >
> > :S
> >
> > Maybe Mark will answer it...
> >
> > --
> > Thanks,
> > Jordi Espasa Clofent
> >
>
> That particular sample I took directly from:
> http://www.ijs.si/software/amavisd/amavisd-new-docs.html#pbanks-ex
>
> I have not tested extensively, but it does not seem to pay any
> attention to anything I place in banned_filename_maps
>

I had better luck by doing this (for example):

%banned_rules = (
  'BLOCK_EXE' =>  new_RE(
 # block double extensions in names:
   qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
 # blocks MS executable file(1) types:
   qr'^\.(exe|exe-ms)$',
 # block these MIME types
   qr'^application/x-msdownload$'i,
   qr'^application/x-msdos-program$'i,
   ),
 'DEFAULT' => $banned_filename_re,
);

$policy_bank{'MYNETS'} = {
  spam_lovers_maps   => [1],  # don't stop spam
  final_spam_destiny => D_PASS,
  banned_filename_maps => ['BLOCK_EXE'],
};

You have to place these after where $banned_filename_re is set.

-- 
Gary V

> %banned_rules = (
>  'BLOCK_EXE' =>  new_RE(
>  # block double extensions in names:
>   qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
>  # blocks MS executable file(1) types:
>   qr'^\.(exe|exe-ms)$',
>  # block these MIME types
>   qr'^application/x-msdownload$'i,
>   qr'^application/x-msdos-program$'i,
>   ),
>  'DEFAULT' => $banned_filename_re,
> );
>
> $policy_bank{'MYNETS'} = {
>  spam_lovers_maps   => [1],  # don't stop spam
>  final_spam_destiny => D_PASS,
>  banned_filename_maps => ['BLOCK_EXE'],
> };
>

BTW, the spam settings I show here are unrelated. I just grabbed
something available.

-- 
Gary V

Adam Gibson wrote:
> Gary V wrote:
>> (have not tried it though). Make sure your update script is a recent
>> one that tests the downloads before employing them and consider
> 
> This is one of the most important steps IMHO.  I would make sure the 
> script tests the dat files before copying them into place.  The scripts 
> that I have used over the years tests the dat files with the eicar virus 
> test pattern to make sure they work before copying them into place.

This issue here is not whether the virus signature files work or not, it's
whether one of them is corrupted or not.  A corrupted signature file will cause
clamd to silently crash and no longer be available for message scanning.  The
test that needs to be done on ClamAV signature files:

	clamscan --quiet -d /path/to/sigfile

will detect corrupted signature files, and thus can prevent them from being
moved into the production directory.  Most, if not all, of the download scripts
available on the SaneSecurity site
(http://www.sanesecurity.com/clamav/usage.htm) enable this testing prior to usage.

Bill

Bill Landry wrote:
> Adam Gibson wrote:
>> Gary V wrote:
>>> (have not tried it though). Make sure your update script is a recent
>>> one that tests the downloads before employing them and consider
>> This is one of the most important steps IMHO.  I would make sure the 
>> script tests the dat files before copying them into place.  The scripts 
>> that I have used over the years tests the dat files with the eicar virus 
>> test pattern to make sure they work before copying them into place.
> 
> This issue here is not whether the virus signature files work or not, it's
> whether one of them is corrupted or not.  A corrupted signature file will cause
> clamd to silently crash and no longer be available for message scanning.  The
> test that needs to be done on ClamAV signature files:
> 
> 	clamscan --quiet -d /path/to/sigfile
> 
> will detect corrupted signature files, and thus can prevent them from being
> moved into the production directory.  Most, if not all, of the download scripts
> available on the SaneSecurity site
> (http://www.sanesecurity.com/clamav/usage.htm) enable this testing prior to usage.
> 
> Bill

I think we are saying the same thing.  By checking to make sure it
detects eicar before copying the dat files over it also makes sure the
dat files are not corrupt.  The dat files are initially downloaded to a 
temporary staging area which does not impact the running clamd.  Only 
after testing the dat files to see if they properly detect the eicar 
test virus do they get copied into the default clam dat signature 
database directory.  This solves both problems at the same time.

Adam Gibson wrote:
> Bill Landry wrote:
>> Adam Gibson wrote:
>>> Gary V wrote:
>>>> (have not tried it though). Make sure your update script is a recent
>>>> one that tests the downloads before employing them and consider
>>> This is one of the most important steps IMHO.  I would make sure the 
>>> script tests the dat files before copying them into place.  The scripts 
>>> that I have used over the years tests the dat files with the eicar virus 
>>> test pattern to make sure they work before copying them into place.
>> This issue here is not whether the virus signature files work or not, it's
>> whether one of them is corrupted or not.  A corrupted signature file will cause
>> clamd to silently crash and no longer be available for message scanning.  The
>> test that needs to be done on ClamAV signature files:
>>
>> 	clamscan --quiet -d /path/to/sigfile
>>
>> will detect corrupted signature files, and thus can prevent them from being
>> moved into the production directory.  Most, if not all, of the download scripts
>> available on the SaneSecurity site
>> (http://www.sanesecurity.com/clamav/usage.htm) enable this testing prior to usage.
>>
>> Bill
> 
> I think we are saying the same thing.  By checking to make sure it
> detects eicar before copying the dat files over it also makes sure the
> dat files are not corrupt.  The dat files are initially downloaded to a 
> temporary staging area which does not impact the running clamd.  Only 
> after testing the dat files to see if they properly detect the eicar 
> test virus do they get copied into the default clam dat signature 
> database directory.  This solves both problems at the same time.

Sounds like a lot of needless extra effort versus the sanctioned and ClamAV
developed and supported way of testing signature files for corruption.

Bill

Bill Landry wrote:
> Adam Gibson wrote:
--- CUT---
>> I think we are saying the same thing.  By checking to make sure it
>> detects eicar before copying the dat files over it also makes sure the
>> dat files are not corrupt.  The dat files are initially downloaded to a 
>> temporary staging area which does not impact the running clamd.  Only 
>> after testing the dat files to see if they properly detect the eicar 
>> test virus do they get copied into the default clam dat signature 
>> database directory.  This solves both problems at the same time.
> 
> Sounds like a lot of needless extra effort versus the sanctioned and ClamAV
> developed and supported way of testing signature files for corruption.
> 
> Bill

Maybe I am just paranoid but I personally see the test to make sure the 
dat files detect a virus as a worthwhile step.  A dat pattern that 
passes corruption tests does not guarantee that the dat file detects 
viruses IMHO.  I am not that familiar with clamav though so maybe they 
do some checks like that.  By using the same method for all virus 
scanners I feel more comfortable.  It only takes parsing the output of 
the virus scanner that you are testing to see if it detected the virus 
and if so move the dat files to the production dat directory.  This 
seems like a pretty simple step to me.

Bill Landry wrote:
> Adam Gibson wrote:
>> Gary V wrote:
>>> (have not tried it though). Make sure your update script is a recent
>>> one that tests the downloads before employing them and consider
>>
>> This is one of the most important steps IMHO.  I would make sure the
>> script tests the dat files before copying them into place.  The
>> scripts that I have used over the years tests the dat files with the
>> eicar virus test pattern to make sure they work before copying them
>> into place.
>

Thanks. I will check for a newer script. Below is the one I'm using. I have 
no idea where I got it, as it was several years ago. Looks pretty simple and 
doesn't appear to do any testing.


[root@... scripts]# cat freshclam
#!/bin/sh

### A simple update script for the clamav virus database.
### This could as well be replaced by a SysV script.

### fix log file if needed
LOG_FILE="/var/log/clamav/freshclam.log"
if [ ! -f "$LOG_FILE" ]; then
    touch "$LOG_FILE"
    chmod 644 "$LOG_FILE"
    chown clamav.clamav "$LOG_FILE"
fi


/usr/bin/freshclam \
    --quiet \
    --datadir="/var/clamav" \
    --log="$LOG_FILE" \
    --log-verbose \
    --daemon-notify="/etc/clamd.conf"

At 03:06 PM 8/20/2007, Adam Gibson wrote:
>Bill Landry wrote:
> > Adam Gibson wrote:
>--- CUT---
> >> I think we are saying the same thing.  By checking to make sure it
> >> detects eicar before copying the dat files over it also makes sure the
> >> dat files are not corrupt.  The dat files are initially downloaded to a
> >> temporary staging area which does not impact the running clamd.  Only
> >> after testing the dat files to see if they properly detect the eicar
> >> test virus do they get copied into the default clam dat signature
> >> database directory.  This solves both problems at the same time.
> >
> > Sounds like a lot of needless extra effort versus the sanctioned and ClamAV
> > developed and supported way of testing signature files for corruption.
> >
> > Bill
>
>Maybe I am just paranoid but I personally see the test to make sure the
>dat files detect a virus as a worthwhile step.  A dat pattern that
>passes corruption tests does not guarantee that the dat file detects
>viruses IMHO.  I am not that familiar with clamav though so maybe they
>do some checks like that.  By using the same method for all virus
>scanners I feel more comfortable.  It only takes parsing the output of
>the virus scanner that you are testing to see if it detected the virus
>and if so move the dat files to the production dat directory.  This
>seems like a pretty simple step to me.

Testing for EICAR detection is OK if you're talking about the 
standard clamav signatures.

But this discussion is also about testing add-on signatures, such as 
the excellent ones from SaneSecurity.  Add-on files don't contain an 
EICAR signature (although some of them have a separate test file published).

-- 
Noel Jones

On 8/20/07, Jan Steding <steding@...> wrote:
> Hi @ all,
>
> i think my amavis-new is crazy .-)

You are not using amavisd-new. You are using Maia Mailguard. Usually
you should post Maia questions to the Maia list.

>
> In every mail send i get an UBE error inside.
> This is not normal.
>

<...>

> Aug 20 18:44:36 gs01 amavis[32205]: (32205-10) spam_scan: hits=6.633
> tests=AWL=-2.317,BAYES_99=3.5,HTML_40_50=0.496,HTML_MESSAGE=0.001,NO_REAL_NAME=0.961,RCVD_IN_NJABL_DUL=1.946,RCVD_IN_SORBS_DUL=2.046

<...>

> /Jan

The big problem is the two rules that are hitting:
RCVD_IN_NJABL_DUL=1.946 and RCVD_IN_SORBS_DUL=2.046. This indicates
that the IP address of the client you are sending from is on a dynamic
network (DUL=Dial Up List). Are you sending mail to your Maia server
from a dynamic IP, and if so, are you connecting to this server via
SASL? Or are you simply sending mail to an address hosted on the
server?

-- 
Gary V

At 10:48 AM 8/20/2007, Richard Bishop wrote:

>Hello all,
>
>I noticed today that there is a client_addr field in the r/w 
>database that stores the source server's IP address.  On my setup 
>(Exim4 -> Amavisd-new -> Exim4) this is always populated with NULL.
>
>Having checked the mailing list I see that this is reliant upon the 
>XFORWARD feature of Postfix (details on this are here for anybody 
>not aware of it - 
>http://www.postfix.org/XFORWARD_README.html).  Obviously Exim 
>doesn't have this feature - though there is a patch available 
>(http://lists.exim.org/lurker/message/20060518.093957.3322cd9c.en.html).
>
>Has anybody found a way / have any suggestion how to get this 
>working using Exim rather than Postfix?  I'm not too keen about 
>patching either Exim or Amavis because it makes upgrading a 
>headache.  I've not looked into the code that deeply though surely 
>the same information could be carried in a standard header called 
>'X-Forward-IP' (or similar)?
>
>Is it really that easy or am I missing something somewhere?  The 
>general opinion on the Exim-dev list seems to be that the XFORWARD 
>feature isn't required so it doesn't look like the patch will make 
>it into the official binary any time soon.
>
>I'd appreciate your comments / suggestions.

The advantage of the SMTP XFORWARD extension is that the client IP is 
available *prior to* envelope data and without having to parse the 
already-received message to extract it.  One could also argue that 
the information is also already available via Received: headers.

Using XFORWARD makes after-queue content filtering (such as with 
amavisd-new) simpler, and makes the logging far easier to follow.

Those are reasons to use XFORWARD, and there isn't really a substitute.

It looks as if your choices are to live with Exim's limitations, 
patch Exim, or switch to some MTA that supports XFORWARD - at least 
for the pre-filter front end.

-- 
Noel Jones

OK, I got a solution, I`m not 100% sure that it is right so I would appreciate 
your comment on the following setup. The goal is to have a simple global soft 
blacklisting in SQL and keep everything else in text configuration files. Let 
me know if I`m missing/doing wrong something:


/etc/amavis/conf.d/50-user:
use strict;

#
# Place your configuration directives here.  They will override those in
# earlier files.
#
# See /usr/share/doc/amavisd-new/ for documentation and examples of
# the directives you can use in this file
#

$max_servers = 20;

# Enable mysql lookups
@lookup_sql_dsn = (
   ['DBI:mysql:database=amavisd;host=xxxx', 'amavisd', 'xxx'],
);

$sql_select_white_black_list = 'SELECT sum(wb) as wb FROM amavis_wblist WHERE 
email IN (%k)';

# Enable Virus check
@bypass_virus_checks_maps = (
   \%bypass_virus_checks, \@bypass_virus_checks_acl, 
\$bypass_virus_checks_re);

# Enable smap check
@bypass_spam_checks_maps = (
   \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);

$sa_local_tests_only = 0;
$notify_method = 'smtp:127.0.0.1:25';

# Set different policies
$inet_socket_port = [10040,10041];
$interface_policy{'10040'} = 'INCOMING_UNTRUSTED';
$interface_policy{'10041'} = 'OUTGOING_UNTRUSTED';

$policy_bank{'INCOMING_UNTRUSTED'} = {
   # Set spam levels
   spam_tag_level_maps  => [-999.0],
   spam_tag2_level_maps => [6.31], # add 'spam detected' headers at that level
   spam_kill_level_maps => [16.31], # triggers spam evasive actions
   final_spam_destiny   => D_PASS,
   forward_method       => 'smtp:127.0.0.1:10126',
};

$policy_bank{'OUTGOING_UNTRUSTED'} = {
   # Set spam levels
   spam_tag_level_maps  => [-999.0],
   spam_tag2_level_maps => [3.31], # add 'spam detected' headers at that level
   spam_kill_level_maps => [16.31], # triggers spam evasive actions
   final_spam_destiny   => D_PASS,
   forward_method       => 'smtp:127.0.0.1:25',
};



#------------ Do not modify anything below this line -------------
1;  # insure a defined return



I have for tables as described in README.sql-mysql.txt:
mailaddr
policy
users
wblist

Additionally I have a custom table amavis_wblist which I use for soft listing:
mysql> describe amavis_wblist;
+-------+--------------+------+-----+---------+-------+
| Field | Type         | Null | Key | Default | Extra |
+-------+--------------+------+-----+---------+-------+
| email | varchar(255) |      | PRI |         |       |
| wb    | float        | YES  |     | NULL    |       |
+-------+--------------+------+-----+---------+-------+


The only data that I have in the first four tables is this line which should 
match all users and still use the policies defined in the text conf:
INSERT INTO `users` VALUES (1,1,1,'@.','','Y');

This also sets all domains as "local" which is desired for setting the spam 
headers on all mails.

Any comments are wellcome.

On Monday 20 August 2007 15:39:21 Pavel Georgiev wrote:
> Still no luck enabling soft black/white lists, any help here would be
> appreciated.
>
> In general I`m trying to enable soft black/white lists without putting any
> other configuration in SQL, I have config files for this.
>
> Here is my /etc/amavis/conf.d/50-user
>
> use strict;
>
> #
> # Place your configuration directives here.  They will override those in
> # earlier files.
> #
> # See /usr/share/doc/amavisd-new/ for documentation and examples of
> # the directives you can use in this file
> #
>
> $max_servers = 20;
>
> # Enable mysql lookups
> @lookup_sql_dsn = (
>    ['DBI:mysql:database=amavisd;host=xxx', 'amavisd', 'xxx'],
> );
> #$sql_select_policy = undef;
>
> #
> $sql_select_white_black_list = 1;
>
> #$log_level=5;
> # Enable header tags for all domains
> $local_domains_re ='.';
> @local_domains_maps =
>  (\%local_domains,\@local_domains_acl,\$local_domains_re);
>
> # Enable Virus check
> @bypass_virus_checks_maps = (
>    \%bypass_virus_checks, \@bypass_virus_checks_acl,
> \$bypass_virus_checks_re);
>
> # Enable smap check
> @bypass_spam_checks_maps = (
>    \%bypass_spam_checks, \@bypass_spam_checks_acl,
> \$bypass_spam_checks_re);
>
> $sa_local_tests_only = 0;
> $notify_method = 'smtp:127.0.0.1:25';
>
> # Set different policies
> $inet_socket_port = [10040,10041];
> $interface_policy{'10040'} = 'INCOMING_UNTRUSTED';
> $interface_policy{'10041'} = 'OUTGOING_UNTRUSTED';
>
> $policy_bank{'INCOMING_UNTRUSTED'} = {
>    # Set spam levels
>    spam_tag_level_maps  => [-999.0],
>    spam_tag2_level_maps => [6.31], # add 'spam detected' headers at that
> level spam_kill_level_maps => [16.31], # triggers spam evasive actions
> final_spam_destiny   => D_PASS,
>    forward_method       => 'smtp:127.0.0.1:10126',
> };
>
> $policy_bank{'OUTGOING_UNTRUSTED'} = {
>    # Set spam levels
>    spam_tag_level_maps  => [-999.0],
>    spam_tag2_level_maps => [3.31], # add 'spam detected' headers at that
> level spam_kill_level_maps => [16.31], # triggers spam evasive actions
> final_spam_destiny   => D_PASS,
>    forward_method       => 'smtp:127.0.0.1:25',
> };
>
>
>
> #------------ Do not modify anything below this line -------------
> 1;  # insure a defined return
>
> On Wednesday 08 August 2007 17:14:44 Pavel Georgiev wrote:
> > Hi list,
> >
> > I`m trying to setup amavis-new (2.3.3) with postfix (2.2.10) on Ubuntu
> > 6.06. I have a working setup with two policy banks defined in the config.
> >
> > I decided to add a soft black/white lists, but I cannot find the right
> > documentation for this.
> >
> > I created 4 tables as described here:
> > http://infocenter.guardiandigital.com/archive/amavis/2004/Dec/0316.html
> >
> > and enabled sql lookups with @lookup_sql_dsn = ( ... )
> >
> > I see in the logs that a query is done for policies:
> >
> >  lookup_sql select: SELECT *,users.id FROM users LEFT JOIN policy ON
> > users.policy_id=policy.id WHERE users.email IN (?,?,?,?,?,?) ORDER BY
> > users.priority DESC
> >
> > which return no records (I dont need policies in SQL) and then when wbl
> > check is made no actual sql queries are made:
> >
> > amavis[18915]: (18915-01) wbl: checking sender <xxx>
> > amavis[18915]: (18915-01) lookup_sql_field(id), "xxx" no matching records
> > amavis[18915]: (18915-01) lookup => undef, "xxx" does not match
> > amavis[18915]: (18915-01) wbl: (SQL) recip <xxx>, 0 matches
> >
> >
> > How do I enable sql lookups for score_sender_maps (an example would be
> > appreciated).
> >
> > In general I dont need any configuration is sql, I only want to put
> > sender addresses (that are global, not per recipient). Is it possible to
> > have sql lookup only for this in a custom sql tables that would have only
> > two fields - address and score. I only care of the envelope sender is
> > listed in that table so that I can get the score for it.
> >
> > Thanks!
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc.
> > Still grepping through log files to find problems?  Stop.
> > Now Search log events and configuration files using AJAX and a browser.
> > Download your FREE copy of Splunk now >>  http://get.splunk.com/
> > _______________________________________________
> > AMaViS-user mailing list
> > AMaViS-user@...
> > https://lists.sourceforge.net/lists/listinfo/amavis-user
> > AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
> > AMaViS-HowTos:http://www.amavis.org/howto/
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> AMaViS-user mailing list
> AMaViS-user@...
> https://lists.sourceforge.net/lists/listinfo/amavis-user
> AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
> AMaViS-HowTos:http://www.amavis.org/howto/