AMaViS - A Mail Virus Scanner

Jim wrote:

> Hallo und Guten Morgen amavis-user,

> I have installed dspam under /usr/local/bin/dspam and included
> $dspam = 'dspam'; in the amavisd.conf (and restarted). But
> amavisd-new debug says $dspam not found - not using it. What`s
> wrong. Thank you for help.

Try:
su vscan -c 'rehash'

Gary V

Hallo und Guten Morgen Gary,

Heute (am 29.10.2005 - 05:02 Uhr)
   schriebst Du:=20

> Jim wrote:

>> Hallo und Guten Morgen amavis-user,

>> I have installed dspam under /usr/local/bin/dspam and included
>> $dspam =3D 'dspam'; in the amavisd.conf (and restarted). But
>> amavisd-new debug says $dspam not found - not using it. What`s
>> wrong. Thank you for help.

> Try:
> su vscan -c 'rehash'

> Gary V


my user called amavis


su amavis -c 'rehash'

sh: line 1: rehash: command not found


--=20
Viele Gr=FC=DFe, Kind regards,
 Jim Knuth
 jk@...
 ICQ #277289867
 PGP: 54C9 1A46 D3B2 95B6 454D 74FA AC73 773E 1F78 066F
----------
Zufalls-Zitat
----------
Rund ein Drittel aller Amerikaner bet=E4tigen die Sp=FClung,=20
w=E4hrend sie noch auf dem Klo sitzen.
----------
Der Text hat nichts mit dem Empf=E4nger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1267 Build 6270  28.10.2005

Jim wrote:
>>> Hallo und Guten Morgen amavis-user,

>>> I have installed dspam under /usr/local/bin/dspam and included
>>> $dspam = 'dspam'; in the amavisd.conf (and restarted). But
>>> amavisd-new debug says $dspam not found - not using it. What`s
>>> wrong. Thank you for help.

>> Try:
>> su vscan -c 'rehash'
>> Gary V
> my user called amavis
> su amavis -c 'rehash'
> sh: line 1: rehash: command not found

Sorry, you are using 'sh'.

Do you get a response if you simply run 'su amavis dspam' ?
and
su amavis /usr/local/bin/dspam ?

If you first installed it somewhere else, then deleted it, then
installed it in /usr/local/bin/dspam, try:

su amavis -c 'hash -r'

Gary V

Hallo und Guten Morgen Gary,

Heute (am 29.10.2005 - 05:39 Uhr)
   schriebst Du:=20

> Jim wrote:
>>>> Hallo und Guten Morgen amavis-user,

>>>> I have installed dspam under /usr/local/bin/dspam and included
>>>> $dspam =3D 'dspam'; in the amavisd.conf (and restarted). But
>>>> amavisd-new debug says $dspam not found - not using it. What`s
>>>> wrong. Thank you for help.

>>> Try:
>>> su vscan -c 'rehash'
>>> Gary V
>> my user called amavis
>> su amavis -c 'rehash'
>> sh: line 1: rehash: command not found

> Sorry, you are using 'sh'.

> Do you get a response if you simply run 'su amavis dspam' ?
> and
> su amavis /usr/local/bin/dspam ?

> If you first installed it somewhere else, then deleted it, then
> installed it in /usr/local/bin/dspam, try:

> su amavis -c 'hash -r'

> Gary V



server2:~# su amavis dspam
sh: line 1: /usr/local/bin/dspam: Keine Berechtigung

server2:~# su amavis /usr/local/bin/dspam
sh: line 1: /usr/local/bin/dspam: Keine Berechtigung

server2:~# su amavis -c 'hash -r'
server2:~#

I think, it is an permission/ownership problem. Must be an
user/group dspam? In which group must be then dspam. amavis?
In dspam.conf is Trust amavis

--=20
Viele Gr=FC=DFe, Kind regards,
 Jim Knuth
 jk@...
 ICQ #277289867
 PGP: 54C9 1A46 D3B2 95B6 454D 74FA AC73 773E 1F78 066F
----------
Zufalls-Zitat
----------
Es ist m=F6glich, eine Kuh eine Treppe heraufzuf=FChren.=20
Unm=F6glich ist es jedoch, sie die Treppe wieder=20
herunterzuf=FChren.
----------
Der Text hat nichts mit dem Empf=E4nger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1267 Build 6270  28.10.2005

Jim wrote:
> I have installed dspam under /usr/local/bin/dspam and included
> $dspam = 'dspam'; in the amavisd.conf (and restarted). But
> amavisd-new debug says $dspam not found - not using it. What`s
> wrong. Thank you for help.

> server2:~# su amavis dspam
> sh: line 1: /usr/local/bin/dspam: Keine Berechtigung

> I think, it is an permission/ownership problem. Must be an
> user/group dspam? In which group must be then dspam. amavis?
> In dspam.conf is Trust amavis

Maybe you forgot this:
chmod u-s,a+rx /usr/local/bin/dspam
and this:
chown -R amavis:amavis /the/home/of/dspam

I use Debian, so my ./configure option for the dspam home was
"--with-dspam-home=/var/lib/amavis/dspam". Then I:
chown -R amavis:amavis /var/lib/amavis/dspam

Another note:
I first installed Dspam using the default storage method. When
amavisd-new fed a message to dspam for retraining, if in the body of
the message there were over 15K characters, it would take longer than
6 minutes on my machine (Celeron 800MHZ) to process the message and as
a result, amavisd-new would time out. Dspam is nearly unusable this
way. I strongly recommend using SQL.

Gary V

Hallo und Guten Tag Gary,

Heute (am 29.10.2005 - 15:48 Uhr)
   schriebst Du:=20

> Jim wrote:
>> I have installed dspam under /usr/local/bin/dspam and included
>> $dspam =3D 'dspam'; in the amavisd.conf (and restarted). But
>> amavisd-new debug says $dspam not found - not using it. What`s
>> wrong. Thank you for help.

>> server2:~# su amavis dspam
>> sh: line 1: /usr/local/bin/dspam: Keine Berechtigung

>> I think, it is an permission/ownership problem. Must be an
>> user/group dspam? In which group must be then dspam. amavis?
>> In dspam.conf is Trust amavis

> Maybe you forgot this:
> chmod u-s,a+rx /usr/local/bin/dspam
> and this:
> chown -R amavis:amavis /the/home/of/dspam

> I use Debian, so my ./configure option for the dspam home was
> "--with-dspam-home=3D/var/lib/amavis/dspam". Then I:
> chown -R amavis:amavis /var/lib/amavis/dspam

Now I have new compiled with:

./configure --with-storage-driver=3Dlibdb4_drv  --with-dspam-home=3D/var/=
lib/amavis/dspam

chmod u-s,a+rx /usr/local/bin/dspam
chown -R amavis:amavis /var/lib/amavis/dspam

And NOW

amavis[28014]: (28014-01) X-DSPAM-Result: Innocent\n
amavis[28014]: (28014-01) X-DSPAM-Confidence: 1.0000\n
amavis[28014]: (28014-01) X-DSPAM-Probability: 0.0023\n
amavis[28014]: (28014-01) X-DSPAM-Signature: 436388c3280891105819789\n
amavis[28014]: (28014-01) X-DSPAM-Factors: 27,\n
amavis[28014]: (28014-01) spam_scan: DSPAM gave: 436388c3280891105819789,=
 Innocent

Is this all? I`ts so right? I think so. ;)

> Another note:
> I first installed Dspam using the default storage method. When
> amavisd-new fed a message to dspam for retraining, if in the body of
> the message there were over 15K characters, it would take longer than
> 6 minutes on my machine (Celeron 800MHZ) to process the message and as
> a result, amavisd-new would time out. Dspam is nearly unusable this
> way. I strongly recommend using SQL.

You mean SQL or MySQL?

> Gary V


--=20
Viele Gr=FC=DFe, Kind regards,
 Jim Knuth
 jk@...
 ICQ #277289867
 PGP: 54C9 1A46 D3B2 95B6 454D 74FA AC73 773E 1F78 066F
----------
Zufalls-Zitat
----------
Moral ist, wenn man so lebt, da=DF es gar keinen Spa=DF macht,=20
so zu leben. (Edith Piaf)
----------
Der Text hat nichts mit dem Empf=E4nger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1267 Build 6270  28.10.2005

Jim wrote:
> I have installed dspam under /usr/local/bin/dspam and included
> $dspam = 'dspam'; in the amavisd.conf (and restarted). But
> amavisd-new debug says $dspam not found - not using it. What`s
> wrong. Thank you for help.

Jim, I just set a Debian machine up from scratch (as far as MySQL
and Dspam goes) and I thought this "how I did it" might be of use. This works
for me and should give you an idea of what is involved. I'm sorry this
is all off-topic. Paths to libraries/includes are specific to Debian.
No doubt this could be improved.


apt-get install mysql-server-4.1 libsqlite0-dev libmysqlclient14-dev
## you need those two libraries

mysql -u root
SET PASSWORD FOR 'root'@'localhost' = PASSWORD('RootPassword');
SET PASSWORD FOR 'root'@'somehost' = PASSWORD('RootPassword');
create database dspam;
quit
## note - somehost - is the machine's host name

mkdir /usr/local/etc
cd /usr/local/src
wget http://www.nuclearelephant.com/projects/dspam/sources/dspam-3.6.0.tar.gz
tar xzvf dspam-3.6.0.tar.gz
cd dspam-3.6.0/src/tools.mysql_drv
mysql dspam -u root -pRootPassword< mysql_objects-speed.sql 
mysql dspam -u root -pRootPassword< virtual_users.sql 
cp purge-4.1.sql /usr/local/etc

mysql -u root -pRootPassword
use dspam; 
GRANT ALL PRIVILEGES ON *.* TO 'dspam'@'localhost' IDENTIFIED BY '(DspamPassword)' WITH GRANT OPTION;
SET PASSWORD FOR 'dspam'@'localhost' = PASSWORD('DspamPassword');
FLUSH PRIVILEGES;
quit

cd /usr/local/src/dspam-3.6.0
./configure --with-storage-driver=mysql_drv --with-mysql-libraries=/usr/lib --with-mysql-includes=/usr/include/mysql --enable-virtual-users --with-dspam-home=/var/lib/amavis/dspam --enable-signature-headers --without-delivery-agent --without-quarantine-agent --enable-debug
make
make install

vi /usr/local/etc/dspam.conf

Trust amavis

MySQLServer     localhost
MySQLPort       3306
MySQLUser       dspam
MySQLPass       DspamPassword
MySQLDb         dspam
MySQLCompress   true

crontab -e
0 0 * * * /usr/bin/mysql -udspam -pDspamPassword dspam < /usr/local/etc/purge-4.1.sql

vi /etc/amavis/amavisd.conf
$dspam = 'dspam';

chmod u-s,a+rx /usr/local/bin/dspam
chown -R amavis:amavis /var/lib/amavis/dspam

amavisd-new stop
amavisd-new debug

(Send a message through and check for DSPAM headers.)
amavisd-new start

dspam_stats -H
(should show some data)

Now train DPSPAM according to documentation (some training
will be done by amavisd-new), and at some point, add this to local.cf:

header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
describe DSPAM_SPAM DSPAM claims it is spam
score DSPAM_SPAM 0.5

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.1


Gary V

Gary wrote:

>  Jim wrote:
>> I have installed dspam under /usr/local/bin/dspam and included
>> $dspam = 'dspam'; in the amavisd.conf (and restarted). But
>> amavisd-new debug says $dspam not found - not using it. What`s
>> wrong. Thank you for help.

> cd /usr/local/src/dspam-3.6.0
> ./configure --with-storage-driver=mysql_drv --with-mysql-libraries=/usr/lib --with-mysql-includes=/usr/include/mysql --enable-virtual-users --with-dspam-home=/var/lib/amavis/dspam
> --enable-signature-headers --without-delivery-agent --without-quarantine-agent --enable-debug
> make
> make install

BTW, it might be a good idea to trash your old dspam.conf, just in
case it prevents the new one from copying over, then reconfigure the
new dspam.conf.

Gary V

Hallo und Guten Abend Gary,

Heute (am 29.10.2005 - 18:47 Uhr)
   schriebst Du:=20

> I'm sorry this is all off-topic.

yes, I know. Sorry, but thanx

> Paths to libraries/includes are specific to Debian.
> No doubt this could be improved.

I use Debian too. ;)

> dspam_stats -H
> (should show some data)

The results since 2 hours

server2:~# dspam_stats -H
amavis:
                TS Total Spam:                  0
                TI Total Innocent:             20
                SM Spam Misclassified:          1
                IM Innocent Misclassified:      0
                SC Spam Corpusfed:              0
                IC Innocent Corpusfed:          0
                TL Training Left:            2480
                SR Spam Catch Rate:         0.00%
                IR Innocent Catch Rate:   100.00%
                OR Overall Rate/Accuracy:  95.24%

Looks good, or? :)

I will try the other things too. Thank you again.


--=20
Viele Gr=FC=DFe, Kind regards,
 Jim Knuth
 jk@...
 ICQ #277289867
 PGP: 54C9 1A46 D3B2 95B6 454D 74FA AC73 773E 1F78 066F
----------
Zufalls-Zitat
----------
M=E4nner heiraten, weil sie m=FCde, Frauen, weil sie neugierig=20
sind; beide werden entt=E4uscht. Oscar Wilde
----------
Der Text hat nichts mit dem Empf=E4nger der Mail zu tun
----------
Virus free. Checked by NOD32 Version 1.1267 Build 6270  28.10.2005