Results 1 to 6 of 6

Thread: salocal.cf - case sensitive?

  1. #1
    Join Date
    Jan 2007
    Location
    Baltimore, Maryland
    Posts
    51
    Rep Power
    8

    Default salocal.cf - case sensitive?

    First attempt to white list an email address has unexpected results.

    Is salocal.cf(.in) case sensitive with username@domain.tld?

    Should there be some notation in the log and or headers about being white listed?

    I see no log entry and nothing special in the headers.

  2. #2
    Join Date
    Apr 2007
    Location
    NSW, Australia
    Posts
    38
    Rep Power
    8

    Default

    The salocal.cf needs to contain valid spamassassin rules. You can't just drop an e-mail address in there and expect it to know what to do with it.

    If you're having trouble with the spamassassin rule syntax, just remember it's actually using Perl regular expressions. So in the case of the e-mail you've quoted, a simple rule might look like this:

    header WHITE1 From=~/username\@domain\.tld/i
    describe WHITE1 Drop score for username@domain.tld
    score WHITE1 -100

    That will lower the score for any message from 'username@domain.tld' by 100 points. Effectively, this means they will never be flagged as spam.

    Alternatively, you can use the 'whitelist_from' or 'whitelist_from_rcvd' to accompish the same thing:

    whitelist_from username@domain.tld

    The 'whitelist_from' and 'whitelist_from_rcvd' both do exactly the same thing as the 3-line rule at the top (lower a matching message's score by 100). However, the 'whitelist_from_rcvd' will match against the envelope sender and thus makes it a little more accurate as spammers usually use the "From:" header to spoof a real user, and thus can defeat the 'whitelist_from' rule.

    To answer your question, Perl regex IS case sensitive, unless you tell it otherwise:
    /match some text/ - IS case sensitive
    /MAtch sOme TExt/i - ISN'T case sensitive as it has the 'i' after the regex telling Perl to be case Insensitive.

    Most of the time, when writing spamassassin rules, you'll want them to be case insensitive. I am believe the 'whitelist_...' rules are case insensitive by design.

    There's more info in perldoc Mail::SpamAssassin::Conf (and here: Spamassassin WIKI)

    Cheers,

    James
    Last edited by Centurion; 10-03-2007 at 11:54 PM. Reason: Added some more explanation and fixed a few typo's - proof read it next time James!

  3. #3
    Join Date
    Jan 2007
    Location
    Baltimore, Maryland
    Posts
    51
    Rep Power
    8

    Default

    sorry, I should have provided my salocal.cf entries

    working from the wiki
    Improving Anti-spam system - ZimbraWiki

    I inserted this line
    /opt/zimbra/conf/salocal.cf.in
    whitelist_from poor_email_etiquette@domain.tld

    restarted antispam and now have this line
    /opt/zimbra/conf/salocal.cf
    whitelist_from poor_email_etiquette@domain.tld


    I set my mail client to have an extra identity and sent an email posing as poor_email_etiquette@domain.tld

    This is a snip of the headers obfuscated to protect the confused.
    Received: from localhost (localhost.localdomain [127.0.0.1])
    by mta-1.domain.tld (Postfix) with ESMTP id A441D255865B
    for <bowergo@domain.tld>; Wed, 3 Oct 2007 00:04:46 -0400 (EDT)
    X-Virus-Scanned: amavisd-new at
    Received: from mta-1.domain.tld ([127.0.0.1])
    by localhost (mta-1.domain.tld [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id BvUS9kw+FNdr for <bowergo@domain.tld>;
    Wed, 3 Oct 2007 00:04:45 -0400 (EDT)
    Received: from mail.domain.tld (mail-0.domain.tld [10.10.220.5])
    by mta-1.domain.tld (Postfix) with ESMTP id D37982558636
    for <bowergo@mta-1.domain.tld>; Wed, 3 Oct 2007 00:04:44 -0400 (EDT)
    Received: from relay.domain.tld (hv.domain.tld [10.10.220.25])
    by mail.domain.tld (8.11.6/8.11.6) with ESMTP id l9344n408444;
    Wed, 3 Oct 2007 00:04:49 -0400
    Message-ID: <>
    Date: Wed, 03 Oct 2007 00:04:49 -0400
    From: "poor_email_etiquette@domain.tld" <poor_email_etiquette@domain.tld>
    User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
    MIME-Version: 1.0
    To: Bowergo <bowergo@domain.tld>
    Subject: Whitelist test
    Content-Type: text/plain; charset=ISO-8859-1; format=flowed
    Content-Transfer-Encoding: 7bit

    Test
    I really expected to see some headers about the spam check, but see none.

  4. #4
    Join Date
    May 2007
    Location
    Los Angeles, CA
    Posts
    31
    Rep Power
    8

    Default

    If the SPAM score is below a certain threshhold the X-Spam headers don't get added.

    in /opt/zimbra/conf/amavisd.conf, look for a line like the following:
    $sa_tag_level_deflt = -10.0; # add spam info headers if at, or above that level

    In this case, anything scoring lower than -10 (which your whitelist certainly should) doesn't get headers added.

    You could edit amavisd.conf.in, change this value temporarily to -1000, zmamavisdctl stop/start and repeat the test...
    Last edited by Bevan Bennett; 10-04-2007 at 01:49 PM.

  5. #5
    Join Date
    Apr 2007
    Location
    NSW, Australia
    Posts
    38
    Rep Power
    8

    Default

    The other option is to follow the /var/log/zimbra.log file as you send the message. Then, even though amavis wont insert the headers, you should still see the spamassassin result in the log file. This approach avoids restarting any Zimbra components or editing config files.

    You can follow the logs with "tail -f <filename>" or "less <filename>" then hit SHIFT+F. The beauty of using "less" is you can easily pause/restart the scrolling, search for strings and other useful things.

    HTH,

    James

  6. #6
    Join Date
    Jan 2007
    Location
    Baltimore, Maryland
    Posts
    51
    Rep Power
    8

    Default

    Thank you.

    Quote Originally Posted by Bevan Bennett View Post

    ...If the SPAM score is below a certain threshold the X-Spam headers don't get added...
    This explains the headers. I have found the score in both zimbra.log and zmmsgtrace -s poor_email_etiquette@domain.tld

    Hits: -93.658

Similar Threads

  1. Admin Webinar/O'Reilly Case Study: Aug 29th
    By mmorse in forum Webinars
    Replies: 1
    Last Post: 08-29-2007, 12:43 PM
  2. Small test case in large Notes environment...
    By sn4265 in forum Migration
    Replies: 0
    Last Post: 08-22-2007, 11:09 AM
  3. Case Managment Reports I'm logged out
    By Cringer in forum Administrators
    Replies: 9
    Last Post: 06-12-2007, 06:01 AM
  4. email address upper/lower case
    By dagar in forum Administrators
    Replies: 0
    Last Post: 12-06-2006, 07:53 AM
  5. Calendar Use Case
    By enthenergy in forum Administrators
    Replies: 2
    Last Post: 12-01-2006, 05:16 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •