[Mimedefang] MimeDefang + SpamAssassin on Solaris 9

[Albert E. Whale, CISSP]

David F. Skoll wrote:

>On Mon, 26 May 2003, Mathew Thomas wrote:
>
>  
>
>>Has anyone successfully installed MIMEDefang+ SpamAssassin on Solaris 9?
>>    
>>
>
>It works fine for me on the four reference platforms we have in-house,
>which are Linux (various flavors of Red Hat plus Gentoo), Solaris 8,
>Solaris 9 and FreeBSD.
>
>  
>
Hmm, I didn't modify the SPAM Assassin filter either, and I can you that 
this is not functioning any longer (SPAM Assassin upgraded to the latest 
on Friday - Darn Murphy!).  Here's a Log file snippet

May 25 22:40:12 ns mimedefang.pl[6249]: MDLOG,h4Q2eBlh006262,mail_out,127.0.0.1,,<root at ns.abs-comptech.com>,<aewhale at hky.com>,
May 25 22:40:12 ns mimedefang[6263]: h4Q2eBlh006262: Filter time is 949ms
May 25 22:40:12 ns sendmail[6262]: h4Q2eBlh006262: Milter add: header: X-Scanned-By: MIMEDefang 2.33 (www . roaringpenguin . com / mimedefang)
May 25 22:40:12 ns sendmail[6261]: h4Q2e8lH006261: to=aewhale at hky.com, ctladdr=root (0/0), delay=00:00:04, xdelay=00:00:01, mailer=relay, pri=30005, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (h4Q2eBlh006262 Message accepted for delivery)

Here's the Mimedefang-filter routines:

sub filter_end ($) {

    my($entity) = @_;

    if ($RelayAddr eq '192.168.99.1' or
        $RelayAddr =~ /^192\.168\./ or
        $RelayAddr =~ /^172\.16\./ or
        $RelayAddr =~ /^192\.168\./ or
        $RelayAddr eq '127.0.0.1' or
        $RelayAddr eq '66.93.61.157' or
        $RelayAddr eq '66.93.61.117') {
            md_log('mail_out',,$RelayAddr);
        } else {
            md_log('mail_in',,$RelayAddr);
        }

    # If you want quarantine reports, uncomment next line
    # send_quarantine_notifications();

    # No sense doing any extra work
    return if message_rejected();

    # Spam checks if SpamAssassin is installed
    if ($Features{"SpamAssassin"}) {
        if (-s "./INPUTMSG" < 100*1024) {
            # Only scan messages smaller than 100kB.  Larger messages
            # are extremely unlikely to be spam, and SpamAssassin is
            # dreadfully slow on very large messages.
            my($hits, $req, $names, $report) = spam_assassin_check();
            if ($hits >= $req) {
                md_log('spam', $hits, $RelayAddr);
                my($score);
                if ($hits < 40) {
                    $score = "*" x int($hits);
                } else {
                    $score = "*" x 40;
                }
                # We add a header which looks like this:
                # X-Spam-Score: 6.8 (******) NAME_OF_TEST,NAME_OF_TEST
                # The number of asterisks in parens is the integer part
                # of the spam score clamped to a maximum of 40.

I don't know what's happened here.  Any Ideas?



-- 
Albert E. Whale, CISSP
http://www.abs-comptech.com
----------------------------------------------------------------------
ABS Computer Technology, Inc. - ESM, Computer & Networking Specialists
Sr. Security, Network, and Systems Consultant
Founding Board of Directors of Pittsburgh FBI - InfraGard