[Mimedefang] SpamAssassin 2.60

[Kevin A. McGrail]

There was a wonderful and LENGTHY 2.60 upgrade document distributed on the
announcement list that seems to have missed being put in the archive.  There
is also a patch to Razor2 that I know has been mentioned as well on this
list.

Anyway, here's the verbatim information from that announcement which
includes information on converting from non-DB_file to DB_File format.

Regards,
KAM


Important installation notes
----------------------------

- Bayes FYI: 2.60 has a new Bayes backend and database format.  Your old
  database(s) will automatically be upgraded the first time 2.60 tries to
  write to the DB, and any journal, if it exists, will be wiped out without
  being synced.

  In addition, we have had to drop support for Bayes databases in formats
  other than DB_File, due to a large number of serious issues (including
  crash and concurrency bugs) with those formats.

  So, what you want to do is something like this:

  - stop running spamassassin/spamd (ie: you don't want it to be running
    during the upgrade)
  - run "sa-learn --rebuild", this will sync your journal.
  - upgrade SA to 2.60
  - install DB_File module if necessary
  - if you were using another database module, run "sa-learn --import"
    to migrate the data into new DB_File files
  - run "sa-learn --rebuild", this will cause the db format to be upgraded
  - start running spamassassin/spamd again

  Obviously the steps will be different depending on your environment,
  but you get the idea. :)

- Bayes FYI 2: Because of the new database format, "check_bayes_db" will
  no longer function properly.  The functionality from that script was
  added to sa-learn via the "--dump" parameter.  Please see the sa-learn
  man/pod documentation for more info.

- SpamAssassin 2.6x will be the last release supporting perl 5.005,
  so it's suggested to upgrade to at least perl 5.6.1

- Razor2 isn't fully taint safe.  So since SpamAssassin 2.60 enables
  taint mode by default, there's a Razor2.patch file which needs to be
  applied to Razor2.  Documentation exists in the patch file.

Summary of major changes since 2.5x
-----------------------------------

spamd improvements

  - spamd now supports UNIX-domain sockets for low-overhead scanning, thanks
    to Steve Friedl for this.  This is strongly recommended if you're
running
    spamc on the same host as the spamd server

Bayes improvements

  - new tweaks to the Bayes engine: it now breaks down email addresses and
URI
    elements while learning to use as additional features when testing email

  - new bayes backend, including new database format, ability to learn
messages
    to the journal, etc.  Improved expiration mechanism

HTML parser improvements

  - HTML::Parser 3.24 or higher is now required

  - major improvements to the HTML engine, including better support for
    detecting 'invisible text' and similar obfuscation techniques used in
    spam

DNS blacklist and network testing improvements

  - DNS blacklists (RBLs) overhauled; lots of new lists, including SORBS and
    SpamCop; dropped Osirusoft due to their retirement (brought on by a
DDOS)

  - RBL timeouts are now handled much more efficiently; if one RBL is taking
    much longer than all the others, it will be cut short and ignored

  - the RBL engine improves the extraction and selection of IP addresses
    queried by inferring trust relationships between Received headers; trust
    can also be manually specified using the new "trusted_networks" option

  - a generalised Received-header parser to more easily detect HELO string
    forgery and faked relay lines

  - support for domain-based blacklists and TXT record queries

  - dccifd support added

  - Razor 1 support dropped

Report improvements

  - to reduce confusion, the default report now includes the hostname of the
    machine where SpamAssassin is running and the installer also asks for an
    administrative address or URL

  - more flexible header and report rewriting including a simple template
    system

Other changes

  - workaround for red hat kernel with NPTL reporting "application bug" in
    spamd due to use of waitpid() when SIGCHLD is set to SIG_IGN

  - taint mode is now enabled by default (for perl versions 5.6.0 and
    higher) for extra security

  - Makefile variables were changed to use DESTDIR instead of the various
    INST_* variables.  Please read the PACKAGING file for more information.

  - Lots of bugs fixed and new rules added. ;)

  - timelog code has been removed



>     2.  SpamAssassin 2.60 depends on perl-DB_File in order for the
>         Bayesian features to work.  But if you don't have perl-DB_File
>         installed, the Bayesian features simply don't work, and
>         there's no obvious error message.
>
>         (I build RPMs of SpamAssassin, and rpmbuild didn't
>         automatically detect the perl(DB_File) dependency.  I had to
>         manually put the appropriate BuildRequires and Requires in the
>         SPEC file.)
>
>     3.  I believe that 2.60 can auto-upgrade Bayesian databases
>         created by previous versions, but I didn't test that; I
>         figured it would be easier to archive the old databases and
>         let 2.60 build new databases from scratch.
>
> Regards,
>
> -- 
> James Ralston, Postmaster General
> Software Engineering Institute
> Carnegie Mellon University, Pittsburgh, PA, USA
>
> _______________________________________________
> MIMEDefang mailing list
> MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
>