[Mimedefang] Mimedefang/Multiplexor wrong score. Stops running tests randomly

[Justin Edmands]

Steffen and Stephen,
>From a combination of your responses I was able to shed some light on
a few things. Firewall outbound was blocking Pyzor/Razor and
Spamassassin for a few IPs. I originally allowed the traffic during
testing, but to one external IP that connects to spamassassin.

The command run as defang, adding a shell, was the most helpful. I was
able to see the score that defang would see. Thanks for that tip.

su defang -s /bin/bash -c 'spamassassin -x -p
/etc/mail/sa-mimedefang.cf -D' < spam.eml


Thanks again for your help. It has been greatly appreciated.

On Fri, Jul 18, 2014 at 10:54 AM, Stephen Johnson (DIS)
<Stephen.Johnson at arkansas.gov> wrote:
> On Thu, 2014-07-17 at 18:51 -0400, Justin Edmands wrote:
>> Hey,
>> Mimedefang is not appending the appropriate score to our messages.
>>
>> An example would be a message manually run through spamassassin
>> produces a 17.6 score. This same message processed by the mimedefang
>> filter only produces a 0.698. This is all run on the same server. What
>> the heck? It only runs those tests? It runs random tests sometimes. I
>> have no idea why. Does it have a max process time or something causing
>> it to stop running tests after X time? Anyways...
>
> You are misunderstanding how Mimedefang uses spamassassin.
> Spamassassins's rewriting of e-mail headers is done when it's used after
> the MTA has accepted delivery of the e-mail. Mimedefang runs as a milter
> (mail filter) within sendmail itself. That means that an incoming e-mail
> is still in the processing of being received when Mimedefang get's
> called be sendmail. The e-mail can't be rewritten by spamassassin.
>
> The only way to modify the incoming e-mails is via milter API calls. And
> only Mimedefang itself has to do the rewrites. Spamassassin in this
> scenario is only used to run the tests. If you are using the default
> Mimedefang filter (/etc/mail/mimedefang-filter), you will see some
> rewriting code happening in the fitler_end() function.
>
> And in terms of how spamassassin works espceically inside run within
> Mimedefang. Spamassassin data (e.g. bayes filter database, autowhitelist
> database, etc), the data is stored on a per user basis. That means the
> spamassassin runs its tests using data stored in the user id that
> Mimedefang runs under. Running the same e-mail on a different user it
> will result in different test scores. If you want a semi-accurate
> spamassasin check of an e-mail as Mimedefang sees it, it has to be done
> under the Mimedefang user id.
>
>
> --
> Stephen L Johnson  <stephen.johnson at arkansas.gov>
> Unix Systems Administrator / DNS Hostmaster
> Department of Information Systems
> State of Arkansas
> 501-682-4339
> _______________________________________________
> NOTE: If there is a disclaimer or other legal boilerplate in the above
> message, it is NULL AND VOID.  You may ignore it.
>
> Visit http://www.mimedefang.org and http://www.roaringpenguin.com
> MIMEDefang mailing list MIMEDefang at lists.roaringpenguin.com
> http://lists.roaringpenguin.com/mailman/listinfo/mimedefang