Deliver Spam with subject heading and headers not working

Joel:

Thanks for all the useful info.

Here is what my spamassassin settings now look like in amavisd.conf:

# SpamAssassin settings

# $sa local_testsonly is passed to Mail::SpamAssassin::new as a value
# of the option local testsonly. See Mail::SpamAssassin man page.
# If set to 1, no tests that require internet access will be performed.
#
$sa local_testsonly = 1; # (default: false)
#$sa autowhitelist = 1; # turn on AWL (default: false)

$sa mail_body_sizelimit = 64*1024; # don't waste time on SA if mail is larger
# (less than 1% of spam is > 64k)
# default: undef, no limitations

# default values, can be overridden by more specific lookups, e.g. SQL
$sa tag_leveldeflt = -999; # add spam info headers if at, or above that level
$sa tag2_leveldeflt = 6.0; # add 'spam detected' headers at that level
$sa kill_leveldeflt = 22.0;
#$sa kill_leveldeflt = $sa tag2_leveldeflt; # triggers spam evasive actions
# at or above that level: bounce/reject/drop,
# quarantine, and adding mail address extension
#
# The $sa tag_leveldeflt, $sa tag2_leveldeflt and $sa kill_leveldeflt
# may also be hashrefs to hash lookup tables, to make static per-recipient
# settings possible without having to resort to SQL or LDAP lookups.

# a quick reference:
# tag_level controls adding the X-Spam-Status and X-Spam-Level headers,
# tag2_level controls adding 'X-Spam-Flag: YES', and editing Subject,
# kill_level controls 'evasive actions' (reject, quarantine, extensions);
# it only makes sense to maintain the relationship:
# tag_level <= tag2_level <= kill_level

# string to prepend to Subject header field when message exceeds tag2 level
$sa spam_subjecttag = ' ****SPAM****'; # (defaults to undef, disabled)
# (only seen when spam is passed and recipient is
# in local_domains*)

$sa spam_modifiessubj = 1; # in @spam modifies_subjmaps, default is true

# Example: modify Subject for all local recipients except user@example.com
#$sa spam_modifiessubj = [qw( !user@example.com . )];

So, if all goes well, I should see messages with 6 or more hits delivered unmodified with the exception of the ****SPAM**** subject header, right? Or am I missing something else.

Well I made the changes but I'm still not getting any results when the option in server admin is set to deliver with subject changed to ****SPAM**** with or without the message attached as MIME. I am seeing messages with hits way over my tag2 threshold getting delivered without any subject header or XSPAM headers. The only option that seems to work is the option to redirect it to a quarantine mailbox which is a bit of a pain as spamassassin is still in it's initial traing period.

Here are my spamassassin settings from amavisd.conf: # SpamAssassin settings

# $sa local_testsonly is passed to Mail::SpamAssassin::new as a value
# of the option local testsonly. See Mail::SpamAssassin man page.
# If set to 1, no tests that require internet access will be performed.
#
$sa local_testsonly = 1; # (default: false)
#$sa autowhitelist = 1; # turn on AWL (default: false)

$sa mail_body_sizelimit = 64*1024; # don't waste time on SA if mail is larger
# (less than 1% of spam is > 64k)
# default: undef, no limitations

# default values, can be overridden by more specific lookups, e.g. SQL
$sa tag_leveldeflt = -999; # add spam info headers if at, or above that level
$sa tag2_leveldeflt = 7.0; # add 'spam detected' headers at that level
$sa kill_leveldeflt = 22.0;
#$sa kill_leveldeflt = $sa tag2_leveldeflt; # triggers spam evasive actions
# at or above that level: bounce/reject/drop,
# quarantine, and adding mail address extension
#
# The $sa tag_leveldeflt, $sa tag2_leveldeflt and $sa kill_leveldeflt
# may also be hashrefs to hash lookup tables, to make static per-recipient
# settings possible without having to resort to SQL or LDAP lookups.

# a quick reference:
# tag_level controls adding the X-Spam-Status and X-Spam-Level headers,
# tag2_level controls adding 'X-Spam-Flag: YES', and editing Subject,
# kill_level controls 'evasive actions' (reject, quarantine, extensions);
# it only makes sense to maintain the relationship:
# tag_level <= tag2_level <= kill_level

# string to prepend to Subject header field when message exceeds tag2 level
$sa spam_subjecttag = ' ****SPAM****'; # (defaults to undef, disabled)
# (only seen when spam is passed and recipient is
# in local_domains*)

$sa spam_modifiessubj = 1; # in @spam modifies_subjmaps, default is true

# Example: modify Subject for all local recipients except user@example.com
#$sa spam_modifiessubj = [qw( !user@example.com . )];


Anything I'm missing? I noticed there is a amavisd.conf.personal file also in etc. Should I be tweaking that as well?

Thanks.

Hi David:

Here is an example of a passed spam:

date, etc: /usr/bin/amavisd[27596]: (27596-08) Passed SPAM, <hrunoff@innerekreis.de> -> <example@example.com>, Hits: 6.225, tag=-999, tag2=6, kill=9, 0/Y/Y/0

The spam passes on as it should but no X-SPAM header and no subject change.

Here's the output from grep ^[^#[:space:]] /etc/amavisd.conf:

$daemon_user = 'clamav'; # (no default; customary: vscan or amavis)
$daemon_group = 'clamav'; # (no default; customary: vscan or amavis)
$TEMPBASE = $MYHOME; # (must be set if other config vars use is)
$ENV{TMPDIR} = $TEMPBASE; # wise, but usually not necessary
$max_servers = 2; # number of pre-forked children (default 2)
$max_requests = 10; # retire a child after that many accepts (default 10)
$child_timeout=5*60; # abort child if it does not complete each task in n sec
@local_domains_acl = ( ".$mydomain" ); # $mydomain and its subdomains
$unix_socketname = "$MYHOME/amavisd.sock"; # amavis helper protocol socket
$inet_socket_port = 10024; # accept SMTP on this local TCP port
@inet_acl = qw( 127.0.0.1 ); # allow SMTP access only from localhost IP
$DO_SYSLOG = 0; # (defaults to false)
$LOGFILE = "/var/log/amavis.log"; # (defaults to empty, no log)
$log_level = 2; # (defaults to 0)
$log_templ = '[? %#V |[? %#F |[?%#D|Not-Delivered|Passed]|BANNED name/type (%F)]|INFECTED (%V)], #
<%o> -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c';
$final_virus_destiny = D_DISCARD; # (defaults to D_BOUNCE)
$final_banned_destiny = D_BOUNCE; # (defaults to D_BOUNCE)
$final_spam_destiny = D_DISCARD; # (defaults to D_REJECT)
$final_bad_header_destiny = D_PASS; # (defaults to D_PASS), D_BOUNCE suggested
$warnvirusrecip = 1; # (defaults to false (undef))
$viruses_that_fake_sender_re = new_RE(
$mailfrom_notify_admin = "virusalert\@$mydomain";
$mailfrom_notify_recip = "virusalert\@$mydomain";
$mailfrom_notify_spamadmin = "spam.police\@$mydomain";
$mailfrom_to_quarantine = undef; # original sender if undef, or set explicitly
$QUARANTINEDIR = '/var/virusmails';
$X_HEADER_TAG = 'X-Virus-Scanned'; # (default: undef)
$X_HEADER_LINE = "by amavisd-new at $mydomain";
$remove_existing_x_scanned_headers = 0; # leave existing X-Virus-Scanned alone
$remove_existing_spam_headers = 0; # leave existing X-Spam* headers alone
$keep_decoded_original_re = new_RE(
);
$banned_filename_re = new_RE(
);
$sql_select_white_black_list = undef; # undef disables SQL white/blacklisting
$recipient_delimiter = '+'; # (default is '+')
$localpart_is_case_sensitive = 0; # (default is false)
$blacklist_sender_re = new_RE(
);
map { $whitelist_sender{lc($_)}=1 } (qw(
));
$MAXLEVELS = 14; # (default is undef, no limit)
$MAXFILES = 1500; # (default is undef, no limit)
$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced)
$MIN_EXPANSION_FACTOR = 5; # times original mail size (must be specified)
$MAX_EXPANSION_FACTOR = 500; # times original mail size (must be specified)
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
$file = 'file'; # file(1) utility; use 3.41 or later to avoid vulnerability
$gzip = 'gzip';
$bzip2 = 'bzip2';
$lzop = 'lzop';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc = ['nomarch', 'arc'];
$unarj = ['arj', 'unarj']; # both can extract, same options
$unrar = ['rar', 'unrar']; # both can extract, same options
$zoo = 'zoo';
$lha = 'lha';
$cpio = 'cpio';
$sa_local_tests_only = 1; # (default: false)
$sa_mail_body_size_limit = 64*1024; # don't waste time on SA if mail is larger
$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 9.0;
$sa_spam_subject_tag = '*****SPAM*****'; # (defaults to undef, disabled)
$sa_spam_modifies_subj = 1; # in @spam_modifies_subj_maps, default is true
@av_scanners = (
);
@av_scanners_backup = (
);
1; # insure a defined return

Thanks for looking at this.

That did it! While I didn't have any virtual domains setup, I did have some aliases to which all of our emails are addressed. Thanks everyone for all the great insight and especially David for nailing it.