On 08/16/2010 12:00 AM, Gordon Messmer wrote:
On 08/15/2010 04:40 PM, Kevin J. Cummings wrote:
The "From" address is: root@kjc386.framingham.ma.us which makes sense since it is being run directly as a cron.hourly script. I have added this whitelist_from_rcvd to /etc/mail/spamassassin/local.cf.
whitelist_from_rcvd also requires the hostname of the sending system, as recorded in the Received: header. Take a look at one of the messages that you've received to get this value.
Oops, I missed that when reading the documentation. Fixed. Added framingham.ma.us as the hostname.
Your other option is to simply not run SpamAssassin on messages that you receive from hosts under your control, but since you haven't told us how you run SA, I don't know how you'd do that.
I had already tried to do that by adding this line to my /etc/mail/spamassassin/local.cf file:
trusted_networks 192.168.6/24
That's not quite what I meant. That still filters mail from your internal hosts through spamassassin, but tells it to lower the message scores from those hosts. If that didn't work, you'd probably need to snag one of the messages marked as SPAM, save the complete set of headers to a file, and send it to the list. Don't modify anything in the headers. Don't exclude any of the headers. If you do, no one will be able to tell you what your host wasn't affected by the trusted_networks setting.
My 11:00 email got marked as [SPAM], here are the email headers:
Return-Path: root@kjc386.framingham.ma.us X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on kjc386.framingham.ma.us X-Spam-Level: X-Spam-Status: No, score=0.3 required=4.0 tests=ALL_TRUSTED,BAYES_00, FRT_ADOBE2,NORMAL_HTTP_TO_IP,NUMERIC_HTTP_ADDR,SPF_PASS,URI_HEX autolearn=no version=3.3.1 Received-SPF: pass (kjc386.framingham.ma.us: domain of root@kjc386.framingham.ma.us designates 127.0.0.1 as permitted sender) receiver=kjc386.framingham.ma.us; client-ip=127.0.0.1; helo=kjc386.framingham.ma.us; envelope-from=root@kjc386.framingham.ma.us; x-software=spfmilter 0.97 http://www.acme.com/software/spfmilter/ with libspf2-1.0.0; X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.96 at kjc386.framingham.ma.us Received: from kjc386.framingham.ma.us (localhost [127.0.0.1]) by kjc386.framingham.ma.us (8.14.4/8.14.4) with ESMTP id o7G312re009755 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for root@kjc386.framingham.ma.us; Sun, 15 Aug 2010 23:01:02 -0400 Received: (from root@localhost) by kjc386.framingham.ma.us (8.14.4/8.14.4/Submit) id o7G312a1009752 for root; Sun, 15 Aug 2010 23:01:02 -0400 From: root root@kjc386.framingham.ma.us Message-Id: 201008160301.o7G312a1009752@kjc386.framingham.ma.us Date: Sun, 15 Aug 2010 23:01:02 -0400 To: root@kjc386.framingham.ma.us Subject: [SPAM] kjc386.framingham.ma.us 08/15/10:23.01 system check User-Agent: Heirloom mailx 12.4 7/29/08 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.2 (kjc386.framingham.ma.us [127.0.0.1]); Sun, 15 Aug 2010 23:01:02 -0400 (EDT)
[I'm wondering *why* it says [SPAM] if the X-Spam-Status score is 0.3?]
Do I need to use localhost or kjc386.framingham.ma.us as the hostname for the whitelist_from_rcvd line?
and my mail server is on that network.... Do I need to do the same for 127.0.0.1? (since the email is originating on the same system as the mail server?)
I'm not entirely sure, honestly. If the message was submitted with SMTP, you probably should.
I added 127.0.0/24 as a trusted network as well.
BTW, I get all of root's emails sent to me through a sendmail alias. If that matters....