Re: Questions about spamassassin

> On Jun 20, 2024, at 6:05 PM, Bill Cole <[email protected]> wrote:
> 
> On 2024-06-20 at 16:14:47 UTC-0400 (Thu, 20 Jun 2024 15:14:47 -0500)
> Paul Schmehl <[email protected] <mailto:[email protected]>>
> is rumored to have said:
> 
>> I’m running spamassassin (SA) 3.4, postfix 3.9.0-1, and dovecot 2.2.36-8 on a linux server. I have some questions about SA that I can’t seem to find answers for on the web.
>> 
>> The SA conf files are /etc/mail/spamassassin. The bayes files are in /usr/local/etc/mail/spamassassin/bayes.
>> 
>> I’m running spamd as the content_filter in postfix. spamassassin unix -      n       n       -       -      pipe
>>    user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}
>> 
>> Everything is working as expected, but I have some questions about permissions. Should spamd be the owner of /etc/mail/spamassassin?
> 
> No. It is entirely normal for any user to read the config files. The spamd user never needs to write to that directory or anything in it.

I set it back to root ownership.
> 
>> Of /usr/local/etc/mail/spamassassin?
> 
> Yes. The bayes_* files there are the active Bayes DB in use by the spamd daemon, so the user the daemon is running as needs to be able to do anything in that directory.

So spamd needs to be the owner of the bayes files.
> 
>> Today I got a warning about the unsafe perms on sa-update-keys. Who should own those and what should the perms be?
> 
> Files in that directory control whose signatures you trust on daily rules packages, so the directory should be owned by root, perms 0700.
> 
> 
>> Finally, I’m seeing this in my maillogs.
>> config: failed to parse line, skipping, in "/etc/mail/spamassassin/local.cf": bayes_
>> 
>> This is the config in local.cf:
>> bayes_path /usr/local/etc/mail/spamassassin/bayes/bayes
> 
> Is there any other line in that file starting with 'bayes_' ?
> 
> That error message is not lying to you: you have an error in local.cf which SA cannot parse around. Also look in the lines before the 'bayes_path' line for unterminated quotes.
> 
Here’s every line with bayes_ in it:
bayes_#auto_learn 1
bayes_learn_to_journal 1
bayes_path /usr/local/etc/mail/spamassassin/bayes/bayes
bayes_file_mode 0775
bayes_ignore_header ReSent-Date
bayes_ignore_header ReSent-From
bayes_ignore_header ReSent-Message-ID
bayes_ignore_header ReSent-Subject
bayes_ignore_header ReSent-To
bayes_ignore_header Resent-Date
bayes_ignore_header Resent-From
bayes_ignore_header Resent-Message-ID
bayes_ignore_header Resent-Subject
bayes_ignore_header Resent-To
 
I think that first line looks problematic.
> 
>> This is the contents of the bayes folder:
>> # ls -lsah /usr/local/etc/mail/spamassassin/bayes/
>> total 632K
>>   0 drwxrwxr-x 2 spamd spamd   63 Jun 20 11:36 .
>>   0 drwxrwxr-x 3 spamd spamd   19 Jun 13 06:00 ..
>> 96K -rw------- 1 spamd spamd  95K Jun 20 14:44 bayes_journal
>> 12K -rwxrwxrwx 1 spamd spamd  12K Jun 20 11:32 bayes_seen
>> 524K -rwxrwxrwx 1 spamd spamd 664K Jun 20 11:32 bayes_toks
>> 
>> spamd owns the directory /usr/local/etc/mail/spamassassin and all subdirectories. The perms are 775 for the directories and 777 for all files.  (I did this for testing purposes. They normally would be 755 and 644.)
> 
> I hope there's only you on that machine...

It is.
> 
> Using 'chmod 777' to troubleshoot permissions issues is always a bad idea.

Yeah, but when you run out of ideas…..

They’ve already been reset to normal since they didn’t change anything.

Paul Schmehl
[email protected]