salocal.cf - case sensitive?

[bowergo]

First attempt to white list an email address has unexpected results.

Is salocal.cf(.in) case sensitive with username@domain.tld?

Should there be some notation in the log and or headers about being white listed?

I see no log entry and nothing special in the headers.

[Centurion]

The salocal.cf needs to contain valid spamassassin rules. You can't just drop an e-mail address in there and expect it to know what to do with it.

If you're having trouble with the spamassassin rule syntax, just remember it's actually using Perl regular expressions. So in the case of the e-mail you've quoted, a simple rule might look like this:

header WHITE1 From=~/username\@domain\.tld/i
describe WHITE1 Drop score for username@domain.tld
score WHITE1 -100

That will lower the score for any message from 'username@domain.tld' by 100 points. Effectively, this means they will never be flagged as spam.

Alternatively, you can use the 'whitelist_from' or 'whitelist_from_rcvd' to accompish the same thing:

whitelist_from username@domain.tld

The 'whitelist_from' and 'whitelist_from_rcvd' both do exactly the same thing as the 3-line rule at the top (lower a matching message's score by 100). However, the 'whitelist_from_rcvd' will match against the envelope sender and thus makes it a little more accurate as spammers usually use the "From:" header to spoof a real user, and thus can defeat the 'whitelist_from' rule.

To answer your question, Perl regex IS case sensitive, unless you tell it otherwise:
/match some text/ - IS case sensitive
/MAtch sOme TExt/i - ISN'T case sensitive as it has the 'i' after the regex telling Perl to be case Insensitive.

Most of the time, when writing spamassassin rules, you'll want them to be case insensitive. I am believe the 'whitelist_...' rules are case insensitive by design.

There's more info in perldoc Mail::SpamAssassin::Conf (and here: Spamassassin WIKI)

Cheers,

James

[bowergo]

sorry, I should have provided my salocal.cf entries

working from the wiki
Improving Anti-spam system - ZimbraWiki

I inserted this line
/opt/zimbra/conf/salocal.cf.in
whitelist_from poor_email_etiquette@domain.tld

restarted antispam and now have this line
/opt/zimbra/conf/salocal.cf
whitelist_from poor_email_etiquette@domain.tld


I set my mail client to have an extra identity and sent an email posing as poor_email_etiquette@domain.tld

This is a snip of the headers obfuscated to protect the confused.

Received: from localhost (localhost.localdomain [127.0.0.1])
by mta-1.domain.tld (Postfix) with ESMTP id A441D255865B
for <bowergo@domain.tld>; Wed, 3 Oct 2007 00:04:46 -0400 (EDT)
X-Virus-Scanned: amavisd-new at
Received: from mta-1.domain.tld ([127.0.0.1])
by localhost (mta-1.domain.tld [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id BvUS9kw+FNdr for <bowergo@domain.tld>;
Wed, 3 Oct 2007 00:04:45 -0400 (EDT)
Received: from mail.domain.tld (mail-0.domain.tld [10.10.220.5])
by mta-1.domain.tld (Postfix) with ESMTP id D37982558636
for <bowergo@mta-1.domain.tld>; Wed, 3 Oct 2007 00:04:44 -0400 (EDT)
Received: from relay.domain.tld (hv.domain.tld [10.10.220.25])
by mail.domain.tld (8.11.6/8.11.6) with ESMTP id l9344n408444;
Wed, 3 Oct 2007 00:04:49 -0400
Message-ID: <>
Date: Wed, 03 Oct 2007 00:04:49 -0400
From: "poor_email_etiquette@domain.tld" <poor_email_etiquette@domain.tld>
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Bowergo <bowergo@domain.tld>
Subject: Whitelist test
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Test

I really expected to see some headers about the spam check, but see none.

[Bevan Bennett]

If the SPAM score is below a certain threshhold the X-Spam headers don't get added.

in /opt/zimbra/conf/amavisd.conf, look for a line like the following:
$sa_tag_level_deflt = -10.0; # add spam info headers if at, or above that level

In this case, anything scoring lower than -10 (which your whitelist certainly should) doesn't get headers added.

You could edit amavisd.conf.in, change this value temporarily to -1000, zmamavisdctl stop/start and repeat the test...

[Centurion]

The other option is to follow the /var/log/zimbra.log file as you send the message. Then, even though amavis wont insert the headers, you should still see the spamassassin result in the log file. This approach avoids restarting any Zimbra components or editing config files.

You can follow the logs with "tail -f <filename>" or "less <filename>" then hit SHIFT+F. The beauty of using "less" is you can easily pause/restart the scrolling, search for strings and other useful things.

HTH,

James

[bowergo]

Thank you.

...If the SPAM score is below a certain threshold the X-Spam headers don't get added...

This explains the headers. I have found the score in both zimbra.log and zmmsgtrace -s poor_email_etiquette@domain.tld

Hits: -93.658