Bug 130492 - amavisd-new-2.4.0 is passing spam through
Bug#: 130492 Product:  Gentoo Linux Version: unspecified Platform: AMD64
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: antivirus@gentoo.org Reported By: fkrogh@mathalacarte.com
Component: Server
URL:  http://forums.gentoo.org/viewtopic.php?p=3267423#3267423
Summary: amavisd-new-2.4.0 is passing spam through
Keywords:  
Status Whiteboard: 
Opened: 2006-04-19 09:47 0000
Description:   Opened: 2006-04-19 09:47 0000
It may be a configuration issue, but there are two of us having stuff labeled
as spam that is not getting discarded as it should be. The spam goes to the
original recipient and to the quarantine recipient. If it is a configuration
issue perhaps the documentation could use a boost?  For both of us the old
version worked.  The URL above gives a link to the gentoo forums.  I'd be happy
to post my configuration file on request.  If requested indicate whether you
want the whole thing or just the noncomment lines.  Thanks,
Fred

=============== emerge --info
Portage 2.1_pre7-r5 (default-linux/amd64/2005.1, gcc-3.4.6, glibc-2.4-r1,
2.6.16-gentoo-r2 x86_64)
=================================================================
System uname: 2.6.16-gentoo-r2 x86_64 AMD Opteron(tm) Processor 242
Gentoo Base System version 1.12.0_pre17
dev-lang/python:     2.3.5, 2.4.2-r1
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r2
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r3
ACCEPT_KEYWORDS="amd64 ~amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=opteron -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config
/usr/lib64/mozilla/defaults/pref /usr/share/X11/xkb /usr/share/config
/var/qmail/control"
CONFIG_PROTECT_MASK="/etc/eselect/compiler /etc/gconf /etc/revdep-rebuild
/etc/terminfo /etc/texmf/web2c /etc/env.d"
CXXFLAGS="-O2 -march=opteron -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="http://gentoo.osuosl.org http://cudlug.cudenver.edu/gentoo
http://gentoo.binarycompass.org"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="amd64 X aac alsa apache2 auctex audiofile avi bash-completion bcmath
berkdb bitmap-fonts blas bonobo bzip2 calendar crypt ctype cups dbus dga
divx-linux dri dvd dvdr dvdread eds emacs emboss emul-linux86 encode esd fam
fastcgi fbcon flac foomaticdb fortran ftp gif gnome gphoto2 gpm gstreamer gtk
gtk2 imlib ipv6 isdnlog jpeg kde kerberos lapack lzw lzw-tiff mbox mcal mime
mng motif mouse mozcalendar mozilla mp3 mpeg mpi mysql mysqli ncurses nls nocd
nptl nptlonly nvidia offensive openal opengl osc oscar oss pam pdflib perl png
pop pop3d portaudio ppds pppd python qt quicktime readline samba sasl sdl
sharedmem sockets source sox speex spell ssl svg symlink tcltk tcpd tetex
threads tiff truetype truetype-fonts type1-fonts usb vhosts video_cards_nvidia
vorbis xine xpm xv xvid zlib elibc_glibc input_devices_keyboard
input_devices_mouse kernel_linux userland_GNU video_cards_vesa
video_cards_fbdev"
Unset:  ASFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL,
LDFLAGS, LINGUAS, PORTDIR_OVERLAY

------- Comment #1 From Joakim 2006-04-26 15:26:38 0000 -------
Yes emerged 2.4.0 some hours ago an emediately the spam started to flood our
inboxes.

------- Comment #2 From Andrej Kacian (RETIRED) 2006-04-27 01:21:58 0000 -------
Is there anything relevant in log files? Both during amavisd-new startup, and
during scanning of spam e-mail.

------- Comment #3 From Joakim 2006-04-27 02:38:51 0000 -------
here is what I get in my log starting Amavid-new

Apr 27 09:24:59 merc amavis[10869]: starting.  /usr/sbin/amavisd at
merc.astrocalc.net amavisd-new-2.4.0 (20060403), Unicode aware
Apr 27 09:24:59 merc amavis[10869]: user=, EUID: 0 (0);  group=, EGID: 0 27 26
20 11 10 6 4 3 2 1 0 (0 27 26 20 11 10 6 4 3 2 1 0); log_level=2
Apr 27 09:24:59 merc amavis[10869]: Perl version               5.008008
Apr 27 09:25:00 merc amavis[10869]: INFO: no optional modules:
Sys::Hostname::Long Mail::SPF::Query Net::CIDR::Lite
Mail::SpamAssassin::Plugin::DomainKeys Mail::DomainKeys::Header
Mail::DomainKeys::Message Mail::DomainKeys::Policy Mail::DomainKeys::Signature
Mail::DomainKeys::Key Mail::DomainKeys::Key::Public Crypt::OpenSSL::RSA
auto::Crypt::OpenSSL::RSA::new_public_key
auto::Crypt::OpenSSL::RSA::load_public_key auto::Crypt::OpenSSL::RSA::_new
auto::Crypt::OpenSSL::RSA::DESTROY IP::Country::Fast
Apr 27 09:25:00 merc amavis[10869]: SpamControl: init_pre_chroot done
Apr 27 09:25:00 merc amavis[10870]: Net::Server: Process Backgrounded
Apr 27 09:25:00 merc amavis[10870]: Net::Server: 2006/04/27-09:25:00 Amavis
(type Net::Server::PreForkSimple) starting! pid(10870)
Apr 27 09:25:00 merc amavis[10870]: Net::Server: Binding to UNIX socket file
/var/amavis/amavisd.sock using SOCK_STREAM
Apr 27 09:25:01 merc amavis[10870]: Net::Server: Binding to TCP port 10024 on
host 127.0.0.1
Apr 27 09:25:01 merc amavis[10870]: Net::Server: Setting gid to "1002 1002"
Apr 27 09:25:01 merc amavis[10870]: Net::Server: Setting uid to "10025"
Apr 27 09:25:01 merc amavis[10870]: Module Amavis::Conf        2.062
Apr 27 09:25:01 merc amavis[10870]: Module Archive::Tar        1.29
Apr 27 09:25:01 merc amavis[10870]: Module Archive::Zip        1.16
Apr 27 09:25:01 merc amavis[10870]: Module BerkeleyDB          0.27
Apr 27 09:25:01 merc amavis[10870]: Module Compress::Zlib      1.41
Apr 27 09:25:01 merc amavis[10870]: Module Convert::TNEF       0.17
Apr 27 09:25:01 merc amavis[10870]: Module Convert::UUlib      1.06
Apr 27 09:25:01 merc amavis[10870]: Module DBD::mysql          3.0002_4
Apr 27 09:25:01 merc amavis[10870]: Module DBI                 1.50
Apr 27 09:25:01 merc amavis[10870]: Module DB_File             1.814
Apr 27 09:25:01 merc amavis[10870]: Module Digest::MD5         2.36
Apr 27 09:25:01 merc amavis[10870]: Module MIME::Entity        5.420
Apr 27 09:25:01 merc amavis[10870]: Module MIME::Parser        5.420
Apr 27 09:25:01 merc amavis[10870]: Module MIME::Tools         5.420
Apr 27 09:25:01 merc amavis[10870]: Module Mail::Header        1.67
Apr 27 09:25:01 merc amavis[10870]: Module Mail::Internet      1.67
Apr 27 09:25:01 merc amavis[10870]: Module Mail::SpamAssassin  3.001001
Apr 27 09:25:01 merc amavis[10870]: Module Net::Cmd            2.26
Apr 27 09:25:01 merc amavis[10870]: Module Net::DNS            0.55
Apr 27 09:25:01 merc amavis[10870]: Module Net::SMTP           2.29
Apr 27 09:25:01 merc amavis[10870]: Module Net::Server         0.93
Apr 27 09:25:01 merc amavis[10870]: Module Razor2::Client::Version 2.81
Apr 27 09:25:01 merc amavis[10870]: Module Time::HiRes         1.86
Apr 27 09:25:01 merc amavis[10870]: Module Unix::Syslog        0.100
Apr 27 09:25:01 merc amavis[10870]: Amavis::DB code      loaded
Apr 27 09:25:01 merc amavis[10870]: Amavis::Cache code   loaded
Apr 27 09:25:01 merc amavis[10870]: SQL base code        NOT loaded
Apr 27 09:25:01 merc amavis[10870]: SQL::Log code        NOT loaded
Apr 27 09:25:01 merc amavis[10870]: SQL::Quarantine      NOT loaded
Apr 27 09:25:01 merc amavis[10870]: Lookup::SQL code     NOT loaded
Apr 27 09:25:01 merc amavis[10870]: Lookup::LDAP code    NOT loaded
Apr 27 09:25:01 merc amavis[10870]: AM.PDP-in proto code loaded
Apr 27 09:25:01 merc amavis[10870]: SMTP-in proto code   loaded
Apr 27 09:25:01 merc amavis[10870]: Courier proto code   NOT loaded
Apr 27 09:25:01 merc amavis[10870]: SMTP-out proto code  loaded
Apr 27 09:25:01 merc amavis[10870]: Pipe-out proto code  NOT loaded
Apr 27 09:25:01 merc amavis[10870]: BSMTP-out proto code NOT loaded
Apr 27 09:25:01 merc amavis[10870]: Local-out proto code loaded
Apr 27 09:25:01 merc amavis[10870]: OS_Fingerprint code  NOT loaded
Apr 27 09:25:01 merc amavis[10870]: ANTI-VIRUS code      loaded
Apr 27 09:25:01 merc amavis[10870]: ANTI-SPAM code       loaded
Apr 27 09:25:01 merc amavis[10870]: ANTI-SPAM-SA code    loaded
Apr 27 09:25:01 merc amavis[10870]: Unpackers code       loaded
Apr 27 09:25:01 merc amavis[10870]: Found $file            at /usr/bin/file
Apr 27 09:25:01 merc amavis[10870]: No $dspam,             not using it
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .mail
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .asc 
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .uue 
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .hqx 
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .ync 
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .F    at
/usr/bin/unfreeze
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .Z    at
/usr/bin/uncompress
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .gz  
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .gz   at /bin/gzip -d
(backup, not used)
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .bz2  at /bin/bzip2 -d
Apr 27 09:25:01 merc amavis[10870]: No decoder for       .lzo  tried: lzop -d
Apr 27 09:25:01 merc amavis[10870]: No decoder for       .rpm  tried:
rpm2cpio.pl, rpm2cpio
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .cpio at /bin/cpio
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .tar  at /bin/cpio
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .tar  (backup, not
used)
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .deb  at /usr/bin/ar
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .zip 
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .rar  at
/usr/bin/unrar
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .arj  at
/usr/bin/unarj
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .arc  at /usr/bin/arc
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .zoo  at /usr/bin/zoo
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .lha  at /usr/bin/lha
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .cab  at
/usr/bin/cabextract
Apr 27 09:25:01 merc amavis[10870]: No decoder for       .tnef tried: tnef
Apr 27 09:25:01 merc amavis[10870]: Internal decoder for .tnef
Apr 27 09:25:01 merc amavis[10870]: Found decoder for    .exe  at
/usr/bin/unrar; /usr/bin/lha; /usr/bin/unarj
Apr 27 09:25:01 merc amavis[10870]: Using internal av scanner code for
(primary) ClamAV-clamd
Apr 27 09:25:01 merc amavis[10870]: Found secondary av scanner ClamAV-clamscan
at /usr/bin/clamscan
Apr 27 09:25:01 merc amavis[10870]: Creating db in /var/amavis/db/; BerkeleyDB
0.27, libdb 4.2
Apr 27 09:25:01 merc amavis[10870]: SpamControl: initializing
Mail::SpamAssassin
Apr 27 09:25:04 merc amavis[10870]: SpamControl: init_pre_fork done
Apr 27 09:25:04 merc amavis[10919]: TIMING [total 49 ms] - bdb-open: 49
(100%)100, rundown: 0 (0%)100
Apr 27 09:27:20 merc amavis[10919]: (10919-01) ESMTP::10024
/var/amavis/tmp/amavis-20060427T092720-10919: <info@thegreatestwebsites.net> ->
<colin@astrocalc.com> SIZE=2840 Received: from merc.astrocalc.net ([127.0.0.1])
by localhost (merc.astrocalc.net [127.0.0.1]) (amavisd-new, port 10024) with
ESMTP for <colin@astrocalc.com>; Thu, 27 Apr 2006 09:27:20 +0000 (UTC)
Apr 27 09:27:20 merc amavis[10919]: (10919-01) Checking: fI3evGDZQjUn
[222.255.121.136] <info@thegreatestwebsites.net> -> <colin@astrocalc.com>
Apr 27 09:27:20 merc amavis[10919]: (10919-01) p001 1 Content-Type: text/html,
size: 2303 B, name: 
Apr 27 09:25:04 merc amavis[10920]: TIMING [total 57 ms] - bdb-open: 57
(100%)100, rundown: 0 (0%)100
Apr 27 09:25:05 merc amavis[10921]: TIMING [total 60 ms] - bdb-open: 60
(100%)100, rundown: 0 (0%)100

I can'r read out anything special from it though :-(

------- Comment #4 From Joakim 2006-04-27 03:01:25 0000 -------
And here is a log entry for an email that surely is flagged as spam, put into
quarantine BUT STILL end up deliverd to inbox by postfix:

Apr 27 09:45:05 merc amavis[11125]: (11125-01) ESMTP::10024
/var/amavis/tmp/amavis-20060427T094505-11125: <nicholas@paramed.biz> ->
<joakim@astrocalc.net> SIZE=21677 Received: from merc.astrocalc.net
([127.0.0.1]) by localhost (merc.astrocalc.net [127.0.0.1]) (amavisd-new, port
10024) with ESMTP for <joakim@astrocalc.net>; Thu, 27 Apr 2006 09:45:05 +0000
(UTC)
Apr 27 09:45:05 merc amavis[11125]: (11125-01) Checking: fAzvs06W9mXs
[65.191.131.238] <nicholas@paramed.biz> -> <joakim@astrocalc.net>
Apr 27 09:45:06 merc amavis[11125]: (11125-01) p004 1 Content-Type:
multipart/related
Apr 27 09:45:06 merc amavis[11125]: (11125-01) p005 1/1 Content-Type:
multipart/alternative
Apr 27 09:45:06 merc amavis[11125]: (11125-01) p001 1/1/1 Content-Type:
text/plain, size: 0 B, name: 
Apr 27 09:45:06 merc amavis[11125]: (11125-01) p002 1/1/2 Content-Type:
text/html, size: 445 B, name: 
Apr 27 09:45:06 merc amavis[11125]: (11125-01) p003 1/2 Content-Type:
image/gif, size: 14425 B, name: list9.gif
Apr 27 09:45:07 merc amavis[11125]: (11125-01) local delivery: <> ->
<spam-quarantine>, mbx=/var/amavis/quarantine/spam-fAzvs06W9mXs.gz
Apr 27 09:45:07 merc amavis[11125]: (11125-01) SPAM, <nicholas@paramed.biz> ->
<joakim@astrocalc.net>, Yes, score=17.86 tag=2 tag2=6.31 kill=6.31
tests=[BAYES_99=3.5, DATE_IN_PAST_03_06=0.478, EXTRA_MPART_TYPE=1.091,
HTML_90_100=0.113, HTML_IMAGE_ONLY_08=3.126, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_1=0.948, MIME_HTML_MOSTLY=1.102,
RCVD_IN_BL_SPAMCOP_NET=1.558, RCVD_IN_SORBS_DUL=2.046, RCVD_IN_XBL=3.897],
autolearn=no, quarantine fAzvs06W9mXs (spam-quarantine)
Apr 27 09:45:07 merc amavis[11125]: (11125-01) SPAM-TAG, <nicholas@paramed.biz>
-> <joakim@astrocalc.net>, Yes, score=17.86 tagged_above=2 required=6.31
tests=[BAYES_99=3.5, DATE_IN_PAST_03_06=0.478, EXTRA_MPART_TYPE=1.091,
HTML_90_100=0.113, HTML_IMAGE_ONLY_08=3.126, HTML_MESSAGE=0.001,
HTML_SHORT_LINK_IMG_1=0.948, MIME_HTML_MOSTLY=1.102,
RCVD_IN_BL_SPAMCOP_NET=1.558, RCVD_IN_SORBS_DUL=2.046, RCVD_IN_XBL=3.897]
Apr 27 09:45:08 merc amavis[11125]: (11125-01) FWD via SMTP:
<nicholas@paramed.biz> -> <joakim@astrocalc.net>, 250 2.6.0 Ok, id=11125-01,
from MTA([127.0.0.1]:10025): 250 Ok: queued as 04A6A7D5105
Apr 27 09:45:08 merc amavis[11125]: (11125-01) Passed SPAM, [65.191.131.238]
[65.191.131.238] <nicholas@paramed.biz> -> <joakim@astrocalc.net>, quarantine:
spam-fAzvs06W9mXs.gz, Message-ID:
<000001c669e0$23273280$0100007f@CPQ18944199075>, mail_id: fAzvs06W9mXs, Hits:
17.86, 2301 ms
Apr 27 09:45:08 merc amavis[11125]: (11125-01) TIMING [total 2318 ms] - SMTP
EHLO: 31 (1%)1, SMTP pre-MAIL: 6 (0%)2, mkdir tempdir: 2 (0%)2, create
email.txt: 13 (1%)2, SMTP pre-DATA-flush: 15 (1%)3, SMTP DATA: 20 (1%)4,
body_digest: 8 (0%)4, gen_mail_id: 3 (0%)4, mkdir parts: 2 (0%)4, mime_decode:
121 (5%)10, get-file-type2: 74 (3%)13, parts_decode: 2 (0%)13, AV-scan-1: 115
(5%)18, spam-wb-list: 10 (0%)18, SA msg read: 8 (0%)19, SA parse: 28 (1%)20, SA
check: 1378 (59%)79, SA finish: 16 (1%)80, update_cache: 8 (0%)80,
decide_mail_destiny: 3 (0%)80, write-header: 85 (4%)84, save-to-local-mailbox:
13 (1%)85, fwd-connect: 99 (4%)89, fwd-mail-from: 32 (1%)90, fwd-rcpt-to: 71
(3%)93, fwd-data-cmd: 2 (0%)93, write-header: 4 (0%)94, fwd-data-contents: 10
(0%)94, fwd-data-end: 72 (3%)97, fwd-rundown: 5 (0%)97, prepare-dsn: 3 (0%)98,
main_log_entry: 47 (2%)100, update_snmp: 4 (0%)100, unlink-2-files: 4 (0%)100,
rundown: 2 (0%)100
Apr 27 09:45:05 merc postfix/qmgr[24339]: F29E8658C12:
from=<nicholas@paramed.biz>, size=21677, nrcpt=1 (queue active)
Apr 27 09:45:08 merc postfix/qmgr[24339]: 04A6A7D5105:
from=<nicholas@paramed.biz>, size=22562, nrcpt=1 (queue active)
Apr 27 09:45:08 merc postfix/qmgr[24339]: F29E8658C12: removed
Apr 27 09:45:08 merc postfix/qmgr[24339]: 04A6A7D5105: removed
Apr 27 09:45:04 merc postfix/cleanup[11162]: F29E8658C12:
message-id=<000001c669e0$23273280$0100007f@CPQ18944199075>
Apr 27 09:45:08 merc postfix/smtp[11163]: F29E8658C12:
to=<joakim@astrocalc.net>, relay=127.0.0.1[127.0.0.1], delay=6, status=sent
(250 2.6.0 Ok, id=11125-01, from MTA([127.0.0.1]:10025): 250 Ok: queued as
04A6A7D5105)

------- Comment #5 From Joakim 2006-04-27 03:09:21 0000 -------
And here are the header of delivered email

Return-Path: <nicholas@paramed.biz>
X-Original-To: joakim@astrocalc.net
Delivered-To: joakim@astrocalc.net
Received: from localhost (localhost [127.0.0.1])
        by merc.astrocalc.net (Postfix) with ESMTP id 04A6A7D5105
        for <joakim@astrocalc.net>; Thu, 27 Apr 2006 09:45:07 +0000 (UTC)
X-Quarantine-ID: <fAzvs06W9mXs>
X-Virus-Scanned: amavisd-new at astrocalc.net
X-Spam-Flag: YES
X-Spam-Score: 17.86
X-Spam-Level: *****************
X-Spam-Status: Yes, score=17.86 tagged_above=2 required=6.31
        tests=[BAYES_99=3.5, DATE_IN_PAST_03_06=0.478, EXTRA_MPART_TYPE=1.091,
        HTML_90_100=0.113, HTML_IMAGE_ONLY_08=3.126, HTML_MESSAGE=0.001,
        HTML_SHORT_LINK_IMG_1=0.948, MIME_HTML_MOSTLY=1.102,
        RCVD_IN_BL_SPAMCOP_NET=1.558, RCVD_IN_SORBS_DUL=2.046,
        RCVD_IN_XBL=3.897]
Received: from merc.astrocalc.net ([127.0.0.1])
        by localhost (merc.astrocalc.net [127.0.0.1]) (amavisd-new, port 10024)
        with ESMTP id fAzvs06W9mXs for <joakim@astrocalc.net>;
        Thu, 27 Apr 2006 09:45:05 +0000 (UTC)
Received: from friend (cpe-065-191-131-238.nc.res.rr.com [65.191.131.238])
        by merc.astrocalc.net (Postfix) with ESMTP id F29E8658C12
        for <joakim@astrocalc.net>; Thu, 27 Apr 2006 09:45:02 +0000 (UTC)
Message-ID: <000001c669e0$23273280$0100007f@CPQ18944199075>
From: "Geoffrey" <nicholas@paramed.biz>
To: <joakim@astrocalc.net>
Subject: Any med for your girl to be happy! 
Date: Thu, 27 Apr 2006 05:51:21 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
        type="multipart/alternative";
        boundary="------------ms050107010301060503000304"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

------- Comment #6 From Andrej Kacian (RETIRED) 2006-04-27 04:03:12 0000 -------
I think where the problem might lie.
Unless you caught this annoyance and commented out the following line in
amavisd.conf, the setting that gets used for spam mail is D_PASS, because last
relevant lines in _ccat section are:

# to rely on a default %final_destiny_by_ccat and only change few settings:
$final_destiny_by_ccat{CC_SPAM} = D_PASS;
$final_destiny_by_ccat{CC_BADH} = D_BOUNCE;
$final_destiny_by_ccat{CC_BADH.',2'} = D_PASS;  # BadHdr8bit

The whole new *_ccat setting block is new, and looks like by default, all
example settings are uncommented. Please try commenting out every _ccat setting
except one, where you set your desired destiny for categories, and try
filtering mail again.

If this is indeed the problem, we'll have to modify the config file patch to
only include one uncommented final_destiny_by_ccat, set to sane values.

------- Comment #7 From Andrej Kacian (RETIRED) 2006-04-27 04:46:55 0000 -------
After trying a virgin amavisd-new install on my mail server and plugging it to
MTA, it seems to be discarding spam mails just OK. I've commented every
occurance of final_*_destiny and final_destiny_by_ccat, except for this one:

%final_destiny_by_ccat = (
  CC_VIRUS,      D_DISCARD,
  CC_BANNED,     D_BOUNCE,
  CC_UNCHECKED,  D_PASS,
  CC_SPAM,       D_DISCARD,
  CC_BADH,       D_PASS,
  CC_OVERSIZED,  D_BOUNCE,
  CC_CLEAN,      D_PASS,
  CC_CATCHALL,   D_PASS,
);

------- Comment #8 From Joakim 2006-04-27 05:09:41 0000 -------
Yes that's it!

Thanks

------- Comment #9 From Fred Krogh 2006-04-27 06:27:15 0000 -------
Many thanks.  A change in the default configuration file should eliminate this
problem for people like me who find the configuration file a bit mysterious. 
After seeing the fix though, it seems that I should have seen this.  What a
relief to have this resolved!

------- Comment #10 From Andrej Kacian (RETIRED) 2006-04-27 06:52:13 0000 -------
I'm glad your issue is resolved. I'll definitely change the default config file
in this regard.

Now, what would you (both of you, and anyone else reading this) propose as a
reasonable default? I think my posted version of %final_destiny_by_ccat would
do, but I'm looking for another opinion. There is possibility of more
fine-grained control for D_BADH (see examples in the configuration file).

------- Comment #11 From Fred Krogh 2006-04-27 07:10:02 0000 -------
I will probably change D_BADH to D_DISCARD, but I don't think this matters
much.  If all but one section is commented should make things clear. Another
way of dealing with this would be to have only one section like this and then
have entries such as

  CC_BADH,     D_PASS, # Use one of: D_PASS, D_BOUNCE, D_DISCARD, D_REJECT

Or perhaps better just at the top:
Say column 2 can be one of ...
For column 1, you could explain that adding ".',n'" as in for example,
CC_BADH,',4', instead of CC_BADH, will ... (I haven't a clue what this does!)

This would cut down on the number of lines in a terribly long configuration
file and remove one possible stupid mistake.

------- Comment #12 From dswhite42@yahoo.com 2006-04-28 22:36:25 0000 -------
Pardon me for bumping in, but I found this bug while searching for a new
spam-related problem I'm having with amavisd-new-2.4.0 (which wasn't happening
with earlier versions).

I've filed it as Bug 131634 - is it possibly related to this one, or is a
separate issue entirely?

Thanks very much!

------- Comment #13 From Andrej Kacian (RETIRED) 2006-06-02 14:06:15 0000 -------
Ok, it took a while, but I finally whipped myself to commit amavisd-new-2.4.1,
along with saner final destinies in the default config file.

BTW, in 2.4.1's sample config file, all %final_destiny_by_ccat examples are
commented out, unlike in 2.4.0. Looks like you guys weren't the only people hit
by this. :)

Anyway, thanks everyone involved!