dovecot - Jan 2015 - [SERVERBUG] failed to send mail with SA and antispam plugin

Thank you for your helpful hints on debugging this issue. I wanted first to get
the mail which generates this error but unfortunately the user already deleted
it as well from his trash. Now I got another hint and it looks like this mail
had a big attachment to it. Is it possible that spamc generated this error due
to the size of the mail?

Regards
ML




On Thursday, January 15, 2015 8:29 AM, Steffen Kaiser <skdovecot at
smail.inf.fh-brs.de> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 15 Jan 2015, ML mail wrote:

It would be better to have the original question & discussion at the top, 
so one could cut and read nicely,
> On Wednesday, January 14, 2015 9:06 PM, Pascal Volk <user+dovecot at
localhost.localdomain.org> wrote:
> On 01/14/2015 03:05 PM, ML mail wrote:
>
>> Hello,
>>
>> I am using the antispam plugin of Dovecot with SpamAssassin and in some
cases when users move back mails from the Spam folder to their INBOX (false
positive) they get the following error message:
>>
>> [SERVERBUG] failed to send mail
> # 2.1.7: /etc/dovecot/dovecot.conf
> # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4
[cut]
> plugin {
> antispam_backend = pipe
> antispam_pipe_program = /usr/bin/spamc
> antispam_pipe_program_args = -d;my-mx-server.domain.com;-u;amavis
> antispam_pipe_program_notspam_args = -L;ham
> antispam_pipe_program_spam_args = -L;spam
> antispam_pipe_tmpdir = /tmp
> antispam_signature = X-Spam-Flag
> antispam_signature_missing = error
> antispam_spam = INBOX.Spam;INBOX.Junk
> antispam_trash = INBOX.trash;trash;INBOX.Trash;Trash;INBOX.Deleted
Items;Deleted Items;INBOX.Deleted Messages;Deleted Messages
> antispam_verbose_debug = 1
What does the Plugin log?

[cut]
> service quota-warning {
> executable = script /usr/local/bin/quota-warning.sh
> unix_listener quota-warning {
> user = vmail
> }
> user = vmail
> }
You seem to use a virtual user configuration, so the antispam plugin 
executes spamc as user vmail, correct?

What happens if you run the program manually?
sudo -u vmail /usr/bin/spamc -d my-mx-server.domain.com -u amavis -L ham \ 
< message

You can also trace the program with a wrapper script. Replace 
antispam_pipe_program with /usr/local/bin/spamc-wrapper

==== BEGIN /usr/local/bin/spamc-wrapper
#/bin/bash

( # when and who
  date;id;
  let i=0
  # what
  echo /usr/bin/spamc "$@"
  # see embedded spaces in arguments
  for arg; do
   let i=i+1
   echo "Arg#$i: '$arg'"
  done
  # call original program

  /usr/bin/spamc "$@"
  # log return code / exit code
  rc=$?
  echo rc=$rc
  # Make sure the rc is returned back to caller
  exit $rc

  # log everything into a file
) >>/tmp/spamc-wrapper.log 2>&1
==== END

If you have lots of simultaneous calls, create one log file per call -> 
add .$$ to filename.

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBVLdsenz1H7kL/d9rAQI5wQf/R/8IIWAgcLX8061FBI5gFxEH8jP8UVMb
MoSkkRT88teQJYuDxjr8zA92MX/2HDruRstzwxgJ1WxPefOvETpzGs1wrFqtWABM
2qB/ENfmkyOgmvpfsX5j6armYgOGEK0j5lf/ulV2i110wAJqjWY+9hBekFs7g4Th
j29D42kv5Tl0XVwJbbYfzH/gUB+kyLxV7ja3dWWmmRRNV9am4Du36zua5AB2BzYq
kuSqXfxClbnRYA/Ajy8H1KYhmx8wRtjkNijxt8B7R5f04E8hLrFVd5lKZIieuO6e
oNu45xHeW3mYas0I3jWBf0u5pt1XlP7RLOtdB3D15CsW42PPsDcKxw==Beji
-----END PGP SIGNATURE-----

Thanks to your help Steffen I was able to find out the issue which was simply
the size of the Spam mail as you can see here:

spamc[16545]: skipped message, greater than max message size (512000 bytes)

The spam mail was around 900 kbytes as such I have changed the spamc limit to
1MB. Bastard spammer who abuses this limit by attaching a big image...

Regards
ML







On Thursday, January 15, 2015 12:23 PM, ML mail <mlnospam at yahoo.com>
wrote:
Thank you for your helpful hints on debugging this issue. I wanted first to get
the mail which generates this error but unfortunately the user already deleted
it as well from his trash. Now I got another hint and it looks like this mail
had a big attachment to it. Is it possible that spamc generated this error due
to the size of the mail?

Regards
ML





On Thursday, January 15, 2015 8:29 AM, Steffen Kaiser <skdovecot at
smail.inf.fh-brs.de> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 15 Jan 2015, ML mail wrote:

It would be better to have the original question & discussion at the top, 
so one could cut and read nicely,
> On Wednesday, January 14, 2015 9:06 PM, Pascal Volk <user+dovecot at
localhost.localdomain.org> wrote:
> On 01/14/2015 03:05 PM, ML mail wrote:
>
>> Hello,
>>
>> I am using the antispam plugin of Dovecot with SpamAssassin and in some
cases when users move back mails from the Spam folder to their INBOX (false
positive) they get the following error message:
>>
>> [SERVERBUG] failed to send mail
> # 2.1.7: /etc/dovecot/dovecot.conf
> # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4
[cut]
> plugin {
> antispam_backend = pipe
> antispam_pipe_program = /usr/bin/spamc
> antispam_pipe_program_args = -d;my-mx-server.domain.com;-u;amavis
> antispam_pipe_program_notspam_args = -L;ham
> antispam_pipe_program_spam_args = -L;spam
> antispam_pipe_tmpdir = /tmp
> antispam_signature = X-Spam-Flag
> antispam_signature_missing = error
> antispam_spam = INBOX.Spam;INBOX.Junk
> antispam_trash = INBOX.trash;trash;INBOX.Trash;Trash;INBOX.Deleted
Items;Deleted Items;INBOX.Deleted Messages;Deleted Messages
> antispam_verbose_debug = 1
What does the Plugin log?

[cut]
> service quota-warning {
> executable = script /usr/local/bin/quota-warning.sh
> unix_listener quota-warning {
> user = vmail
> }
> user = vmail
> }
You seem to use a virtual user configuration, so the antispam plugin 
executes spamc as user vmail, correct?

What happens if you run the program manually?
sudo -u vmail /usr/bin/spamc -d my-mx-server.domain.com -u amavis -L ham \ 
< message

You can also trace the program with a wrapper script. Replace 
antispam_pipe_program with /usr/local/bin/spamc-wrapper

==== BEGIN /usr/local/bin/spamc-wrapper
#/bin/bash

( # when and who
  date;id;
  let i=0
  # what
  echo /usr/bin/spamc "$@"
  # see embedded spaces in arguments
  for arg; do
   let i=i+1
   echo "Arg#$i: '$arg'"
  done
  # call original program

  /usr/bin/spamc "$@"
  # log return code / exit code
  rc=$?
  echo rc=$rc
  # Make sure the rc is returned back to caller
  exit $rc

  # log everything into a file
) >>/tmp/spamc-wrapper.log 2>&1
==== END

If you have lots of simultaneous calls, create one log file per call -> 
add .$$ to filename.

- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBVLdsenz1H7kL/d9rAQI5wQf/R/8IIWAgcLX8061FBI5gFxEH8jP8UVMb
MoSkkRT88teQJYuDxjr8zA92MX/2HDruRstzwxgJ1WxPefOvETpzGs1wrFqtWABM
2qB/ENfmkyOgmvpfsX5j6armYgOGEK0j5lf/ulV2i110wAJqjWY+9hBekFs7g4Th
j29D42kv5Tl0XVwJbbYfzH/gUB+kyLxV7ja3dWWmmRRNV9am4Du36zua5AB2BzYq
kuSqXfxClbnRYA/Ajy8H1KYhmx8wRtjkNijxt8B7R5f04E8hLrFVd5lKZIieuO6e
oNu45xHeW3mYas0I3jWBf0u5pt1XlP7RLOtdB3D15CsW42PPsDcKxw==Beji
-----END PGP SIGNATURE-----

Am 16.01.2015 um 09:46 schrieb ML mail:
> Thanks to your help Steffen I was able to find out the issue which was
simply the size of the Spam mail as you can see here:
>
> spamc[16545]: skipped message, greater than max message size (512000 bytes)
>
> The spam mail was around 900 kbytes as such I have changed the spamc limit
to 1MB. Bastard spammer who abuses this limit by attaching a big image...
that's common for years now, even as we used a Barracuda Networks device 
where you need to add &expert=1 in the extended settings to raise that limit

given that only a small amount makes it to SA here i increased that to 5 
MB, in case of large images there is no performance impact, only large 
messages with most plaintext are ressource hungry to scan

in fact i have seen such bastards attach 2 MB images to the typical spam 
mailbody to bypass scanners


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20150116/8a6f4421/attachment.sig>