Spamassassin not tagging subject line

[nsusa]

SA is adding appropriate headers to incoming SPAM emails, but it is not adding a tag to the subject line. I am on a new cpanel 11 server for just a few days now. I am not seeing a setting to have it tag the subject line. What am I missing? Where can I turn it on?

Thanks.

Chris

X-Spam-Subject: ***SPAM***
X-Spam-Status: Yes, score=11.8
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "hostname.domainname.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: [...]
Content analysis details: (11.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
4.4 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr
2)
0.5 FH_HELO_EQ_D_D_D_D Helo is d-d-d-d
1.0 SPF_FAIL SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.org/Why?s=mfrom&i...omainname.com]
2.9 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
1.3 MISSING_SUBJECT Missing Subject: header
0.6 EMPTY_MESSAGE Message appears to have no textual parts and no
Subject: text
1.0 TVD_PDF_FINGER01 Mail matches standard pdf spam fingerprint
X-Spam-Flag: YES

[mtindor]

Are you an end-user or are you a server administrator with WHM access?

The server administrator needs to log into WHM and then go into the Exim Configuration Editor and then checkmark the option to enable subject rewriting and save the config.

Then the administrator needs to make sure that the line in exim.conf that handles the subject rewriting is properly set - There is a bug in Cpanel 11 whereby some admins who enable subject rewriting will have the subject replaced with ***SPAM*** instead of having the subject prefixed with ***SPAM***.

Some early updates of Cpanel 11 had the following line in /etc/exim.conf:

add_header = X-Spam-Subject: ***SPAM*** $h_subject

More recent updates of Cpanel 11 had the following line in /etc/exim.conf:

add_header = X-Spam-Subject: [% ACL_SPAM_HEADER %] $h_subject

The problem with either of these lines is the $h_subject on the end - that should be a capital S in Subject in $h_Subject.

So if you are the administrator and you can look in your exim.conf and search for $h_subject and change it to $h_Subject - save exim.conf and restart Exim. Even better, do this through the Exim Configuration Editor in WHM - find $h_subject and replace with $h_Subject and save the config.

NOTE: Subject Rewriting can only be turned on/off globally now. The individual accountholders no longer have the option to enable subject rewriting. If the admin chooses to enable it in WHM, then ALL accounts on the server will have the subject rewritten for spam messages if they have spamassassin enabled. If the admin chooses to disable it, then NO account on the server will have the subject rewritten for spam messages.

So if you are not the server admin, you'll want to contact your web host and ask them if they have subject rewriting in WHM, or if they will enable it. Then you can go from there. You might want to point them to this thread for some information in case they need it. There are better threads about this as well - just search the Cpanel forums for subject rewriting.

Mike

[nsusa]

Thanks, Mike. Please see my responses below.

Are you an end-user or are you a server administrator with WHM access?

I am the admin with full root access.

The server administrator needs to log into WHM and then go into the Exim Configuration Editor and then checkmark the option to enable subject rewriting and save the config.

I do not see a checkmark for that at all. I am on WHM 11.2.0 cPanel 11.6.0-R15076

Then the administrator needs to make sure that the line in exim.conf that handles the subject rewriting is properly set - There is a bug in Cpanel 11 whereby some admins who enable subject rewriting will have the subject replaced with ***SPAM*** instead of having the subject prefixed with ***SPAM***.

Some early updates of Cpanel 11 had the following line in /etc/exim.conf:

add_header = X-Spam-Subject: ***SPAM*** $h_subject

More recent updates of Cpanel 11 had the following line in /etc/exim.conf:

add_header = X-Spam-Subject: [% ACL_SPAM_HEADER %] $h_subject

The problem with either of these lines is the $h_subject on the end - that should be a capital S in Subject in $h_Subject.

So if you are the administrator and you can look in your exim.conf and search for $h_subject and change it to $h_Subject - save exim.conf and restart Exim. Even better, do this through the Exim Configuration Editor in WHM - find $h_subject and replace with $h_Subject and save the config.

It was indeed lower case and I changed it to upper case "S", but it did not make a difference.

NOTE: Subject Rewriting can only be turned on/off globally now. The individual accountholders no longer have the option to enable subject rewriting. If the admin chooses to enable it in WHM, then ALL accounts on the server will have the subject rewritten for spam messages if they have spamassassin enabled. If the admin chooses to disable it, then NO account on the server will have the subject rewritten for spam messages.

That's fine - I only host my own sites. I just wish I could turn it on. Any idea what is going on?

Chris

[nsusa]

Ok, here is what is going on, but don't know why.

The "Filters" section in Exim is not visible. It is almost like a collapsed menu, but with no option to expand it. So, I can't access the options underneath.

Chris

[mtindor]

Thanks, Mike. Please see my responses below.



I am the admin with full root access.



I do not see a checkmark for that at all. I am on WHM 11.2.0 cPanel 11.6.0-R15076



It was indeed lower case and I changed it to upper case "S", but it did not make a difference.




That's fine - I only host my own sites. I just wish I could turn it on. Any idea what is going on?

Chris

Chris - did you make the change to h_Subject from within WHM/Exim Configuration Editor, or did you make the change by manually editing exim.conf?

If you made the change by manually editing exim.conf, then you'll need to do something such as /scripts/restartsrv_exim

In the Exim Configuration Editor there should be an option to enable subject rewrites. Unfortunately I can't tell you exactly where it was because I run some custom ACLs and as soon as I added those in via the Exim Configuration Editor, it took out about half of the options that I see in the Exim Configuration Manager. All of my config works fine and as intended, but the Exim Configuration Editor doesn't display for me what it does by default for anyone else and so I can't tell you what to select.

You should have something in your exim.conf already that looks similar to what I have below:

  warn
    condition = ${if eq {${acl_m0}}{1}{1}{0}}
    spam =  ${acl_m1}/defer_ok
    log_message = "SpamAssassin as ${acl_m1} detected message as spam"
    add_header = X-Spam-Subject: [SPAM] $h_Subject
    add_header = X-Spam-Status: Yes, score=$spam_score
    add_header = X-Spam-Score: $spam_score_int
    add_header = X-Spam-Bar: $spam_bar
    add_header = X-Spam-Report: $spam_report
    add_header = X-Spam-Flag: YES
    set acl_m2 = 1

But instead of add_header = X-Spam-Subject: [SPAM] $h_Subject that I have above, you probably have either the of the two following lines:

add_header = X-Spam-Subject: ***SPAM*** $h_subject

or

add_header = X-Spam-Subject: [% ACL_SPAM_HEADER %] $h_subject

Oh - Maybe you dont have that bottom line in Exim Configuration Editor - you know, the one that tells it to use /etc/cpanel_exim_system_filter. The actual rewriting of the subject happens in /etc/cpanel_exim_system_filter I believe - and if you don't have it specified in Exim Configuration Editor and instead have that disabled, you won't get the subject rewrite.

Mike

[mtindor]

Ok, here is what is going on, but don't know why.

The "Filters" section in Exim is not visible. It is almost like a collapsed menu, but with no option to expand it. So, I can't access the options underneath.

Chris

Yep I know exactly what you are talking about. I bet you added some custom ACLs to your Exim since Cpanel 11, didn't you? As soon as I added a dictionary ACL (from Chirpy's site) and some HELO checking, I no longer had anything listed under the Filters section.

Mike

[cpanelnick]

$h_Subject and $h_subject are the same thing

its case insensitive matching

from the exim manual (section 11)

Upper case and lower case letters are synonymous in header names. If the following character is white space, the terminating colon may be omitted, but this is not recommended, because you may then forget it when it is needed. When white space terminates the header name, it is included in the expanded string. If the message does not contain the given header, the expansion item is replaced by an empty string. (See the def condition in section 11.7 for a means of testing for the existence of a header.)


http://www.exim.org/exim-html-curren...tml#SECTexpvar

[nsusa]

Yep I know exactly what you are talking about. I bet you added some custom ACLs to your Exim since Cpanel 11, didn't you? As soon as I added a dictionary ACL (from Chirpy's site) and some HELO checking, I no longer had anything listed under the Filters section.

Mike

You hit the nail on the head. That now got me back up and running and I am now seeing those options again. I really appreciate your help Thanks.

Chris

[mtindor]

Keep on saying that - but keep in mind that both times after Cpanel 11 upgrades this was changed to h_subject and it was NOT adding the subject after it prefixed the subject with ***SPAM*** - And it was because the subject was not stored in $h_subject - it was stored in $h_Subject. As soon as I cahnged it to use h_Subject, it started displaying the full subject after the ***SPAM*** tag instead of just displaying ***SPAM***.

I'm not imagining things.

Would you like me to prove it to you on our Cpanel machine? I can reproduce this problem in an instant simply by going in and changing h_Subject to h_subject and restarting Exim. As soon as I do that, spam messages with the subject rewritten only display ***SPAM*** instead of ***SPAM*** <original subject>

Mike

$h_Subject and $h_subject are the same thing

its case insensitive matching

from the exim manual (section 11)

Upper case and lower case letters are synonymous in header names. If the following character is white space, the terminating colon may be omitted, but this is not recommended, because you may then forget it when it is needed. When white space terminates the header name, it is included in the expanded string. If the message does not contain the given header, the expansion item is replaced by an empty string. (See the def condition in section 11.7 for a means of testing for the existence of a header.)


http://www.exim.org/exim-html-curren...tml#SECTexpvar

[cpanelnick]

Keep on saying that - but keep in mind that both times after Cpanel 11 upgrades this was changed to h_subject and it was NOT adding the subject after it prefixed the subject with ***SPAM*** - And it was because the subject was not stored in $h_subject - it was stored in $h_Subject. As soon as I cahnged it to use h_Subject, it started displaying the full subject after the ***SPAM*** tag instead of just displaying ***SPAM***.

I'm not imagining things.

Would you like me to prove it to you on our Cpanel machine? I can reproduce this problem in an instant simply by going in and changing h_Subject to h_subject and restarting Exim. As soon as I do that, spam messages with the subject rewritten only display ***SPAM*** instead of ***SPAM*** <original subject>

Mike

I'd love (I've spent hours and hours on this without getting it to break) to see it reproduced. I can't get it to happen. I've dug though the exim source code line by line :

Here is the test for matching the header (line 1192) expand.c:

if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))

and the compare function:

/*************************************************
* Case-independent strncmp() function *
*************************************************/

/*
Arguments:
s first string
t second string
n number of characters to compare

Returns: < 0, = 0, or > 0, according to the comparison
*/

int
strncmpic(uschar *s, uschar *t, int n)
{
while (n--)
{
int c = tolower(*s++) - tolower(*t++);
if (c) return c;
}
return 0;
}

[mtindor]

Alright Nick (edited to be a little nicer). In an effort to grant you your wish, I proceeded to change the WHM IP so you could log in and reproduce it.

But... (yeah, you can gloat now I suppose), for shits and grins I went ahead and edited it myself to be $h_subject and restarted it and it kept the intregity of the original subject line intact. So you're right, and I am wrong.

However, that does not explain what I had experienced after the Cpanel update.
- updated Cpanel to 11 I'm guessing sometime last month
- spam messages were instantly showing up with ***SPAM*** as the _only_ thing in the subject
- I did a search on the forums here, and some other person on the forums experienced the same problem and suggested that changing $h_subject to $h_Subject fixed the problem for them
- I tried this - it worked for me as well

- then I updated to a more recent version of Cpanel 11 and reset my exim config from WHM
- as soon as I reset it, I had the same problem with spam message subjects having ***SPAM*** as the only thing in the subject
- I repeated the 'fix' that I performed previously, restarted Exim and voila it worked fine

So without further ado I proclaimed that changing $h_subject to $h_Subject fixed the problem. And I still stand by that - at least to the extent that editing that line did in fact fix my problem. I did not edit anything else whatsoever except for that line.

I'll attempt to be really humble now and bow to your guru likeness and ask this: Is it possible that _something_ in the default exim.conf configuration (after you reset the exim config) such as some strange 'invisible' character could be in that line and that when I would go in and edit that line (I always changed ***SPAM*** to [SPAM] at the same time that i changed $h_subject to $h_Subject) could have been removed - and that this character was causing a problem?

I am not the only one who experienced the problem, and simply editing that line fixed it for me as it had for at least one other person.

So, what is your opinion on that hypothesis? I'd really love to test it again myself, but I don't really feel like setting exim.conf back to default to test it and then re-adding the extra ACLs that I use. Both times this happened after resetting exim.conf from within WHM - and it happened on two different releases of Cpanel 11 within the past month.

Mike

PS: I would not have been such a wiseass to your original response if I hadn't thought that you were trying to talk down to me and disprove my theory without addressing me directly about it and just saying 'i dont think that's the problem Mike' - I took offense at that.

I'd love (I've spent hours and hours on this without getting it to break) to see it reproduced. I can't get it to happen. I've dug though the exim source code line by line :

Here is the test for matching the header (line 1192) expand.c:

if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))

and the compare function:

/*************************************************
* Case-independent strncmp() function *
*************************************************/

/*
Arguments:
s first string
t second string
n number of characters to compare

Returns: < 0, = 0, or > 0, according to the comparison
*/

int
strncmpic(uschar *s, uschar *t, int n)
{
while (n--)
{
int c = tolower(*s++) - tolower(*t++);
if (c) return c;
}
return 0;
}

[cpanelnick]

Alright Nick (edited to be a little nicer). In an effort to grant you your wish, I proceeded to change the WHM IP so you could log in and reproduce it.

But... (yeah, you can gloat now I suppose), for shits and grins I went ahead and edited it myself to be $h_subject and restarted it and it kept the intregity of the original subject line intact. So you're right, and I am wrong.

However, that does not explain what I had experienced after the Cpanel update.
- updated Cpanel to 11 I'm guessing sometime last month
- spam messages were instantly showing up with ***SPAM*** as the _only_ thing in the subject
- I did a search on the forums here, and some other person on the forums experienced the same problem and suggested that changing $h_subject to $h_Subject fixed the problem for them
- I tried this - it worked for me as well

- then I updated to a more recent version of Cpanel 11 and reset my exim config from WHM
- as soon as I reset it, I had the same problem with spam message subjects having ***SPAM*** as the only thing in the subject
- I repeated the 'fix' that I performed previously, restarted Exim and voila it worked fine

[random thoughts]
So without further ado I proclaimed that changing $h_subject to $h_Subject fixed the problem. And I still stand by that - at least to the extent that editing that line did in fact fix my problem. I did not edit anything else whatsoever except for that line.
[/random thoughts]

I'll attempt to be really humble now and bow to your guru likeness and ask this: Is it possible that _something_ in the default exim.conf configuration (after you reset the exim config) such as some strange 'invisible' character could be in that line and that when I would go in and edit that line (I always changed ***SPAM*** to [SPAM] at the same time that i changed $h_subject to $h_Subject) could have been removed - and that this character was causing a problem?

It could simple be saving the exim config solved the problem as it caused it to be rebuilt. Maybe any change would have solved it.

I am not the only one who experienced the problem, and simply editing that line fixed it for me as it had for at least one other person.

So, what is your opinion on that hypothesis? I'd really love to test it again myself, but I don't really feel like setting exim.conf back to default to test it and then re-adding the extra ACLs that I use. Both times this happened after resetting exim.conf from within WHM - and it happened on two different releases of Cpanel 11 within the past month.

Mike

PS: I would not have been such a wiseass to your original response if I hadn't thought that you were trying to talk down to me and disprove my theory without addressing me directly about it and just saying 'i dont think that's the problem Mike' - I took offense at that.

Like any text media its really hard to gauge responses. I tend to be blunt and come off much more harsh then I mean all the time. I know there are times I take things the wrong way. After all the internet can be pretty dehumanizing.

Likewise, I'm not on a quest to disprove your theory, just to find the problem and fix it. If I didn't think there might be some merit to the idea I wouldn't have spent hours coming over the config and exim code .

[mtindor]

It could simple be saving the exim config solved the problem as it caused it to be rebuilt. Maybe any change would have solved it.

I've seen odder things happen. So I guess we'll just chalk it up to that. In the future if somebody has the problem I'll just suggest that they make _any_ change and save it and see if it fixes it.

Like any text media its really hard to gauge responses. I tend to be blunt and come off much more harsh then I mean all the time. I know there are times I take things the wrong way. After all the internet can be pretty dehumanizing.

Indeed. I'm actually pissed at myself now for reading so much into a simple post. Although Im 40, my pride still often goeth before my fall and I don't like being 'shot down'. Time for a brew

Likewise, I'm not on a quest to disprove your theory, just to find the problem and fix it. If I didn't think there might be some merit to the idea I wouldn't have spent hours coming over the config and exim code .

Understood.

Mike

[anton_latvia]

Sorry guys to bother this thread, but have you found some solution for this issue?

Anton.

[mtindor]

Sorry guys to bother this thread, but have you found some solution for this issue?

Anton.

Well, if you are still experiencing the problem, just edit the exim.conf manually (even a small edit) and then save it and restart exim and see if that fixes it. By default, on Cpanel 11 it is going to tag the prefix the subject line of spam messages with ***SPAM*** if it is working. If it is not showing the actual subject but simply showing ***SPAM*** in the subject line and nothing more, it is probably just some idiosyncracy with the exim.conf file. I thought it was the $h_Subject line - but it has been proven that $h_subject is fine as well. BUT, editing the exim.conf to modify that, saving the exim.conf, and then restarting exim fixed it. So just try changing $h_subject to $h_Subject, saving exim.conf and restarting - Then change it back once it is working.

It's not a problem with that line itself - but editing that line and then editing it back seems to fix it.

Mike

PS: If you mean you aren't seeing the subject line being tagged AT ALL, then you need to enable rewriting in the Exim Configuration Editor. And if you recently upgraded to Cpanel 11 and had some previous modifications in exim.conf, you should really document those modifications and then reset it back to default from wtithin the Exim Configuration Editor at the bottom so that it is using a pristine copy of exim.conf with the latest release. Then once you enable Subject rewrites in there and save it, you should see it tagging the subject line. If it tags it and includes the subject after ***SPAM*** you're good to go. If it then just shows up as ***SPAM*** as the subject, then follow my previous recommendation above.