The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Spamassassin not tagging subject line

Discussion in 'General Discussion' started by nsusa, Jul 25, 2007.

  1. nsusa

    nsusa Well-Known Member

    Joined:
    Jun 30, 2004
    Messages:
    93
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Colorado, USA
    SA is adding appropriate headers to incoming SPAM emails, but it is not adding a tag to the subject line. I am on a new cpanel 11 server for just a few days now. I am not seeing a setting to have it tag the subject line. What am I missing? Where can I turn it on?

    Thanks.

    Chris

     
  2. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Are you an end-user or are you a server administrator with WHM access?

    The server administrator needs to log into WHM and then go into the Exim Configuration Editor and then checkmark the option to enable subject rewriting and save the config.

    Then the administrator needs to make sure that the line in exim.conf that handles the subject rewriting is properly set - There is a bug in Cpanel 11 whereby some admins who enable subject rewriting will have the subject replaced with ***SPAM*** instead of having the subject prefixed with ***SPAM***.

    Some early updates of Cpanel 11 had the following line in /etc/exim.conf:

    add_header = X-Spam-Subject: ***SPAM*** $h_subject

    More recent updates of Cpanel 11 had the following line in /etc/exim.conf:

    add_header = X-Spam-Subject: [% ACL_SPAM_HEADER %] $h_subject

    The problem with either of these lines is the $h_subject on the end - that should be a capital S in Subject in $h_Subject.

    So if you are the administrator and you can look in your exim.conf and search for $h_subject and change it to $h_Subject - save exim.conf and restart Exim. Even better, do this through the Exim Configuration Editor in WHM - find $h_subject and replace with $h_Subject and save the config.

    NOTE: Subject Rewriting can only be turned on/off globally now. The individual accountholders no longer have the option to enable subject rewriting. If the admin chooses to enable it in WHM, then ALL accounts on the server will have the subject rewritten for spam messages if they have spamassassin enabled. If the admin chooses to disable it, then NO account on the server will have the subject rewritten for spam messages.

    So if you are not the server admin, you'll want to contact your web host and ask them if they have subject rewriting in WHM, or if they will enable it. Then you can go from there. You might want to point them to this thread for some information in case they need it. There are better threads about this as well - just search the Cpanel forums for subject rewriting.

    Mike
     
  3. nsusa

    nsusa Well-Known Member

    Joined:
    Jun 30, 2004
    Messages:
    93
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Colorado, USA
    Thanks, Mike. Please see my responses below.

    I am the admin with full root access.

    I do not see a checkmark for that at all. I am on WHM 11.2.0 cPanel 11.6.0-R15076

    It was indeed lower case and I changed it to upper case "S", but it did not make a difference.


    That's fine - I only host my own sites. ;) I just wish I could turn it on. Any idea what is going on?

    Chris
     
  4. nsusa

    nsusa Well-Known Member

    Joined:
    Jun 30, 2004
    Messages:
    93
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Colorado, USA
    Ok, here is what is going on, but don't know why.

    The "Filters" section in Exim is not visible. It is almost like a collapsed menu, but with no option to expand it. So, I can't access the options underneath.

    Chris
     
  5. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Chris - did you make the change to h_Subject from within WHM/Exim Configuration Editor, or did you make the change by manually editing exim.conf?

    If you made the change by manually editing exim.conf, then you'll need to do something such as /scripts/restartsrv_exim

    In the Exim Configuration Editor there should be an option to enable subject rewrites. Unfortunately I can't tell you exactly where it was because I run some custom ACLs and as soon as I added those in via the Exim Configuration Editor, it took out about half of the options that I see in the Exim Configuration Manager. All of my config works fine and as intended, but the Exim Configuration Editor doesn't display for me what it does by default for anyone else and so I can't tell you what to select.

    You should have something in your exim.conf already that looks similar to what I have below:

    Code:
      warn
        condition = ${if eq {${acl_m0}}{1}{1}{0}}
        spam =  ${acl_m1}/defer_ok
        log_message = "SpamAssassin as ${acl_m1} detected message as spam"
        add_header = X-Spam-Subject: [SPAM] $h_Subject
        add_header = X-Spam-Status: Yes, score=$spam_score
        add_header = X-Spam-Score: $spam_score_int
        add_header = X-Spam-Bar: $spam_bar
        add_header = X-Spam-Report: $spam_report
        add_header = X-Spam-Flag: YES
        set acl_m2 = 1
    
    But instead of add_header = X-Spam-Subject: [SPAM] $h_Subject that I have above, you probably have either the of the two following lines:

    add_header = X-Spam-Subject: ***SPAM*** $h_subject

    or

    add_header = X-Spam-Subject: [% ACL_SPAM_HEADER %] $h_subject

    Oh - Maybe you dont have that bottom line in Exim Configuration Editor - you know, the one that tells it to use /etc/cpanel_exim_system_filter. The actual rewriting of the subject happens in /etc/cpanel_exim_system_filter I believe - and if you don't have it specified in Exim Configuration Editor and instead have that disabled, you won't get the subject rewrite.

    Mike
     
  6. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Yep I know exactly what you are talking about. I bet you added some custom ACLs to your Exim since Cpanel 11, didn't you? As soon as I added a dictionary ACL (from Chirpy's site) and some HELO checking, I no longer had anything listed under the Filters section.

    Mike
     
  7. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    $h_Subject and $h_subject are the same thing

    its case insensitive matching

    from the exim manual (section 11)

    Upper case and lower case letters are synonymous in header names. If the following character is white space, the terminating colon may be omitted, but this is not recommended, because you may then forget it when it is needed. When white space terminates the header name, it is included in the expanded string. If the message does not contain the given header, the expansion item is replaced by an empty string. (See the def condition in section 11.7 for a means of testing for the existence of a header.)


    http://www.exim.org/exim-html-current/doc/html/spec_html/ch11.html#SECTexpvar
     
    #7 cPanelNick, Jul 25, 2007
    Last edited by a moderator: Jul 25, 2007
  8. nsusa

    nsusa Well-Known Member

    Joined:
    Jun 30, 2004
    Messages:
    93
    Likes Received:
    1
    Trophy Points:
    8
    Location:
    Colorado, USA
    You hit the nail on the head. ;) That now got me back up and running and I am now seeing those options again. :) I really appreciate your help :) Thanks.

    Chris
     
  9. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Keep on saying that - but keep in mind that both times after Cpanel 11 upgrades this was changed to h_subject and it was NOT adding the subject after it prefixed the subject with ***SPAM*** - And it was because the subject was not stored in $h_subject - it was stored in $h_Subject. As soon as I cahnged it to use h_Subject, it started displaying the full subject after the ***SPAM*** tag instead of just displaying ***SPAM***.

    I'm not imagining things.

    Would you like me to prove it to you on our Cpanel machine? I can reproduce this problem in an instant simply by going in and changing h_Subject to h_subject and restarting Exim. As soon as I do that, spam messages with the subject rewritten only display ***SPAM*** instead of ***SPAM*** <original subject>

    Mike


     
  10. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    I'd love :D:D:D:D:D:D:D:D (I've spent hours and hours on this without getting it to break) to see it reproduced. I can't get it to happen. I've dug though the exim source code line by line :

    Here is the test for matching the header (line 1192) expand.c:

    if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))

    and the compare function:

    /*************************************************
    * Case-independent strncmp() function *
    *************************************************/

    /*
    Arguments:
    s first string
    t second string
    n number of characters to compare

    Returns: < 0, = 0, or > 0, according to the comparison
    */

    int
    strncmpic(uschar *s, uschar *t, int n)
    {
    while (n--)
    {
    int c = tolower(*s++) - tolower(*t++);
    if (c) return c;
    }
    return 0;
    }
     
  11. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Alright Nick (edited to be a little nicer). In an effort to grant you your wish, I proceeded to change the WHM IP so you could log in and reproduce it.

    But... (yeah, you can gloat now I suppose), for shits and grins I went ahead and edited it myself to be $h_subject and restarted it and it kept the intregity of the original subject line intact. So you're right, and I am wrong.

    However, that does not explain what I had experienced after the Cpanel update.
    - updated Cpanel to 11 I'm guessing sometime last month
    - spam messages were instantly showing up with ***SPAM*** as the _only_ thing in the subject
    - I did a search on the forums here, and some other person on the forums experienced the same problem and suggested that changing $h_subject to $h_Subject fixed the problem for them
    - I tried this - it worked for me as well

    - then I updated to a more recent version of Cpanel 11 and reset my exim config from WHM
    - as soon as I reset it, I had the same problem with spam message subjects having ***SPAM*** as the only thing in the subject
    - I repeated the 'fix' that I performed previously, restarted Exim and voila it worked fine

    So without further ado I proclaimed that changing $h_subject to $h_Subject fixed the problem. And I still stand by that - at least to the extent that editing that line did in fact fix my problem. I did not edit anything else whatsoever except for that line.

    I'll attempt to be really humble now and bow to your guru likeness and ask this: Is it possible that _something_ in the default exim.conf configuration (after you reset the exim config) such as some strange 'invisible' character could be in that line and that when I would go in and edit that line (I always changed ***SPAM*** to [SPAM] at the same time that i changed $h_subject to $h_Subject) could have been removed - and that this character was causing a problem?

    I am not the only one who experienced the problem, and simply editing that line fixed it for me as it had for at least one other person.

    So, what is your opinion on that hypothesis? I'd really love to test it again myself, but I don't really feel like setting exim.conf back to default to test it and then re-adding the extra ACLs that I use. Both times this happened after resetting exim.conf from within WHM - and it happened on two different releases of Cpanel 11 within the past month.

    Mike

    PS: I would not have been such a wiseass to your original response if I hadn't thought that you were trying to talk down to me and disprove my theory without addressing me directly about it and just saying 'i dont think that's the problem Mike' - I took offense at that.

     
    #11 mtindor, Jul 25, 2007
    Last edited: Jul 25, 2007
  12. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider
    It could simple be saving the exim config solved the problem as it caused it to be rebuilt. Maybe any change would have solved it.


    Like any text media its really hard to gauge responses. I tend to be blunt and come off much more harsh then I mean all the time. I know there are times I take things the wrong way. After all the internet can be pretty dehumanizing.

    Likewise, I'm not on a quest to disprove your theory, just to find the problem and fix it. If I didn't think there might be some merit to the idea I wouldn't have spent hours coming over the config and exim code :).
     
  13. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    I've seen odder things happen. So I guess we'll just chalk it up to that. In the future if somebody has the problem I'll just suggest that they make _any_ change and save it and see if it fixes it.


    Indeed. I'm actually pissed at myself now for reading so much into a simple post. Although Im 40, my pride still often goeth before my fall and I don't like being 'shot down'. Time for a brew :)

    Understood.

    Mike
     
    #13 mtindor, Jul 25, 2007
    Last edited: Jul 26, 2007
  14. anton_latvia

    anton_latvia Well-Known Member
    PartnerNOC

    Joined:
    May 11, 2004
    Messages:
    348
    Likes Received:
    3
    Trophy Points:
    18
    Location:
    Latvia
    cPanel Access Level:
    Root Administrator
    Sorry guys to bother this thread, but have you found some solution for this issue?

    Anton.
     
  15. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Well, if you are still experiencing the problem, just edit the exim.conf manually (even a small edit) and then save it and restart exim and see if that fixes it. By default, on Cpanel 11 it is going to tag the prefix the subject line of spam messages with ***SPAM*** if it is working. If it is not showing the actual subject but simply showing ***SPAM*** in the subject line and nothing more, it is probably just some idiosyncracy with the exim.conf file. I thought it was the $h_Subject line - but it has been proven that $h_subject is fine as well. BUT, editing the exim.conf to modify that, saving the exim.conf, and then restarting exim fixed it. So just try changing $h_subject to $h_Subject, saving exim.conf and restarting - Then change it back once it is working.

    It's not a problem with that line itself - but editing that line and then editing it back seems to fix it.

    Mike

    PS: If you mean you aren't seeing the subject line being tagged AT ALL, then you need to enable rewriting in the Exim Configuration Editor. And if you recently upgraded to Cpanel 11 and had some previous modifications in exim.conf, you should really document those modifications and then reset it back to default from wtithin the Exim Configuration Editor at the bottom so that it is using a pristine copy of exim.conf with the latest release. Then once you enable Subject rewrites in there and save it, you should see it tagging the subject line. If it tags it and includes the subject after ***SPAM*** you're good to go. If it then just shows up as ***SPAM*** as the subject, then follow my previous recommendation above.
     
    #15 mtindor, Aug 16, 2007
    Last edited: Aug 16, 2007
  16. mahinder

    mahinder Well-Known Member

    Joined:
    Jun 12, 2003
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    matrix
    Hi,

    Since i upgraded to cpanel 11, subject rewriting option is now removed from users cpanel control panel. One of the customer has their own way of rewriting subject and now they want it back. Is there any way to provide them with subject rewrite option in their cpanel so that they can change it for their own domain?

    -max
     
  17. anton_latvia

    anton_latvia Well-Known Member
    PartnerNOC

    Joined:
    May 11, 2004
    Messages:
    348
    Likes Received:
    3
    Trophy Points:
    18
    Location:
    Latvia
    cPanel Access Level:
    Root Administrator
    Try to disable option "Enable SpamAssassin globally" in exim configuration in WHM.
     
  18. internetfab

    internetfab Well-Known Member
    PartnerNOC

    Joined:
    Feb 20, 2003
    Messages:
    336
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Gothenburg, Sweden
    cPanel Access Level:
    DataCenter Provider
    That wont work.. We upgraded a server to cpanel 11 current and have the same problem here with spamassassin not tagging the subject line.

    Is there anyway to turn this on?
     
  19. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,279
    Likes Received:
    36
    Trophy Points:
    48
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    If you have a modified exim.conf, you should back it up. Then you should log into WHM, go to Exim Configuration Editor, and you should reset everything to default.

    Once you do that you should see all of your options
    - one option will be to specify what the rewritten spam subject will look like. By default it is ***SPAM***.
    - another option allows you to turn on SpamAssassin globally. If you turn on SA globally, every email account that has a message detected as spam will have its subject rewritten. If you turn off SA globally, you will then have to enable SA on a per-domain basis from that domain's Cpanel in order for it to tag the subject line of spammy messages for that domain.

    If you have done all of the above and you are sure it is still not tagging the subject line, we'll have to go from there. But often this happens if somebody had a modified exim.conf and the update could not / would not update the actual configuration during the upgrade because it couldn't sort out your modifications. If it could not properly update to the new mail configuration with ACLs/Filters/etc in WHM/Exim Configuration Manager, you'll have problems. So reset all of your exim configuration to default first and go from there.

    Mike
     
  20. internetfab

    internetfab Well-Known Member
    PartnerNOC

    Joined:
    Feb 20, 2003
    Messages:
    336
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Gothenburg, Sweden
    cPanel Access Level:
    DataCenter Provider
    Thank you, I was sure I had reset the ACLs to default after the upgrade but I must have been wrong.

    Is there no way to let the user specify their rewrite of the subject?
     
Loading...
Similar Threads - Spamassassin tagging subject
  1. sandstorm
    Replies:
    2
    Views:
    270

Share This Page