ISPCONFIG Anti-Spam filter not causing problems for user account

Discussion in 'Server Operation' started by vestport, May 14, 2008.

  1. vestport

    vestport Member

    Hello group,

    I have an ISPCONFIG box running on CentOS 5.0. ISPCONFIG has been running like a top up until recently. The problem is that one of my user accounts is blocking all or most of my incoming email due to the spam filter or rather spamassasin. Under "Spam Filter and AntiVirus" for the user account I have:

    Spam Filter: checked
    Spam Hits: 5.0
    ReWrite Subject: checked
    Subject: ***SPAM***
    Use URIBL: checked

    These are the exact same settings as most of my other accounts however inbound email is being blocked all of a sudden just on one account. I have had several persons recently inform me that they cannot get mail through and are getting errors. The only way to allow mail is to "uncheck" Spam Filter which I have done so that I can communicate with the world on this account in question.

    I downloaded and installed all of the latest CentOs updates and also upgraded to the latest ISPCONFIG from 2.2.18 to 2.2.23 in hopes that this would be resolved but no luck. What is going on here. Very Strange. Somehow the spam filter is getting way too strict for this user. I am not sure exactly how I should approach resolving this issue. It appears that a "lockfile" cannot be created for this user.

    Here is the actual email (minus the real servernames) that got bounced back.

    Message 1:
    From [email protected] Wed May 14 10:45:08 2008
    Date: Wed, 14 May 2008 10:44:43 -0400 (EDT)
    From: [email protected] (Mail Delivery System)
    Subject: Undelivered Mail Returned to Sender
    To: [email protected]
    Auto-Submitted: auto-replied
    MIME-Version: 1.0
    Content-Type: multipart/report; report-type=delivery-status;
    boundary="3148F2451714.1210776283/ns1.myserver.com"

    This is a MIME-encapsulated message.

    --3148F2451714.1210776283/ns1.myserver.com
    Content-Description: Notification
    Content-Type: text/plain; charset=us-ascii

    This is the mail system at host ns1.myserver.com.

    I'm sorry to have to inform you that your message could not
    be delivered to one or more recipients. It's attached below.

    For further assistance, please send mail to <postmaster>

    If you do so, please include this problem report. You can
    delete your own text from the attached returned message.

    The mail system

    <[email protected]> (expanded from <[email protected]>): can't
    create user output file. Command output: ==================== QUOTA:
    31457280000 INBOXSIZE: 51198963 MAXMSG: 2147483647 [3341] warn:
    auto-whitelist: open of auto-whitelist file failed: locker: safe_lock:
    cannot create tmp lockfile
    /var/www/web4/.spamassassin/auto-whitelist.lock.ns1.myserver.com.3341 for
    /var/www/web4/.spamassassin/auto-whitelist.lock: No such file or directory
    procmail: Error while writing to "/var/mail/myserver.com.art"

    --3148F2451714.1210776283/ns1.myserver.com
    Content-Description: Delivery report
    Content-Type: message/delivery-status

    Reporting-MTA: dns; ns1.myserver.com
    X-Postfix-Queue-ID: 3148F2451714
    X-Postfix-Sender: rfc822; [email protected]
    Arrival-Date: Wed, 14 May 2008 10:44:39 -0400 (EDT)

    Final-Recipient: rfc822; [email protected]
    Original-Recipient: rfc822;[email protected]
    Action: failed
    Status: 5.2.0
    Diagnostic-Code: x-unix; ==================== QUOTA: 31457280000 INBOXSIZE:
    51198963 MAXMSG: 2147483647 [3341] warn: auto-whitelist: open of
    auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile
    /var/www/web4/.spamassassin/auto-whitelist.lock.ns1.myserver.com.3341 for
    /var/www/web4/.spamassassin/auto-whitelist.lock: No such file or directory
    procmail: Error while writing to "/var/mail/myserver.com.art"

    --3148F2451714.1210776283/ns1.myserver.com
    Content-Description: Undelivered Message
    Content-Type: message/rfc822

    Received: from notmyserver.com (notmyserver.com [999.999.999.999])
    (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by ns1.myserver.com (Postfix) with ESMTP id 3148F2451714;
    Wed, 14 May 2008 10:44:39 -0400 (EDT)
    Received: from notmyserver.com (notmyserver.com [127.0.0.1])
    by notmyserver.com (8.12.8/8.12.8) with ESMTP id m4EEi3J3023402;
    Wed, 14 May 2008 10:44:23 -0400
    Received: (from art@localhost)
    by notmyserver.com (8.12.8/8.12.8/Submit) id m4EEhrxX023399;
    Wed, 14 May 2008 10:43:53 -0400
    Date: Wed, 14 May 2008 10:43:53 -0400
    From: [email protected]
    Message-Id: <[email protected]>
    To: [email protected]
    Cc: [email protected]

    retest with new ispconfig

    --3148F2451714.1210776283/ns1.myserver.com--

    *****************END*********************



    myserver.com is the server in question that is not creating the lock file for this one user. It had been up until about a week ago then all of a sudden things stopped working. My other email accounts are configured exactly the same and have no problems with spam filter enabled for the user. Again, the only way I can get email inbound to my "[email protected]" right now is by unchecking or rather deactivating the spam filter.

    Any help is welcome and thanks in advance for your reply.


    Art
     
  2. falko

    falko Super Moderator Howtoforge Staff

    Seems to be a quota issue. What's the output of
    Code:
    repquota -avug
    ?
     
  3. vestport

    vestport Member

    Hello falko,

    Ther results of repquota -avug for the user in question is:

    mydomain.com.art -- 1872424 20480000 20481024 39821 0 0


    I just did not want to include the whole output because of spam potential for all of the other users and domains.


    The rest of the output is as follows:

    *** Report for user quotas on device /dev/mapper/VolGroup00-LogVol00
    Block grace time: 7days; Inode grace time: 7days
    Block limits File limits
    User used soft hard grace used soft hard grace
    ----------------------------------------------------------------------
    root -- 13744872 0 0 452796 0 0
    daemon -- 20 0 0 3 0 0
    lp -- 16 0 0 2 0 0
    news -- 7332 0 0 183 0 0
    uucp -- 1356 0 0 18 0 0
    games -- 344 0 0 86 0 0
    nobody -- 4 0 0 1 0 0
    rpm -- 100756 0 0 123 0 0
    smmsp -- 8 0 0 1 0 0
    vcsa -- 8 0 0 1 0 0
    rpcuser -- 36 0 0 5 0 0
    pcap -- 308 0 0 13 0 0
    apache -- 24092 0 0 1641 0 0
    avahi -- 12 0 0 3 0 0
    ntp -- 12 0 0 2 0 0
    postgres -- 5516 0 0 281 0 0
    mysql -- 76216 0 0 2786 0 0
    webalizer -- 32 0 0 4 0 0
    squid -- 16 0 0 2 0 0
    hsqldb -- 16 0 0 2 0 0
    named -- 140 0 0 28 0 0
    xfs -- 0 0 0 1 0 0
    postfix -- 236 0 0 73 0 0
    ident -- 8 0 0 1 0 0
    dovecot -- 8 0 0 1 0 0
    radvd -- 8 0 0 1 0 0
    tomcat -- 96 0 0 24 0 0
    amanda -- 364 0 0 17 0 0
    cyrus -- 16112 0 0 24 0 0
    radiusd -- 72 0 0 18 0 0
    quagga -- 36 0 0 5 0 0
    ldap -- 716 0 0 12 0 0
    exim -- 56 0 0 7 0 0
    piranha -- 16 0 0 3 0 0
    pvm -- 8 0 0 1 0 0
    privoxy -- 792 0 0 43 0 0
    luci -- 178992 0 0 20622 0 0
    ricci -- 44 0 0 8 0 0
    beaglidx -- 61124 0 0 24 0 0
    nx -- 164 0 0 20 0 0
    art -- 92704 0 0 1316 0 0
    admispconfig -- 135996 0 0 4174 0 0
    #10004 -- 8 0 0 2 0 0
    #12011 -- 0 512000 513024 0 0 0

    Statistics:
    Total blocks: 17
    Data blocks: 6
    Entries: 102
    Used average: 17.000000

    *** Report for group quotas on device /dev/mapper/VolGroup00-LogVol00
    Block grace time: 7days; Inode grace time: 7days
    Block limits File limits
    Group used soft hard grace used soft hard grace
    ----------------------------------------------------------------------
    root -- 13500312 0 0 443327 0 0
    daemon -- 36 0 0 5 0 0
    sys -- 24 0 0 3 0 0
    tty -- 24 0 0 2 0 0
    disk -- 1664 0 0 79 0 0
    lp -- 124 0 0 26 0 0
    kmem -- 32 0 0 1 0 0
    mail -- 232120 0 0 90 0 0
    news -- 7600 0 0 186 0 0
    uucp -- 1384 0 0 20 0 0
    man -- 256 0 0 32 0 0
    games -- 7376 0 0 640 0 0
    lock -- 28 0 0 2 0 0
    nobody -- 96 0 0 2 0 0
    rpm -- 100756 0 0 123 0 0
    utmp -- 50516 0 0 5 0 0
    smmsp -- 844 0 0 9 0 0
    utempter -- 324 0 0 2 0 0
    rpcuser -- 36 0 0 5 0 0
    gdm -- 8 0 0 1 0 0
    pcap -- 308 0 0 13 0 0
    slocate -- 28404 0 0 3 0 0
    apache -- 24712 0 0 1686 0 0
    avahi -- 12 0 0 3 0 0
    ntp -- 12 0 0 2 0 0
    postgres -- 5516 0 0 281 0 0
    mysql -- 76220 0 0 2787 0 0
    squid -- 216 0 0 7 0 0
    hsqldb -- 16 0 0 2 0 0
    named -- 8308 0 0 401 0 0
    xfs -- 0 0 0 1 0 0
    postdrop -- 368 0 0 4 0 0
    postfix -- 132 0 0 60 0 0
    ident -- 8 0 0 1 0 0
    dovecot -- 32 0 0 5 0 0
    radvd -- 8 0 0 1 0 0
    tomcat -- 11784 0 0 994 0 0
    mailman -- 53040 0 0 2743 0 0
    radiusd -- 24 0 0 3 0 0
    quaggavt -- 4 0 0 1 0 0
    quagga -- 32 0 0 4 0 0
    ldap -- 732 0 0 15 0 0
    exim -- 56 0 0 7 0 0
    piranha -- 4 0 0 1 0 0
    pvm -- 8 0 0 1 0 0
    privoxy -- 792 0 0 43 0 0
    screen -- 356 0 0 2 0 0
    pegasus -- 86232 0 0 5145 0 0
    luci -- 178992 0 0 20622 0 0
    ricci -- 344 0 0 9 0 0
    beaglidx -- 61124 0 0 24 0 0
    art -- 92700 0 0 1315 0 0
    admispconfig -- 129972 0 0 3627 0 0
    web4 -- 62177400 153600000 153601024 1254582 0 0
    web8 -- 719408 204800000 204801024 5477 0 0
    web10 -- 773788 204800000 204801024 39022 0 0
    web11 -- 39476 2048000 2049024 2147 0 0
    web12 -- 694304 204800000 204801024 34327 0 0
    web13 -- 1149392 204800000 204801024 13705 0 0
    web14 -- 376 0 0 47 0 0
    ispconfigend -- 36 0 0 9 0 0
    #10002 -- 8 0 0 2 0 0
    #12011 -- 0 512000 513024 0 0 0

    Statistics:
    Total blocks: 15
    Data blocks: 4
    Entries: 63
    Used average: 15.750000

    Thanks!
     
  4. falko

    falko Super Moderator Howtoforge Staff

    What's the output of
    Code:
    ls -la /var/www/web4/.spamassassin
    ?
     
  5. vestport

    vestport Member

    [root@ns1 ~]# ls -la /var/www/web4/.spamassassin
    lrwxrwxrwx 1 root root 42 Dec 19 08:17 /var/www/web4/.spamassassin -> /var/www/web4/user/web4_art/.spamassassin/
    [root@ns1 ~]#
     
  6. vestport

    vestport Member

    I deleted as many useless emails in my mail box that I could just to free up some space and to see what happened. It appears that now I can receive emails even with anti-spam engaged. My quota did not appear to be exceeded previously so I figured I should try deleting old messaged. I am just worried that this problem is going to happen again soon and that something else is really causing the lockout of inbound email. This is my main account and it has caused lots of grief blocking so many clients, customers and friends.

    Please let me know if you see anything else that may have caused the problem from the "ls -la /var/www/web4/.spamassassin" printout that you requested.


    Thanks Falko!
     
  7. vestport

    vestport Member

    In creating a new email account today I found that limits were exceeded and that it would not create the account. This must be related to the issue that I have been experiencing with mail being blocked etc. since it appears to be quota related. I dilligently went through all of my domains and email account to lean things out and the system appears to be working as per normal once again.

    In short it appears that either ISPCONFIG, quota or the interaction between the 2 are not smart enough to warn before problems like this occur. This is only a guess and I am not trying to start a fueled debate with such a statement that ISPCONFIG is not "smart enough". I love ISPCONFIG and it is a GOD sent in general. I am only mentioning that there may be a problem with quota interaction to hopefully improve development of the next version in the case that there may actually be something here that developers need to address.

    Thanks


    Art
     
  8. vestport

    vestport Member

    Here we go again: My server rejecting emails

    Here is the error from email bounced back. All my other accounts appear to be fine.



    <[email protected]> (expanded from <[email protected]>): can't
    create user output file. Command output: ==================== QUOTA:
    6291456000 INBOXSIZE: 51190606 MAXMSG: 2147483647 [24889] warn:
    auto-whitelist: open of auto-whitelist file failed: locker: safe_lock:
    cannot create tmp lockfile
    /var/www/web4/.spamassassin/auto-whitelist.lock.ns1.myserver.net.24889 for
    /var/www/web4/.spamassassin/auto-whitelist.lock: No such file or directory
    procmail: Error while writing to "/var/mail/myserver.com.me"


    ****END of Bounced mail error******


    In the "Spamfileter and Anti-Virus" for this account I have:

    Spamfilter: checked
    Anti-Virus: Not checked
    Spam Strategy: discard
    Spam Hits: 5.0 (what does increasing or decreasing this number do?)
    Rewrite Subject: checked
    Subject: ***SPAM***
    Use URIBL: checked
    Spam Whitelist: No entries
    Spam Blacklist: No entries


    Under "User and Email" tab I have:

    WebSpace MB: 10000
    MailSpace MB: 6000

    Administrator: checked
    Shell Access: checked

    For the client account under the tab "Basis" I have:


    Space MB: 150000
    Traffic MB: 20000
    Traffic Exceedance: Notify

    Max User: 500
    Max Domain: 500

    Below that everything is checked except:

    PHP Safe Mode
    Ruby
    SSL
    Anonymous FTP


    The system is not creating anything from "/var/www/web4/" on so ".spammassasin" etc. does not exist.


    Please help!!!!!!!!!!!


    If I start deleting tons of emails it will probably fix itself like before but I'd really like to actually know why this is happening. Should I remove quota????

    That is the only thing that I can think of.


    Thanks in advance for any replies



    Art
     
  9. vestport

    vestport Member

    Here are my quota stats for this user

    [root@ns1 ~]# quota myserver.com.me
    Disk quotas for user myserver.com.me (uid 10036):
    Filesystem blocks quota limit grace files quota limit grace
    /dev/mapper/VolGroup00-LogVol00
    2004236 10240000 10241024 39839 0 0

    What is going on here?


    This rejection of email is really screwing me up here.

    Thanks


    Art
     
  10. falko

    falko Super Moderator Howtoforge Staff

    What's the output of
    Code:
    ls -la /var/mail/
    ?
     
  11. vestport

    vestport Member

    Output is as follows:

    -rw------- 1 mydomain.com.user mail 51094744 Aug 7 14:53 mydomain.com.user

    What I end up doing is deleting several emails for a quick fix but this problem keeps re-occurring.


    Art
     
  12. vestport

    vestport Member

    Here is the latest error below:


    his is the mail system at host ns1.myserver.net.

    I'm sorry to have to inform you that your message could not
    be delivered to one or more recipients. It's attached below.

    For further assistance, please send mail to <postmaster>

    If you do so, please include this problem report. You can
    delete your own text from the attached returned message.

    The mail system

    <[email protected]> (expanded from <[email protected]>): can't
    create user output file. Command output: ==================== QUOTA:
    10485760000 INBOXSIZE: 51062154 MAXMSG: 2147483647 [29105] warn:
    auto-whitelist: open of auto-whitelist file failed: locker: safe_lock:
    cannot create tmp lockfile
    /var/www/web4/.spamassassin/auto-whitelist.lock.ns1.myserver.net.29105 for
    /var/www/web4/.spamassassin/auto-whitelist.lock: No such file or directory
    procmail: Error while writing to "/var/mail/myserver.com.user"


    That is it. Is this something to do with "procmail" or having no lock file?

    Sorry this seems like it must be a simple problem and I still can't fix it. This is only happening to one account. Unfortunately the one I use most. If I just offloaded the email I'm confident that it would fix it but I'd rather keep all my emails online for reference and searching.


    Please help!


    Thanks


    Art:rolleyes:
     
  13. vestport

    vestport Member

    I just want to clarify that these are all errors that people get trying to email my ISPCONFIG box.

    Art
     
  14. falko

    falko Super Moderator Howtoforge Staff

    Can you post the full outputs of
    Code:
    ls -la /var/www/web4/.spamassassin
    and
    Code:
    ls -la /var/mail/
    ?
     
  15. vestport

    vestport Member

    /
    [root@ns1 ~]# ls -la /var/www/web4/.spamassassin

    lrwxrwxrwx 1 root root 42 Dec 19 2007 /var/www/web4/.spamassassin -> /var/www/web4/user/web4_art/.spamassassin/

    The above link is wrong as there is no directory "web4_art". I assume I have to change this link with "ln" to point to the proper directory "myserver.com.user" yes?

    More importantly is there another program that creates the link that may overwrite this manual change in the future?


    ls -la /var/mail/ (executed as root gives me a list of all users who have access to mail and I am on it, I mean "mydomain.com.me" or rather the account in question is there).





    Thanks


    Art
     
  16. falko

    falko Super Moderator Howtoforge Staff

    Yes.

    Make sure that myserver.com.user is the adminsitrator of that web site.
     
  17. vestport

    vestport Member

    Yes, mydomain.com.user is the admin of that domain. I deleted the old symbolic link and created the new one that now points to the actual spamassassan setup files. I have great hopes that this has finally solved the issue unless there is another file or routine that will at some point overwrite this fix. I will know for sure in a month or so as deleting older emails in general for some reason has worked as a temporary fix.

    I hope that all of this saves someone else from going through this email problem.

    Many thanks again Falko!


    Art:)
     

Share This Page