Problem with Spamassassin since upgrade (permissions)

[Oliver Zemann]

Hi

I am recieving an error by cron since a couple of weeks. I cant remember
exactly what was updated, but i am pretty sure it was very related to
that. Before that update, i never got such emails:

subject: Cron <***@xxx> test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
content:
config: path "/var/lib/spamassassin/3.003002" is inaccessible:
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is inaccessible:
Permission denied
config: path "/var/lib/spamassassin/3.003002/triplets.txt" is
inaccessible: Permission denied
config: path "/var/lib/spamassassin/3.003002" is inaccessible:
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is inaccessible:
Permission denied

***@xxx:~# ls -lah /var/lib/spamassassin/
total 24M
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .
drwxr-xr-x 49 root root 4.0K May 3 17:18 ..
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 3.003002
drwx------ 2 debian-spamd debian-spamd 4.0K Jan 12 13:37 .pyzor
drwxrwxr-x 2 spamd root 4.0K Jan 12 13:15 sa-update-keys
-rw-rw---- 1 debian-spamd debian-spamd 24M May 24 08:02 spamd.log
drw-rw---- 3 debian-spamd debian-spamd 4.0K Jan 12 13:40 users

***@xxx:~# ls -lah /var/lib/spamassassin/3.003002/
total 16K
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 .
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 ..
-rw-r--r-- 1 amavis debian-spamd 0 May 4 18:21 languages
drw-rw---- 2 amavis debian-spamd 4.0K May 4 18:19
updates_spamassassin_org
-rw-rw---- 1 amavis debian-spamd 2.7K Apr 29 20:38
updates_spamassassin_org.cf

cat amavisd-new
#
# SpamAssassin maintenance for amavisd-new
#
# m h dom mon dow user command
18 */3 * * * amavis test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
24 1 * * * amavis test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-clean

When i execute that command as user amavis (su - amavis), i get the
exactly same error. Can someone please tell me whats wrong?

Regards
Oli

[Oliver Zemann]

Really no one here who could help me with that?

Post by Oliver Zemann
Hi
I am recieving an error by cron since a couple of weeks. I cant remember
exactly what was updated, but i am pretty sure it was very related to
/usr/sbin/amavisd-new-cronjob sa-sync
Permission denied
Permission denied
config: path "/var/lib/spamassassin/3.003002/triplets.txt" is
inaccessible: Permission denied
Permission denied
Permission denied
total 24M
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .
drwxr-xr-x 49 root root 4.0K May 3 17:18 ..
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 3.003002
drwx------ 2 debian-spamd debian-spamd 4.0K Jan 12 13:37 .pyzor
drwxrwxr-x 2 spamd root 4.0K Jan 12 13:15 sa-update-keys
-rw-rw---- 1 debian-spamd debian-spamd 24M May 24 08:02 spamd.log
drw-rw---- 3 debian-spamd debian-spamd 4.0K Jan 12 13:40 users
total 16K
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 .
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 ..
-rw-r--r-- 1 amavis debian-spamd 0 May 4 18:21 languages
drw-rw---- 2 amavis debian-spamd 4.0K May 4 18:19
updates_spamassassin_org
-rw-rw---- 1 amavis debian-spamd 2.7K Apr 29 20:38
updates_spamassassin_org.cf
cat amavisd-new
#
# SpamAssassin maintenance for amavisd-new
#
# m h dom mon dow user command
18 */3 * * * amavis test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
24 1 * * * amavis test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-clean
When i execute that command as user amavis (su - amavis), i get the
exactly same error. Can someone please tell me whats wrong?
Regards
Oli

[Bob Proulx]

Post by Oliver Zemann
Really no one here who could help me with that?

Probably no one is running amavis-new plus spamassassin plus getting
that message. I am not.

Post by Oliver Zemann
I am recieving an error by cron since a couple of weeks. I cant remember
exactly what was updated, but i am pretty sure it was very related to

What version of spamassassin are you running? And amavis-new?

Wheezy Stable? Jessie Testing? Or Sid Unstable?
I am not running amavis-new so some of this will be guessing.

Post by Oliver Zemann
Permission denied

This is usually due to someone running sa-update as root instead of as
the debian-spamd user. They run as root. This creates (or possibly
changes) the ownership to root. Then the normal run by cron as the
debian-spamd user can't access the files.

Post by Oliver Zemann
total 24M
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .
drwxr-xr-x 49 root root 4.0K May 3 17:18 ..
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 3.003002
drwx------ 2 debian-spamd debian-spamd 4.0K Jan 12 13:37 .pyzor
drwxrwxr-x 2 spamd root 4.0K Jan 12 13:15 sa-update-keys
-rw-rw---- 1 debian-spamd debian-spamd 24M May 24 08:02 spamd.log
drw-rw---- 3 debian-spamd debian-spamd 4.0K Jan 12 13:40 users

On my system:

# ls -lah /var/lib/spamassassin/
total 24K
drwxr-xr-x 6 debian-spamd debian-spamd 4.0K Mar 4 09:26 .
drwxr-xr-x 105 root root 4.0K May 7 10:34 ..
drwx------ 3 debian-spamd debian-spamd 4.0K Mar 4 09:26 .spamassassin
drwxrwxr-x 4 debian-spamd debian-spamd 4.0K Apr 19 07:07 3.004000
drwxr-xr-x 3 debian-spamd debian-spamd 4.0K Mar 4 09:26 compiled
drwx------ 2 debian-spamd debian-spamd 4.0K May 28 18:01 sa-update-keys

Your directories are owned by the incorrect users. I would start
fixing things there.

Post by Oliver Zemann
total 16K
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 .
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 ..
-rw-r--r-- 1 amavis debian-spamd 0 May 4 18:21 languages
drw-rw---- 2 amavis debian-spamd 4.0K May 4 18:19 updates_spamassassin_org
-rw-rw---- 1 amavis debian-spamd 2.7K Apr 29 20:38 updates_spamassassin_org.cf

On my system:

# ls -lah /var/lib/spamassassin/3.004000/
total 24K
drwxrwxr-x 4 debian-spamd debian-spamd 4.0K Apr 19 07:07 .
drwxr-xr-x 6 debian-spamd debian-spamd 4.0K Mar 4 09:26 ..
drwxrwxr-x 2 debian-spamd debian-spamd 4.0K Feb 23 19:01 sought_rules_yerp_org
-rw-rw-r-- 1 debian-spamd debian-spamd 123 Feb 23 19:01 sought_rules_yerp_org.cf
drwxrwxr-x 2 debian-spamd debian-spamd 4.0K Apr 19 07:07 updates_spamassassin_org
-rw-rw-r-- 1 debian-spamd debian-spamd 2.7K Apr 19 07:07 updates_spamassassin_org.cf

Post by Oliver Zemann
When i execute that command as user amavis (su - amavis), i get the
exactly same error. Can someone please tell me whats wrong?

I think if you fix the ownership of the files then I think it likely
that your problem will be solved. If not then please report back.

Bob

[Oliver Zemann]

If required, i could also paste the strace somewhere

Post by Bob Proulx

Post by Oliver Zemann
Really no one here who could help me with that?

Probably no one is running amavis-new plus spamassassin plus getting
that message. I am not.

Post by Oliver Zemann
I am recieving an error by cron since a couple of weeks. I cant remember
exactly what was updated, but i am pretty sure it was very related to

What version of spamassassin are you running? And amavis-new?
Wheezy Stable? Jessie Testing? Or Sid Unstable?
I am not running amavis-new so some of this will be guessing.

Post by Oliver Zemann
Permission denied

This is usually due to someone running sa-update as root instead of as
the debian-spamd user. They run as root. This creates (or possibly
changes) the ownership to root. Then the normal run by cron as the
debian-spamd user can't access the files.

Post by Oliver Zemann
total 24M
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .
drwxr-xr-x 49 root root 4.0K May 3 17:18 ..
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 3.003002
drwx------ 2 debian-spamd debian-spamd 4.0K Jan 12 13:37 .pyzor
drwxrwxr-x 2 spamd root 4.0K Jan 12 13:15 sa-update-keys
-rw-rw---- 1 debian-spamd debian-spamd 24M May 24 08:02 spamd.log
drw-rw---- 3 debian-spamd debian-spamd 4.0K Jan 12 13:40 users

# ls -lah /var/lib/spamassassin/
total 24K
drwxr-xr-x 6 debian-spamd debian-spamd 4.0K Mar 4 09:26 .
drwxr-xr-x 105 root root 4.0K May 7 10:34 ..
drwx------ 3 debian-spamd debian-spamd 4.0K Mar 4 09:26 .spamassassin
drwxrwxr-x 4 debian-spamd debian-spamd 4.0K Apr 19 07:07 3.004000
drwxr-xr-x 3 debian-spamd debian-spamd 4.0K Mar 4 09:26 compiled
drwx------ 2 debian-spamd debian-spamd 4.0K May 28 18:01 sa-update-keys
Your directories are owned by the incorrect users. I would start
fixing things there.

Post by Oliver Zemann
total 16K
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 .
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 ..
-rw-r--r-- 1 amavis debian-spamd 0 May 4 18:21 languages
drw-rw---- 2 amavis debian-spamd 4.0K May 4 18:19 updates_spamassassin_org
-rw-rw---- 1 amavis debian-spamd 2.7K Apr 29 20:38 updates_spamassassin_org.cf

# ls -lah /var/lib/spamassassin/3.004000/
total 24K
drwxrwxr-x 4 debian-spamd debian-spamd 4.0K Apr 19 07:07 .
drwxr-xr-x 6 debian-spamd debian-spamd 4.0K Mar 4 09:26 ..
drwxrwxr-x 2 debian-spamd debian-spamd 4.0K Feb 23 19:01 sought_rules_yerp_org
-rw-rw-r-- 1 debian-spamd debian-spamd 123 Feb 23 19:01 sought_rules_yerp_org.cf
drwxrwxr-x 2 debian-spamd debian-spamd 4.0K Apr 19 07:07 updates_spamassassin_org
-rw-rw-r-- 1 debian-spamd debian-spamd 2.7K Apr 19 07:07 updates_spamassassin_org.cf

Post by Oliver Zemann
When i execute that command as user amavis (su - amavis), i get the
exactly same error. Can someone please tell me whats wrong?

I think if you fix the ownership of the files then I think it likely
that your problem will be solved. If not then please report back.
Bob

[Oliver Zemann]

Hi Bob

Thanks for your reply.
I really thought no one will ever answer me here :)

spamassassin 3.3.2-5+deb7u1
amavisd-new 1:2.7.1-2

lsb_release -rd
Description: Debian GNU/Linux 7.5 (wheezy)
Release: 7.5

I changed my permissions with chown -R debian-spamd:debian-spamd
/var/lib... so this should be fixed, thanks.

When i run the command as root i get:
***@xxx:/etc/cron.d# test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
Please run this cronjob as user amavis

When i run the command as user amavis i get the same, old, error message:
$ test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
config: path "/var/lib/spamassassin/3.003002" is inaccessible:
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied
config: path "/var/lib/spamassassin/3.003002/triplets.txt" is
inaccessible: Permission denied
config: path "/var/lib/spamassassin/3.003002" is inaccessible:
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied

I really appreciate your help.

Kind regards
Oli

Post by Bob Proulx

Post by Oliver Zemann
Really no one here who could help me with that?

Probably no one is running amavis-new plus spamassassin plus
getting that message. I am not.

Post by Oliver Zemann
I am recieving an error by cron since a couple of weeks. I cant
remember exactly what was updated, but i am pretty sure it was
very related to that. Before that update, i never got such

What version of spamassassin are you running? And amavis-new?
Wheezy Stable? Jessie Testing? Or Sid Unstable?

Post by Oliver Zemann
&& /usr/sbin/amavisd-new-cronjob sa-sync

I am not running amavis-new so some of this will be guessing.

Post by Oliver Zemann
Permission denied

This is usually due to someone running sa-update as root instead of
as the debian-spamd user. They run as root. This creates (or
possibly changes) the ownership to root. Then the normal run by
cron as the debian-spamd user can't access the files.

Post by Oliver Zemann
6 debian-spamd debian-spamd 4.0K May 21 23:57 . drwxr-xr-x 49
root root 4.0K May 3 17:18 .. drwxrwxr-x 3
amavis debian-spamd 4.0K May 4 18:21 3.003002 drwx------
2 debian-spamd debian-spamd 4.0K Jan 12 13:37 .pyzor drwxrwxr-x
2 spamd root 4.0K Jan 12 13:15 sa-update-keys
-rw-rw---- 1 debian-spamd debian-spamd 24M May 24 08:02
spamd.log drw-rw---- 3 debian-spamd debian-spamd 4.0K Jan 12
13:40 users

# ls -lah /var/lib/spamassassin/ total 24K drwxr-xr-x 6
debian-spamd debian-spamd 4.0K Mar 4 09:26 . drwxr-xr-x 105 root
root 4.0K May 7 10:34 .. drwx------ 3 debian-spamd
debian-spamd 4.0K Mar 4 09:26 .spamassassin drwxrwxr-x 4
debian-spamd debian-spamd 4.0K Apr 19 07:07 3.004000 drwxr-xr-x 3
debian-spamd debian-spamd 4.0K Mar 4 09:26 compiled drwx------ 2
debian-spamd debian-spamd 4.0K May 28 18:01 sa-update-keys
Your directories are owned by the incorrect users. I would start
fixing things there.

Post by Oliver Zemann
drwxrwxr-x 3 amavis debian-spamd 4.0K May 4 18:21 .
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 ..
-rw-r--r-- 1 amavis debian-spamd 0 May 4 18:21
languages drw-rw---- 2 amavis debian-spamd 4.0K May 4
18:19 updates_spamassassin_org -rw-rw---- 1 amavis
debian-spamd 2.7K Apr 29 20:38 updates_spamassassin_org.cf

# ls -lah /var/lib/spamassassin/3.004000/ total 24K drwxrwxr-x 4
debian-spamd debian-spamd 4.0K Apr 19 07:07 . drwxr-xr-x 6
debian-spamd debian-spamd 4.0K Mar 4 09:26 .. drwxrwxr-x 2
debian-spamd debian-spamd 4.0K Feb 23 19:01 sought_rules_yerp_org
-rw-rw-r-- 1 debian-spamd debian-spamd 123 Feb 23 19:01
sought_rules_yerp_org.cf drwxrwxr-x 2 debian-spamd debian-spamd
4.0K Apr 19 07:07 updates_spamassassin_org -rw-rw-r-- 1
debian-spamd debian-spamd 2.7K Apr 19 07:07
updates_spamassassin_org.cf

Post by Oliver Zemann
When i execute that command as user amavis (su - amavis), i get
the exactly same error. Can someone please tell me whats wrong?

I think if you fix the ownership of the files then I think it
likely that your problem will be solved. If not then please report
back.
Bob

[Chris Angelico]

Post by Oliver Zemann
$ test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied
config: path "/var/lib/spamassassin/3.003002/triplets.txt" is
inaccessible: Permission denied
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .

Is user amavis in group debian-spamd? If not, the whole directory is
inaccessible.

ChrisA

[Oliver Zemann]

Thanks, that was the problem.
I added the user amavis to the group debian-spamd (usermod -a -G
debian-spamd amavis) and now it works, no annoying mails anymore :)

Thanks!!

Post by Chris Angelico

Post by Oliver Zemann
$ test -e /usr/sbin/amavisd-new-cronjob &&
/usr/sbin/amavisd-new-cronjob sa-sync
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied
config: path "/var/lib/spamassassin/3.003002/triplets.txt" is
inaccessible: Permission denied
Permission denied
config: path "/var/lib/spamassassin/3.003002/languages" is
inaccessible: Permission denied
drwxrwx--- 6 debian-spamd debian-spamd 4.0K May 21 23:57 .

Is user amavis in group debian-spamd? If not, the whole directory is
inaccessible.
ChrisA

[Tom Furie]

Post by Oliver Zemann
I changed my permissions with chown -R debian-spamd:debian-spamd
/var/lib... so this should be fixed, thanks.

Along with ownership, did you also change the permissions on
/var/lib/spamassassin?

Cheers,
Tom

[Henrique de Moraes Holschuh]

Post by Bob Proulx
Probably no one is running amavis-new plus spamassassin plus getting
that message. I am not.

The recommended way to plug spamassassin into amavisd-new is to NOT use
spamd.

amavisd-new integrates a lot better over the perl module API to spamassassin
(it loads up spamassassin as if it were a library/module, inside the same
child process as the amavisd-new worker).

OTOH, the per-process memory penalty of amavisd-new can get quite high.
YMMV. I've never seen a high-volume/high-performance amavisd-new+SA install
that used spamd, though.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh