Re: Sendmail milter weirdness

[Dan Nelson]

In the last episode (Jul 02), Cassandra Lynette Brockett said:
> I am not sure where the mix-up here lies, but I have been getting some
> strange emails for quite a while... the logs generally follow this form :-
> 
> Jul  1 23:55:22 hotline sendmail[31431]: h626tKn31431: from=<address@hidden>, 
> size=1236, class=0, nrcpts=1, msgid=<address@hidden>, bodytype=8BITMIME, 
> proto=SMTP, daemon=MTA, relay=[211.198.18.97]
> Jul  1 23:55:22 hotline spamd[6391]: connection from localhost.localdomain 
> [127.0.0.1] at port 34926
> Jul  1 23:55:22 hotline spamd[31433]: check: user 'nobody' is an alias for 
> 'cassflinx' - updated.
> Jul  1 23:55:22 hotline spamd[31433]: handle_user: unable to find user 
> 'cassflinx'!
> Jul  1 23:55:22 hotline spamd[31433]: Still running as root: user not 
> specified with -u, not found, or set to root.  Fall back to nobody.
> Jul  1 23:55:22 hotline spamd[31433]: processing message (unknown) for 
> cassflinx:99.
> Jul  1 23:55:28 hotline spamd[31433]: identified spam (23.8/5.0) for 
> cassflinx:99 in 6.0 seconds, 1408 bytes.
> Jul  1 23:55:28 hotline spamd[6391]: connection from localhost.localdomain 
> [127.0.0.1] at port 34935
> Jul  1 23:55:28 hotline spamd[31442]: info: setuid to localuser succeeded
> Jul  1 23:55:28 hotline spamd[31442]: processing message <address@hidden> for 
> flinx:500.
> Jul  1 23:55:34 hotline spamd[31442]: identified spam (24.5/5.0) for 
> flinx:500 in 5.6 seconds, 3690 bytes.
> Jul  1 23:55:34 hotline sendmail[31438]: h626tKn31431: to=<address@hidden>, 
> delay=00:00:14, xdelay=00:00:06, mailer=local, pri=31031, dsn=2.0.0, stat=Sent
> 
> Now we host a few domains here - and the user listed as localuser is
> one of the users from the root account aliasing (as listed above,
> spamd has been modified to do alias expansions - something I am
> trying to figure out how to write in to the milter).
> 
> Basically I am wondering if anyone else is having Spamass-milter do
> the same thing at their site?
> 
> It only happens with some emails too... I've looked at the email that
> came in (after delivery) and it came in and it does not seem to
> actually be anything weird in there...  It is almost as if the email
> is coming in without a user specified - but this is weird as it has
> been happenening even after I upgraded to the latest release (which
> at the time was 0.1.3a+cvs), that release was supposed to handle that
> sort of situation - and for most of the email I used to receive that
> did strange things like that it did fix it... however it only ever
> happens with this one particular user....

Spamass-milter will pass a default username (i.e. whatever the argument
to -u was when you started the milter) to spamc when there are multiple
recipients.  This is probably what's happening.

Also note that the snippet you pasted has two separate spamassassin
runs in it; one for an unknown messageid, which got sent to spamc with
"-u nobody", and one with messageid
<address@hidden>, which got sent with
"-u flinx".

-- 
        Dan Nelson
        address@hidden