Spamassassin driving me NUTS

[RoRoo]

I've been running into an issue for a few days now and can't seem to find a working solution.

The situation is a new server running CentOS 7
Ran this one during install: https://help.directadmin.com/item.php?id=36

Then after a while, when taking server in production, I found out that the maillog contained these lines and spam wasn't being blocked (RBL or SPF checks didn't run)

spamd[31699]: spf: lookup failed: Can't locate object method "handles" via package "IO::Socket::IP" at /usr/local/share/perl5/Net/DNS/Resolver/Base.pm line 735.

Checked this: https://help.directadmin.com/item.php?id=142 which was fine

Then I ran this: https://help.directadmin.com/item.php?id=576

Also didn't work
When I check sa-update -D I get:

 dbg: logger: adding facilities: all
 dbg: logger: logging level is DBG
 dbg: generic: SpamAssassin version 3.4.1
 dbg: generic: Perl 5.016003, PREFIX=/usr, DEF_RULES_DIR=/usr/share/spamassassin, LOCAL_RULES_DIR=/etc/mail/spamassassin, LOCAL_STATE_DIR=/var/lib/spamassassin
 dbg: config: timing enabled
 dbg: config: score set 0 chosen.
 dbg: generic: sa-update version svn1652181
 dbg: generic: using update directory: /var/lib/spamassassin/3.004001
 dbg: diag: perl platform: 5.016003 linux
 dbg: diag: [...] module installed: Digest::SHA1, version 2.13
 dbg: diag: [...] module installed: HTML::Parser, version 3.71
 dbg: diag: [...] module installed: Net::DNS, version 1.03
 dbg: diag: [...] module installed: NetAddr::IP, version 4.078
 dbg: diag: [...] module installed: Time::HiRes, version 1.9725
 dbg: diag: [...] module installed: Archive::Tar, version 2.04
 dbg: diag: [...] module installed: IO::Zlib, version 1.10
 dbg: diag: [...] module installed: Digest::SHA1, version 2.13
 dbg: diag: [...] module installed: MIME::Base64, version 3.13
 dbg: diag: [...] module not installed: DB_File ('require' failed)
 dbg: diag: [...] module installed: Net::SMTP, version 2.31
 dbg: diag: [...] module installed: Mail::SPF, version v2.008
 dbg: diag: [...] module not installed: Geo::IP ('require' failed)
 dbg: diag: [...] module not installed: Net::CIDR::Lite ('require' failed)
 dbg: diag: [...] module installed: Razor2::Client::Agent, version 2.84
 dbg: diag: [...] module installed: IO::Socket::IP, version 0.21
 dbg: diag: [...] module installed: IO::Socket::INET6, version 2.72
 dbg: diag: [...] module installed: IO::Socket::SSL, version 2.020
 dbg: diag: [...] module installed: Compress::Zlib, version 2.061
 dbg: diag: [...] module installed: Mail::DKIM, version 0.4
 dbg: diag: [...] module installed: DBI, version 1.634
 dbg: diag: [...] module installed: Getopt::Long, version 2.4
 dbg: diag: [...] module installed: LWP::UserAgent, version 6.05
 dbg: diag: [...] module installed: HTTP::Date, version 6.02
 dbg: diag: [...] module installed: Encode::Detect::Detector, version 1.01
 dbg: diag: [...] module not installed: Net::Patricia ('require' failed)
 dbg: diag: [...] module installed: Net::DNS::Nameserver, version 1406
 dbg: gpg: Searching for 'gpg'
 dbg: util: current PATH is: /root/perl5/bin:/sbin:/bin:/usr/sbin:/usr/bin
 dbg: util: executable for gpg was found at /bin/gpg
 dbg: gpg: found /bin/gpg
 dbg: gpg: release trusted key id list: 5E541DC959CB8BAC7C78DFDC4056A61A5244EC45 0C2B1D7175B852C64B3CDC716C55397824F434CE
 dbg: util: secure_tmpfile created a temporary file /tmp/.spamassassin484410BZoPQtmp
 dbg: channel: attempting channel updates.spamassassin.org
 dbg: channel: using existing directory /var/lib/spamassassin/3.004001/updates_spamassassin_org
 dbg: channel: channel cf file /var/lib/spamassassin/3.004001/updates_spamassassin_org.cf
 dbg: channel: channel pre file /var/lib/spamassassin/3.004001/updates_spamassassin_org.pre
 dbg: channel: metadata version = 1760228, from file /var/lib/spamassassin/3.004001/updates_spamassassin_org.cf
 dbg: dns: 1.4.3.updates.spamassassin.org => 1760228, parsed as 1760228
 dbg: channel: current version is 1760228, new version is 1760228, skipping channel
 dbg: diag: updates complete, exiting with code 1

This states that the following items are failed:
DB_File
Geo::IP
Net::CIDR::Lite
Net:atricia

But when I check them I get:
DB_File is up to date (1.838)
Geo::IP is up to date (1.50)
Net::CIDR::Lite is up to date (0.21)
Net:atricia is up to date (1.22)

Furthermore the Net:NS that it keeps seeming to fail the SPF check on is claimed to be version 1.03 but when checked I get:
Net:NS is up to date (1.06)

Restarted spamassassin service multiple times and exim aswell.

Can anyone tell me what's going wrong here?

 

[RoRoo]

Solved it!!!

It seems that some modules got installed twice (once with yum and with cpan).
After uninstalling and removing old files regarding the modules, I installed the cpan modules again. Every module got loaded with the correct version.

The error remained though:
spamd[31699]: spf: lookup failed: Can't locate object method "handles" via package "IO::Socket::IP" at /usr/local/share/perl5/Net/DNS/Resolver/Base.pm line 735.

Just for kicks I commented out the
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
entry in the /etc/hosts file and WALLA!!! The SPF check started working and more and more spam got caught.

This morning I found another virus/cryptolocker message in my inbox that didn't got marked as spam.
I noticed that the sending IP server was listen on several RBL databases, but was listed in the globally checked dnswl

2016-09-15 23:07:08 x.x.x.x whitelisted in list.dnswl.org in my /var/log/exim/rejectlog

I commented out the rules in my exim.conf (Edit# 35) to disable this whitelist. And submitted the spamming IP's to the DNSWL.
After a month or so when Spamassassin has trained a bit more I'll re-enable this list.

So far so good.

 

[Richard G]

I didn't have that issue yet, but could run into it soon, especially with that IO::Socket::IP thing. I had a ipv6 issue with spamassassin on another server too and had to activate ipv6 again and activate the ip (which I disabled) to get the cpan module loaded again.
The hosts solution you mention seems a lot easyer.
Thank you for sharing.

 

[ikkeben]

Think old perl that is default within compiled has these kind of failures.

BUg ?

A real howto i didn't found for directadmin:
To not use perl part for de dns socket or to update / sett/handle a newer perl version for this part ( sockets and dns ns )

(updating perl for whole system ist probably not a good idea! )

I can't find the issue right now, but in this forum i remember there was aLSO...

https://www.net-dns.org/docs/Changes.html

https://forum.directadmin.com/showthread.php?t=52987