HestiaCp latest version, Debian 12 bookworm, SpamAssassin version 4.0.0. I made the changes but after a while the error reappears. I don’t understand why?!
drwx------ 3 debian-spamd debian-spamd 4096 Feb 23 06:25 .
drwxr-xr-x 6 debian-spamd debian-spamd 4096 Nov 30 21:22 ..
-rwxr-xr-x 1 debian-spamd debian-spamd 327680 Feb 23 06:25 bayes_seen
-rw------- 1 root root 4501504 Feb 23 06:25 bayes_toks
drwxr-xr-x 2 debian-spamd debian-spamd 4096 Aug 1 2023 sa-compile.cache
-rw-r--r-- 1 debian-spamd debian-spamd 1912 Aug 1 2023 user_prefs
cannot open bayes databases /var/lib/spamassassin/.spamassassin/bayes_* R/O: tie failed: Permission denied
$ chown debian-spamd:debian-spamd bayes_toks
$ service spamd restart
Ok, seems the culprit is sa-learn. Checking the time…
$ date -u -d @1708748717
Sat Feb 24 04:25:17 UTC 2024
we see 04:25 UTC and usually cron.daily runs at 06:25 (so your time zone should be UTC+2), I suppose some task defined in cron.daily is causing this and there are two options, spamham or spamassassin.
spamassassin task executes /usr/sbin/spamassassin-maint that it updates spam db but it should not use sa-learn so I suppose spamham is the one causing this.
Check the syslog to view if the time is the same for the spamham launch:
grep scan_reported_mails /var/log/syslog
Yesterday we checked the user used by the script launched by spamham and I couldn’t see errors so no idea where the issue is.
Could you please show the output of these commands?
ls -l /etc/cron.hourly/spamham
md5sum /etc/cron.hourly/spamham
ls -l /etc/dovecot/conf.d/20-spamham.conf
md5sum /etc/dovecot/conf.d/20-spamham.conf
ls -l /etc/dovecot/sieve/scan_reported_mails
md5sum /etc/dovecot/sieve/scan_reported_mails
namei -mo /var/lib/spamassassin/.spamassassin/bayes_toks
ls -l /etc/cron.daily/spamham
md5sum /etc/cron.daily/spamham
This is ok.
That is ok too.
I’ve the same conf and my bayes_toks file has always the same user and group (debian-spamd:debian-spamd) never has been changed when the file is modified
I can’t reproduce it on my system so here the workaround.
Edit /etc/dovecot/sieve/scan_reported_mails and add this code before the last line :
# Workaround to sa-learn changing owner of bayes_toks to root
BAYES_TOKS="${SPAMD_USER_HOMEDIR}/.spamassassin/bayes_toks"
if ! stat -c %U "${BAYES_TOKS}" | grep -q "${SPAMD_USER}"; then
chown "${SPAMD_USER}":"${SPAMD_USER}" "${BAYES_TOKS}"
fi
So you will have something like:
[...]
rmdir ${SPOOL_LEARN_HAM_DIR} &>/dev/null
if [[ X"$?" != X'0' ]]; then
output="$(${SA_LEARN} --ham ${SPOOL_LEARN_HAM_DIR})"
rm -rf ${SPOOL_LEARN_HAM_DIR} &>/dev/null
${LOG} '[CLEAN]' ${output}
fi
# Workaround to sa-learn changing owner of bayes_toks to root
BAYES_TOKS="${SPAMD_USER_HOMEDIR}/.spamassassin/bayes_toks"
if ! stat -c %U "${BAYES_TOKS}" | grep -q "${SPAMD_USER}"; then
chown "${SPAMD_USER}":"${SPAMD_USER}" "${BAYES_TOKS}"
fi
rm -f ${LOCK_FILE} &>/dev/null
