You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Gene Heskett <ge...@verizon.net> on 2007/01/25 17:50:13 UTC
Rulesdujour?
Greetings;
I got this email from Rules_Du_Jour this morning, what is the fix?
Thu Jan 25 05:59:52 2007
***WARNING***: spamassassin --lint failed.
Rolling configuration files back, not restarting SpamAssassin.
Rollback command is:
mv -f /etc/mail/spamassassin/antidrug.cf /etc/mail/spamassassin/RulesDuJour/antidrug.cf.2;
mv -f /etc/mail/spamassassin/RulesDuJour/antidrug.cf.20070125-0559 /etc/mail/spamassassin/antidrug.cf;
Lint output: [16404] warn: config: failed to parse line, skipping: README:
[16404] warn: config: failed to parse line, skipping: WARNING: YOU HAVE
DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS ACCOUNT.
[16404] warn: config: failed to parse line, skipping: Someone else will
eventually have control of this webspace, possibly a malicious spammer.
[16404] warn: config: failed to parse line, skipping: STOP using RDJ on
this file *NOW*
[16404] warn: config: failed to parse line, skipping: Also, make note of
the fact that this file is for users of SA 2.64 and below.
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""you" "are""
[16404] warn: (Missing operator before "are"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""are" "running""
[16404] warn: (Missing operator before "running"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""running" "SA""
[16404] warn: (Missing operator before "SA"?)
[16404] warn: Number found where operator expected at (eval 1122) line 1,
near ""SA" 3.0.0"
[16404] warn: (Missing operator before 3.0.0?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near "3.0.0 "or""
[16404] warn: (Missing operator before "or"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""or" "higher""
[16404] warn: (Missing operator before "higher"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""higher" "you""
[16404] warn: (Missing operator before "you"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""you" "already""
[16404] warn: (Missing operator before "already"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""already" "have""
[16404] warn: (Missing operator before "have"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""have" "antidrug""
[16404] warn: (Missing operator before "antidrug"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""antidrug" "and""
[16404] warn: (Missing operator before "and"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""and" "this""
[16404] warn: (Missing operator before "this"?)
[16404] warn: String found where operator expected at (eval 1122) line 1,
near ""this" "file""
[16404] warn: (Missing operator before "file"?)
[16404] warn: config: unclosed 'if' in /etc/mail/spamassassin/antidrug.cf:
if you are running SA 3.0.0 or higher, you already have antidrug and this
file
[16404] warn: lint: 6 issues detected, please rerun with debug enabled for
more information
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2007 by Maurice Eugene Heskett, all rights reserved.
Re: Rulesdujour?
Posted by Gene Heskett <ge...@verizon.net>.
On Thursday 25 January 2007 12:33, Nigel Frankcom wrote:
>On Thu, 25 Jan 2007 12:20:09 -0500, Gene Heskett
>
><ge...@verizon.net> wrote:
>>On Thursday 25 January 2007 11:56, Theo Van Dinter wrote:
>>>On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote:
>>>> I got this email from Rules_Du_Jour this morning, what is the fix?
>>>
>>>Don't take this the wrong way, but did you read the errors at all?
>>>
>>>> Lint output: [16404] warn: config: failed to parse line, skipping:
>>>> README: [16404] warn: config: failed to parse line, skipping:
>>>> WARNING: YOU HAVE DOWNLOADED THIS RULESET from COMCAST. I am
>>>> TERMINATING THIS ACCOUNT. [16404] warn: config: failed to parse
>>>> line, skipping: Someone else will eventually have control of this
>>>> webspace, possibly a malicious spammer. [16404] warn: config: failed
>>>> to parse line, skipping: STOP using RDJ on this file *NOW*
>>>> [16404] warn: config: failed to parse line, skipping: Also, make
>>>> note of the fact that this file is for users of SA 2.64 and below.
>>>
>>>It makes it pretty clear that you should stop using it and why.
>>
>>Yes I did read it, but I'm not sure what rule I should remove, or if I
>>should stop using rulesdujour. Has it fallen out of favor or was it
>> too good for somebody?
>>
>>FWIW, rulesdujour, if its complaining about a package, should not only
>> say its an out of date package, but should name it so that one can
>> find and remove it! This message didn't arrive until after this one
>> this morning:
>>
>>Matt Kettler's AntiDrug has changed on coyote.coyote.den.
>>Version line: # rev 0.65 10/01/2006 - updated URL, etc
>>
>>So I assume that's the file being bitched about, so I've removed
>> several of them in the /etc/spamassassin/rulesdujour dir, and removed
>> the antidrug thing from /etc/rulesdujour/config.
>>
>>Damn I get enough of that, some of them claim I could get it up if I
>> was 100 years old. But I'm diabetic & 72, so the chances are
>> somewhere between damned slim and none.
>
>What else is in your RDJ config? It might be worth taking a walk
>through the rules site and just checking what you've got and what, if
>any have been obfuscated.
>
>Kind regards
>
>Nigel
TRUSTED_RULESETS="EVILNUMBERS EVILNUMBERS1 EVILNUMBERS2 BOGUSVIRUS
SARE_ADULT SARE_BAYES_POISON_NXM SARE_BML SARE_CODING
SARE_REDIRECT_POST300 SARE_GENLSUBJ SARE_UNSUB SARE_HEADER0 SARE_HEADER2
SARE_OBFU0 SARE_OBFU1 SARE_OEM SARE_RANDOM SARE_URI0 SARE_URI1 SARE_URI3
SARE_URI_ENG SARE_WHITELIST SARE_WHITELIST_SPF SARE_WHITELIST_RCVD
SARE_SPECIFIC SARE_STOCKS SARE_FRAUD SARE_SPOOF ZMI_GERMAN"
SA_DIR="/etc/mail/spamassassin"
MAIL_ADDRESS="root@coyote.coyote.den"
SA_RESTART="killall -HUP spamd"
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2007 by Maurice Eugene Heskett, all rights reserved.
Re: Rulesdujour?
Posted by Nigel Frankcom <ni...@blue-canoe.net>.
On Thu, 25 Jan 2007 12:20:09 -0500, Gene Heskett
<ge...@verizon.net> wrote:
>On Thursday 25 January 2007 11:56, Theo Van Dinter wrote:
>>On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote:
>>> I got this email from Rules_Du_Jour this morning, what is the fix?
>>
>>Don't take this the wrong way, but did you read the errors at all?
>>
>>> Lint output: [16404] warn: config: failed to parse line, skipping:
>>> README: [16404] warn: config: failed to parse line, skipping: WARNING:
>>> YOU HAVE DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS
>>> ACCOUNT. [16404] warn: config: failed to parse line, skipping: Someone
>>> else will eventually have control of this webspace, possibly a
>>> malicious spammer. [16404] warn: config: failed to parse line,
>>> skipping: STOP using RDJ on this file *NOW*
>>> [16404] warn: config: failed to parse line, skipping: Also, make note
>>> of the fact that this file is for users of SA 2.64 and below.
>>
>>It makes it pretty clear that you should stop using it and why.
>
>Yes I did read it, but I'm not sure what rule I should remove, or if I
>should stop using rulesdujour. Has it fallen out of favor or was it too
>good for somebody?
>
>FWIW, rulesdujour, if its complaining about a package, should not only say
>its an out of date package, but should name it so that one can find and
>remove it! This message didn't arrive until after this one this morning:
>
>Matt Kettler's AntiDrug has changed on coyote.coyote.den.
>Version line: # rev 0.65 10/01/2006 - updated URL, etc
>
>So I assume that's the file being bitched about, so I've removed several
>of them in the /etc/spamassassin/rulesdujour dir, and removed the
>antidrug thing from /etc/rulesdujour/config.
>
>Damn I get enough of that, some of them claim I could get it up if I was
>100 years old. But I'm diabetic & 72, so the chances are somewhere
>between damned slim and none.
What else is in your RDJ config? It might be worth taking a walk
through the rules site and just checking what you've got and what, if
any have been obfuscated.
Kind regards
Nigel
Re: Rulesdujour?
Posted by Matt Kettler <mk...@verizon.net>.
Gene Heskett wrote:
> On Thursday 25 January 2007 11:56, Theo Van Dinter wrote:
>
>> On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote:
>>
>>> I got this email from Rules_Du_Jour this morning, what is the fix?
>>>
>> Don't take this the wrong way, but did you read the errors at all?
>>
>>
>>> Lint output: [16404] warn: config: failed to parse line, skipping:
>>> README: [16404] warn: config: failed to parse line, skipping: WARNING:
>>> YOU HAVE DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS
>>> ACCOUNT. [16404] warn: config: failed to parse line, skipping: Someone
>>> else will eventually have control of this webspace, possibly a
>>> malicious spammer. [16404] warn: config: failed to parse line,
>>> skipping: STOP using RDJ on this file *NOW*
>>> [16404] warn: config: failed to parse line, skipping: Also, make note
>>> of the fact that this file is for users of SA 2.64 and below.
>>>
>> It makes it pretty clear that you should stop using it and why.
>>
>
> Yes I did read it, but I'm not sure what rule I should remove, or if I
> should stop using rulesdujour. Has it fallen out of favor or was it too
> good for somebody?
No, you shouldn't stop using RDJ.
You should however stop using RDJ to update antidrug, for the following
reasons:
1) Antidrug is no longer actively maintained. I haven't edited the rules
themselves in a very long time, over a year. You've probably downloaded
update since, but it's all notes in the comments. ie: don't use this
with 3.0.0 or higher went in back in june or july 06. October 06 saw the
ruleset updated with a comment telling you it moved (that few read).
2) Antidrug is a part of SA as of SA 3.0.0. If you're using antidrug
with SA 3.0.0 or higher, you're possibly downgrading your antidrug
rules. Unless you're using SA 2.64 or lower, you should remove
antidrug.cf from your system completely.
3) If I ever make updates to the antidrug rules, I'd submit them to the
main SA project to avoid conflicts. I will likely NOT update
antidrug.cf. (anyone using 2.64 or older would get a much bigger boost
in accuracy from updating SA than they will from updating my rules.)
Therefore, checking Antidrug with RDJ is pointless. In fact, the
current version of RDJ no longer supports antidrug at all for this very
reason.
So, I suggest that you take the following steps:
1) update your RDJ. Chris Thielen, the author of RDJ, has in the past
pointed out that it's no longer available via exit0.us, but can be
gotten here:
http://sandgnat.com/rdj/rules_du_jour
2) remove antidrug.cf from your system unless your SA version is 2.64 or
lower. If it is, I would SERIOUSLY consider upgrading.
Re: Rulesdujour?
Posted by Gene Heskett <ge...@verizon.net>.
On Thursday 25 January 2007 11:56, Theo Van Dinter wrote:
>On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote:
>> I got this email from Rules_Du_Jour this morning, what is the fix?
>
>Don't take this the wrong way, but did you read the errors at all?
>
>> Lint output: [16404] warn: config: failed to parse line, skipping:
>> README: [16404] warn: config: failed to parse line, skipping: WARNING:
>> YOU HAVE DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS
>> ACCOUNT. [16404] warn: config: failed to parse line, skipping: Someone
>> else will eventually have control of this webspace, possibly a
>> malicious spammer. [16404] warn: config: failed to parse line,
>> skipping: STOP using RDJ on this file *NOW*
>> [16404] warn: config: failed to parse line, skipping: Also, make note
>> of the fact that this file is for users of SA 2.64 and below.
>
>It makes it pretty clear that you should stop using it and why.
Yes I did read it, but I'm not sure what rule I should remove, or if I
should stop using rulesdujour. Has it fallen out of favor or was it too
good for somebody?
FWIW, rulesdujour, if its complaining about a package, should not only say
its an out of date package, but should name it so that one can find and
remove it! This message didn't arrive until after this one this morning:
Matt Kettler's AntiDrug has changed on coyote.coyote.den.
Version line: # rev 0.65 10/01/2006 - updated URL, etc
So I assume that's the file being bitched about, so I've removed several
of them in the /etc/spamassassin/rulesdujour dir, and removed the
antidrug thing from /etc/rulesdujour/config.
Damn I get enough of that, some of them claim I could get it up if I was
100 years old. But I'm diabetic & 72, so the chances are somewhere
between damned slim and none.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2007 by Maurice Eugene Heskett, all rights reserved.
Re: Rulesdujour?
Posted by Theo Van Dinter <fe...@apache.org>.
On Thu, Jan 25, 2007 at 11:50:13AM -0500, Gene Heskett wrote:
> I got this email from Rules_Du_Jour this morning, what is the fix?
Don't take this the wrong way, but did you read the errors at all?
> Lint output: [16404] warn: config: failed to parse line, skipping: README:
> [16404] warn: config: failed to parse line, skipping: WARNING: YOU HAVE
> DOWNLOADED THIS RULESET from COMCAST. I am TERMINATING THIS ACCOUNT.
> [16404] warn: config: failed to parse line, skipping: Someone else will
> eventually have control of this webspace, possibly a malicious spammer.
> [16404] warn: config: failed to parse line, skipping: STOP using RDJ on
> this file *NOW*
> [16404] warn: config: failed to parse line, skipping: Also, make note of
> the fact that this file is for users of SA 2.64 and below.
It makes it pretty clear that you should stop using it and why.
--
Randomly Selected Tagline:
Ask them to list all 54 flavors, then order Vanilla.