You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by sp...@lcwsoft.com on 2014/06/15 18:32:05 UTC
Add an IP to the DNSBL checks
Hi guys,
I am working on a plugin to check X-PHP-Script and am wondering if
there is a way to add the IP to the DNSBL check list?
Regards,
Lawrence
Re: Add an IP to the DNSBL checks
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 6/16/2014 12:58 PM, RW wrote:
> On Mon, 16 Jun 2014 12:06:02 -0400
> Kevin A. McGrail wrote:
>
>
>> It would be nice if SA would evaluate "X-WebmailclientIP: "
>>
>> as in
>>
>> X-ngMessageSubType: MessageSubType_MAIL
>> X-WebmailclientIP: 23.27.220.31
>>
>> against RBLs
> You can already do that by adding the following line to local.cf
>
>
> originating_ip_headers X-WebmailclientIP
Perhaps but there is no fine grain control over what RBL that's used in,
etc.
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 17.06.2014 16:43, Axb wrote:
> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>> On 17.06.2014 14:09, RW wrote:
>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>> spamassassin@lcwsoft.com wrote:
>>>
>>>
>>>> > originating_ip_headers X-WebmailclientIP
>>>>
>>>> Actually, that might meet my needs in a better way, as I could add
>>>> a
>>>> custom header and then set that.
>>>
>>> I don't think that's a good idea, originating IP addresses may
>>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>>> addresses aren't applied. This is where having an interface for
>>> adding
>>> extra IP addresses to be checked would be useful.
>>
>> In our case, I would only be using it for when the e-mail contains
>> an
>> X-PHP-Script header and is outgoing from our server, to prevent
>> outgoing
>> spam from PHP script, as we have some clients with forms being
>> abused
>> currently and cannot possibly police all their forms.
>
> Can you show us a sample of such a header?
X-PHP-Script: www.example.com/cms/admin/contact.php for 69.195.136.109
Re: Add an IP to the DNSBL checks
Posted by Axb <ax...@gmail.com>.
On 06/18/2014 05:38 PM, spamassassin@lcwsoft.com wrote:
> On 18.06.2014 03:17, Axb wrote:
>> On 06/18/2014 07:34 AM, spamassassin@lcwsoft.com wrote:
>>> On 17.06.2014 17:25, Axb wrote:
>>>> On 06/17/2014 09:13 PM, Axb wrote:
>>>>> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>>>>>> On 17.06.2014 14:09, RW wrote:
>>>>>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>>>>>> spamassassin@lcwsoft.com wrote:
>>>>>>>
>>>>>>>
>>>>>>>> > originating_ip_headers X-WebmailclientIP
>>>>>>>>
>>>>>>>> Actually, that might meet my needs in a better way, as I could
>>>>>>>> add a
>>>>>>>> custom header and then set that.
>>>>>>>
>>>>>>> I don't think that's a good idea, originating IP addresses may
>>>>>>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>>>>>>> addresses aren't applied. This is where having an interface for
>>>>>>> adding
>>>>>>> extra IP addresses to be checked would be useful.
>>>>>>
>>>>>> In our case, I would only be using it for when the e-mail contains an
>>>>>> X-PHP-Script header and is outgoing from our server, to prevent
>>>>>> outgoing
>>>>>> spam from PHP script, as we have some clients with forms being abused
>>>>>> currently and cannot possibly police all their forms.
>>>>>
>>>>> Can you show us a sample of such a header?
>>>>>
>>>>
>>>> I'm trying to understand what adds that header if, as you say, have
>>>> no control over the abused form code?
>>>
>>> PHP with the MailHeaders patch: https://choon.net/php-mail-header.php
>>>
>>> It puts a header with the script name and IP address, which I want to
>>> check against one or more RBLs to see if it is listed as a spammer. We
>>> run SpamAssassin on our outbound mail to help filter any possible
>>> outgoing spam, so such a rule could be used to help prevent outgoing
>>> spam from abused PHP forms on our server as a temporary resolution until
>>> the clients can fix their forms.
>>
>> From what I understand, you want to do a type A lookup with the URIBL
>> plugin against that header and hope some BL has it listed which is
>> highly unlikely because most BLs list spam exit point IPs.
>>
>> XBL and some SBL listings could possibly detect some of this but I
>> wouldn't hold my breath unless you have such a massive problem that
>> you make a global difference.
>>
>> At this point I'm not convinced this will mitigte your problem.
>>
>> Hmmm.....as you're not the first person in the world with this
>> problem I wonder what other approaches could be more efficient....
>
> No. I want to parse out the IP and pass that to the RBLs, see if the IP
> is listed on them, and trigger some rules if so. The reason is that this
> issue is causing other legit e-mails from the same server to be delayed
> by Google and Yahoo as only a few e-mails are sent to them daily and the
> ratio appears to be used by them to rate limit.
When you have your plugin running, pls consider submitting a link for
inclusion in https://wiki.apache.org/spamassassin/CustomPlugins
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 18.06.2014 03:17, Axb wrote:
> On 06/18/2014 07:34 AM, spamassassin@lcwsoft.com wrote:
>> On 17.06.2014 17:25, Axb wrote:
>>> On 06/17/2014 09:13 PM, Axb wrote:
>>>> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>>>>> On 17.06.2014 14:09, RW wrote:
>>>>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>>>>> spamassassin@lcwsoft.com wrote:
>>>>>>
>>>>>>
>>>>>>> > originating_ip_headers X-WebmailclientIP
>>>>>>>
>>>>>>> Actually, that might meet my needs in a better way, as I could
>>>>>>> add a
>>>>>>> custom header and then set that.
>>>>>>
>>>>>> I don't think that's a good idea, originating IP addresses may
>>>>>> legitimately be dynamic, so blocklists that tend to FP on
>>>>>> dynamic
>>>>>> addresses aren't applied. This is where having an interface for
>>>>>> adding
>>>>>> extra IP addresses to be checked would be useful.
>>>>>
>>>>> In our case, I would only be using it for when the e-mail
>>>>> contains an
>>>>> X-PHP-Script header and is outgoing from our server, to prevent
>>>>> outgoing
>>>>> spam from PHP script, as we have some clients with forms being
>>>>> abused
>>>>> currently and cannot possibly police all their forms.
>>>>
>>>> Can you show us a sample of such a header?
>>>>
>>>
>>> I'm trying to understand what adds that header if, as you say, have
>>> no control over the abused form code?
>>
>> PHP with the MailHeaders patch:
>> https://choon.net/php-mail-header.php
>>
>> It puts a header with the script name and IP address, which I want
>> to
>> check against one or more RBLs to see if it is listed as a spammer.
>> We
>> run SpamAssassin on our outbound mail to help filter any possible
>> outgoing spam, so such a rule could be used to help prevent outgoing
>> spam from abused PHP forms on our server as a temporary resolution
>> until
>> the clients can fix their forms.
>
> From what I understand, you want to do a type A lookup with the URIBL
> plugin against that header and hope some BL has it listed which is
> highly unlikely because most BLs list spam exit point IPs.
>
> XBL and some SBL listings could possibly detect some of this but I
> wouldn't hold my breath unless you have such a massive problem that
> you make a global difference.
>
> At this point I'm not convinced this will mitigte your problem.
>
> Hmmm.....as you're not the first person in the world with this
> problem I wonder what other approaches could be more efficient....
No. I want to parse out the IP and pass that to the RBLs, see if the IP
is listed on them, and trigger some rules if so. The reason is that this
issue is causing other legit e-mails from the same server to be delayed
by Google and Yahoo as only a few e-mails are sent to them daily and the
ratio appears to be used by them to rate limit.
Re: Add an IP to the DNSBL checks
Posted by Axb <ax...@gmail.com>.
On 06/18/2014 07:34 AM, spamassassin@lcwsoft.com wrote:
> On 17.06.2014 17:25, Axb wrote:
>> On 06/17/2014 09:13 PM, Axb wrote:
>>> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>>>> On 17.06.2014 14:09, RW wrote:
>>>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>>>> spamassassin@lcwsoft.com wrote:
>>>>>
>>>>>
>>>>>> > originating_ip_headers X-WebmailclientIP
>>>>>>
>>>>>> Actually, that might meet my needs in a better way, as I could add a
>>>>>> custom header and then set that.
>>>>>
>>>>> I don't think that's a good idea, originating IP addresses may
>>>>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>>>>> addresses aren't applied. This is where having an interface for adding
>>>>> extra IP addresses to be checked would be useful.
>>>>
>>>> In our case, I would only be using it for when the e-mail contains an
>>>> X-PHP-Script header and is outgoing from our server, to prevent
>>>> outgoing
>>>> spam from PHP script, as we have some clients with forms being abused
>>>> currently and cannot possibly police all their forms.
>>>
>>> Can you show us a sample of such a header?
>>>
>>
>> I'm trying to understand what adds that header if, as you say, have
>> no control over the abused form code?
>
> PHP with the MailHeaders patch: https://choon.net/php-mail-header.php
>
> It puts a header with the script name and IP address, which I want to
> check against one or more RBLs to see if it is listed as a spammer. We
> run SpamAssassin on our outbound mail to help filter any possible
> outgoing spam, so such a rule could be used to help prevent outgoing
> spam from abused PHP forms on our server as a temporary resolution until
> the clients can fix their forms.
From what I understand, you want to do a type A lookup with the URIBL
plugin against that header and hope some BL has it listed which is
highly unlikely because most BLs list spam exit point IPs.
XBL and some SBL listings could possibly detect some of this but I
wouldn't hold my breath unless you have such a massive problem that you
make a global difference.
At this point I'm not convinced this will mitigte your problem.
Hmmm.....as you're not the first person in the world with this problem I
wonder what other approaches could be more efficient....
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 17.06.2014 17:25, Axb wrote:
> On 06/17/2014 09:13 PM, Axb wrote:
>> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>>> On 17.06.2014 14:09, RW wrote:
>>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>>> spamassassin@lcwsoft.com wrote:
>>>>
>>>>
>>>>> > originating_ip_headers X-WebmailclientIP
>>>>>
>>>>> Actually, that might meet my needs in a better way, as I could
>>>>> add a
>>>>> custom header and then set that.
>>>>
>>>> I don't think that's a good idea, originating IP addresses may
>>>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>>>> addresses aren't applied. This is where having an interface for
>>>> adding
>>>> extra IP addresses to be checked would be useful.
>>>
>>> In our case, I would only be using it for when the e-mail contains
>>> an
>>> X-PHP-Script header and is outgoing from our server, to prevent
>>> outgoing
>>> spam from PHP script, as we have some clients with forms being
>>> abused
>>> currently and cannot possibly police all their forms.
>>
>> Can you show us a sample of such a header?
>>
>
> I'm trying to understand what adds that header if, as you say, have
> no control over the abused form code?
PHP with the MailHeaders patch: https://choon.net/php-mail-header.php
It puts a header with the script name and IP address, which I want to
check against one or more RBLs to see if it is listed as a spammer. We
run SpamAssassin on our outbound mail to help filter any possible
outgoing spam, so such a rule could be used to help prevent outgoing
spam from abused PHP forms on our server as a temporary resolution until
the clients can fix their forms.
Re: Add an IP to the DNSBL checks
Posted by Axb <ax...@gmail.com>.
On 06/17/2014 09:13 PM, Axb wrote:
> On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
>> On 17.06.2014 14:09, RW wrote:
>>> On Mon, 16 Jun 2014 17:03:31 -0230
>>> spamassassin@lcwsoft.com wrote:
>>>
>>>
>>>> > originating_ip_headers X-WebmailclientIP
>>>>
>>>> Actually, that might meet my needs in a better way, as I could add a
>>>> custom header and then set that.
>>>
>>> I don't think that's a good idea, originating IP addresses may
>>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>>> addresses aren't applied. This is where having an interface for adding
>>> extra IP addresses to be checked would be useful.
>>
>> In our case, I would only be using it for when the e-mail contains an
>> X-PHP-Script header and is outgoing from our server, to prevent outgoing
>> spam from PHP script, as we have some clients with forms being abused
>> currently and cannot possibly police all their forms.
>
> Can you show us a sample of such a header?
>
I'm trying to understand what adds that header if, as you say, have no
control over the abused form code?
Re: Add an IP to the DNSBL checks
Posted by Axb <ax...@gmail.com>.
On 06/17/2014 08:40 PM, spamassassin@lcwsoft.com wrote:
> On 17.06.2014 14:09, RW wrote:
>> On Mon, 16 Jun 2014 17:03:31 -0230
>> spamassassin@lcwsoft.com wrote:
>>
>>
>>> > originating_ip_headers X-WebmailclientIP
>>>
>>> Actually, that might meet my needs in a better way, as I could add a
>>> custom header and then set that.
>>
>> I don't think that's a good idea, originating IP addresses may
>> legitimately be dynamic, so blocklists that tend to FP on dynamic
>> addresses aren't applied. This is where having an interface for adding
>> extra IP addresses to be checked would be useful.
>
> In our case, I would only be using it for when the e-mail contains an
> X-PHP-Script header and is outgoing from our server, to prevent outgoing
> spam from PHP script, as we have some clients with forms being abused
> currently and cannot possibly police all their forms.
Can you show us a sample of such a header?
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 17.06.2014 14:09, RW wrote:
> On Mon, 16 Jun 2014 17:03:31 -0230
> spamassassin@lcwsoft.com wrote:
>
>
>> > originating_ip_headers X-WebmailclientIP
>>
>> Actually, that might meet my needs in a better way, as I could add a
>> custom header and then set that.
>
> I don't think that's a good idea, originating IP addresses may
> legitimately be dynamic, so blocklists that tend to FP on dynamic
> addresses aren't applied. This is where having an interface for
> adding
> extra IP addresses to be checked would be useful.
In our case, I would only be using it for when the e-mail contains an
X-PHP-Script header and is outgoing from our server, to prevent outgoing
spam from PHP script, as we have some clients with forms being abused
currently and cannot possibly police all their forms.
- Lawrence
Re: Add an IP to the DNSBL checks
Posted by RW <rw...@googlemail.com>.
On Mon, 16 Jun 2014 17:03:31 -0230
spamassassin@lcwsoft.com wrote:
> > originating_ip_headers X-WebmailclientIP
>
> Actually, that might meet my needs in a better way, as I could add a
> custom header and then set that.
I don't think that's a good idea, originating IP addresses may
legitimately be dynamic, so blocklists that tend to FP on dynamic
addresses aren't applied. This is where having an interface for adding
extra IP addresses to be checked would be useful.
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 16.06.2014 14:28, RW wrote:
> On Mon, 16 Jun 2014 12:06:02 -0400
> Kevin A. McGrail wrote:
>
>
>> It would be nice if SA would evaluate "X-WebmailclientIP: "
>>
>> as in
>>
>> X-ngMessageSubType: MessageSubType_MAIL
>> X-WebmailclientIP: 23.27.220.31
>>
>> against RBLs
>
> You can already do that by adding the following line to local.cf
>
>
> originating_ip_headers X-WebmailclientIP
Actually, that might meet my needs in a better way, as I could add a
custom header and then set that.
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 16.06.2014 14:28, RW wrote:
> On Mon, 16 Jun 2014 12:06:02 -0400
> Kevin A. McGrail wrote:
>
>
>> It would be nice if SA would evaluate "X-WebmailclientIP: "
>>
>> as in
>>
>> X-ngMessageSubType: MessageSubType_MAIL
>> X-WebmailclientIP: 23.27.220.31
>>
>> against RBLs
>
> You can already do that by adding the following line to local.cf
>
>
> originating_ip_headers X-WebmailclientIP
Would it be possible to override this setting from a plugin?
Re: Add an IP to the DNSBL checks
Posted by RW <rw...@googlemail.com>.
On Mon, 16 Jun 2014 12:06:02 -0400
Kevin A. McGrail wrote:
> It would be nice if SA would evaluate "X-WebmailclientIP: "
>
> as in
>
> X-ngMessageSubType: MessageSubType_MAIL
> X-WebmailclientIP: 23.27.220.31
>
> against RBLs
You can already do that by adding the following line to local.cf
originating_ip_headers X-WebmailclientIP
Re: Add an IP to the DNSBL checks
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 6/16/2014 11:59 AM, spamassassin@lcwsoft.com wrote:
> Thanks for your insight. Are you currently aware of any other plugins
> that do this currently, so I can get some inspiration and see how it
> works? I know Perl so I don't expect to have too much difficulty with
> it :)
Here's my own notes on the matter and I would look at the
http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf, look at SVN
trunk and the code around
KAM_FROM_URIBL_PCCC where you can see some of the new functions I added.
GOAL: Add the ability to check the reply-to (and other defined headers
in config perhaps such as KAM-Reverse) capabilities to SA for URI's
From checking code, look at lib/Mail/SpamAssassin/Plugin/DNSEval.pm for
something based off of this function
# this only checks the address host name and not the domain name because
# using the domain name had much worse results for dsn.rfc-ignorant.org
sub check_rbl_envfrom {
_check_rbl_addresses(@_, $_[1]->get('EnvelopeFrom:addr',undef));
}
And:
It would be nice if SA would evaluate "X-WebmailclientIP: "
as in
X-ngMessageSubType: MessageSubType_MAIL
X-WebmailclientIP: 23.27.220.31
against RBLs
> X-PHP-Script: www.example.com/cms/admin/contact.php
<http://www.example.com/cms/admin/contact.php> for 69.195.136.109
>
> and I am trying to do a lookup against SpamHaus ZEN preferably
For example, the check_rbl_from_host function as used here:
header KAM_FROM_URIBL_PCCC
eval:check_rbl_from_host('pccc','multi.pccc.com.', '127.0.0.4')
I already want to make a few functions to check any named header for IPs
or URIs to then check against RBLs.
I'll add this to the list as others wanted to evaluate things like
X-WebmailclientIP as well.
Re: Add an IP to the DNSBL checks
Posted by sp...@lcwsoft.com.
On 16.06.2014 12:41, Kevin A. McGrail wrote:
> On 6/16/2014 9:49 AM, spamassassin@lcwsoft.com [3] wrote:
>
>> On 16.06.2014 00:16, Kevin A. McGrail wrote:
>>
>>> On 6/15/2014 12:32 PM, spamassassin@lcwsoft.com [1] wrote:
>>>
>>>> I am working on a plugin to check X-PHP-Script and am wondering
>>>> if there is a way to add the IP to the DNSBL check list?
>>> What's the header look like and what RBL are you trying to use to
>>> do
>>> the lookup against?
>> The header looks like this:
>>
>> X-PHP-Script: www.example.com/cms/admin/contact.php [2] for
>> 69.195.136.109
>>
>> and I am trying to do a lookup against SpamHaus ZEN preferably
> The RBL code currently requires custom code. For example, the
> check_rbl_from_host function as used here:
>
> header KAM_FROM_URIBL_PCCC
> eval:check_rbl_from_host('pccc','multi.pccc.com.', '127.0.0.4')
>
> I already want to make a few functions to check any named header for
> IPs or URIs to then check against RBLs.
>
> I'll add this to the list as others wanted to evaluate things like
> X-WebmailclientIP as well.
>
> regards,
> KAM
>
>
>
> Links:
> ------
> [1] mailto:spamassassin@lcwsoft.com
> [2] http://www.example.com/cms/admin/contact.php
> [3] mailto:spamassassin@lcwsoft.com
Hi Kevin,
Thanks for your insight. Are you currently aware of any other plugins
that do this currently, so I can get some inspiration and see how it
works? I know Perl so I don't expect to have too much difficulty with it
:)
Regards,
Lawrence
Re: Add an IP to the DNSBL checks
Posted by "Kevin A. McGrail" <KM...@PCCC.com>.
On 6/16/2014 9:49 AM, spamassassin@lcwsoft.com wrote:
> On 16.06.2014 00:16, Kevin A. McGrail wrote:
>> On 6/15/2014 12:32 PM, spamassassin@lcwsoft.com wrote:
>>> I am working on a plugin to check X-PHP-Script and am wondering if
>>> there is a way to add the IP to the DNSBL check list?
>> What's the header look like and what RBL are you trying to use to do
>> the lookup against?
> The header looks like this:
>
> X-PHP-Script: www.example.com/cms/admin/contact.php for 69.195.136.109
>
> and I am trying to do a lookup against SpamHaus ZEN preferably
The RBL code currently requires custom code. For example, the
check_rbl_from_host function as used here:
header KAM_FROM_URIBL_PCCC
eval:check_rbl_from_host('pccc','multi.pccc.com.', '127.0.0.4')
I already want to make a few functions to check any named header for IPs
or URIs to then check against RBLs.
I'll add this to the list as others wanted to evaluate things like
X-WebmailclientIP as well.
regards,
KAM