You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@spamassassin.apache.org by Charles Gregory <cg...@hwcn.org> on 2009/07/01 14:08:52 UTC

Re: [sa] Re: New type of spam... (very curious)

On Wed, 1 Jul 2009, richard@buzzhost.co.uk wrote:
> Jul  1 07:38:46 munged #14781: query: 1.2.3.4.dnsbl.sorbs.net IN A +
> Oh, and look: dnsbl.sorbs.net
> So it seems that the demise of sorbs will add latency if their servers
> stop answering...

...which leads back to my original question,
Will the developers issue an sa-update to remove the sorbs test
if sorbs is not kept alive?

-C

Re: New type of spam... (very curious)

Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.

> > > > On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
> > > > >
> > > > > But for the paranoid will changing 50_scores.cf from;
> > > > >
> > > > > score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> > > > > score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> > > > > score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> > > > > score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> > > > > score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> > > > > score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> > > > > score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> > > > > score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
> > > > >
> > > > > TO
> > > > >
> > > > > score RCVD_IN_SORBS_BLOCK 0
> > > > > score RCVD_IN_SORBS_DUL 0
> > > > > score RCVD_IN_SORBS_HTTP 0
> > > > > score RCVD_IN_SORBS_MISC 0
> > > > > score RCVD_IN_SORBS_SMTP 0
> > > > > score RCVD_IN_SORBS_SOCKS 0
> > > > > score RCVD_IN_SORBS_WEB 0
> > > > > score RCVD_IN_SORBS_ZOMBIE 0

> > > On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
> > > > DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
> > > > positive you want to.

> > On Thu, 2009-07-02 at 05:32 +0100, richard@buzzhost.co.uk wrote:
> > > Why?

> On Thu, 2009-07-02 at 08:28 +0200, Kasper Sacharias Eenberg wrote:
> > It might get overwritten if updated. The safe bet is to put it in
> > local.cf. (Any .cf in /etc/mail/spamassassin will work afaik).

On 02.07.09 08:20, richard@buzzhost.co.uk wrote:
> On my box this is a symlink to /etc/spamassassin.

then put the .cf to /etc/spamassassin.

> It will read .cf fine,
> but it won't tolerate a subdirectory 'custom_rules' with .cf

there's no code to search in subdirectories. I doubt it will ever be.

> > Besides from a logical point of view it makes sense for me to have all
> > my rules in one file/dir, and leave the standard files alone so i can
> > blame other people when things go wrong :)

> So, to disable these rules and stop the Sorbs lookups from happening
> just how do we do it ? If we should not alter the score here do we just
> paste the above block into a file like custom_sorbs.cf and that will do
> it or will the built in rule take precedence?

there are no built-in rules. scores of 0 in local .cf will override those in
rule subdirectories.
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Eagles may soar, but weasels don't get sucked into jet engines.

Re: New type of spam... (very curious)

Posted by Benny Pedersen <me...@junc.org>.

On Thu, July 2, 2009 06:32, richard@buzzhost.co.uk wrote:

> Will it result in a nuclear war?

yes, and burn down all googles servers aswell :)

-- 
xpoint

Re: New type of spam... (very curious)

Posted by Steve Freegard <st...@fsl.com>.

Kasper Sacharias Eenberg wrote:
> On Thu, 2009-07-02 at 08:20 +0100, richard@buzzhost.co.uk wrote:
>> On Thu, 2009-07-02 at 08:28 +0200, Kasper Sacharias Eenberg wrote:
>>> On Thu, 2009-07-02 at 05:32 +0100, richard@buzzhost.co.uk wrote:
>>>> On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
>>>>> On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
>> So, to disable these rules and stop the Sorbs lookups from happening
>> just how do we do it ? If we should not alter the score here do we just
>> paste the above block into a file like custom_sorbs.cf and that will do
>> it or will the built in rule take precedence?
> 
> The /etc/mail/spamassassin ( or /etc/spamassassin in your case) is the
> custom dir. Just put them in there.
> 
> Anything you put into rules in /etc/mail/spamassassin will take
> presedence over rules made with sa-update or installed with
> Spamassassin.
> 
> So putting these in /etc/... will disable SORBS lookups altogether.
> 
> score RCVD_IN_SORBS_BLOCK 0
> score RCVD_IN_SORBS_DUL 0
> score RCVD_IN_SORBS_HTTP 0
> score RCVD_IN_SORBS_MISC 0
> score RCVD_IN_SORBS_SMTP 0
> score RCVD_IN_SORBS_SOCKS 0
> score RCVD_IN_SORBS_WEB 0
> score RCVD_IN_SORBS_ZOMBIE 0
> 
> Run 'man spamassassin' and read the 'CONFIGURATION FILES' chapter to get
> a full understanding.
> 

Actually; you could save yourself some typing:

score __RCVD_IN_SORBS 0
score RCVD_IN_SORBS_DUL 0

is all that is necessary to put into local.cf to disable the lookups for
SORBS.  This is because for multiple return lists like SORBS SA queries
the list once (using eval:check_rbl()) and then each test checks the
result and return code of the original (using eval:check_rbl_sub()), so
if you disable the parent query; you disable all the dependent tests.

If you do a "grep -Eh 'check_rbl\(' *" in your SpamAssassin updates
directory; you'll be able to see all of these parent lookups, then do a
"grep -Eh 'check_rbl_sub\(' *'" to see the lookups based on these.

Cheers,
Steve.

Re: New type of spam... (very curious)

Posted by Kasper Sacharias Eenberg <ks...@hovmark.dk>.

On Thu, 2009-07-02 at 08:20 +0100, richard@buzzhost.co.uk wrote:
> On Thu, 2009-07-02 at 08:28 +0200, Kasper Sacharias Eenberg wrote:
> > On Thu, 2009-07-02 at 05:32 +0100, richard@buzzhost.co.uk wrote:
> > > On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
> > > > On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
> > > > >
> > > > > But for the paranoid will changing 50_scores.cf from;
> > > > >
> > > > > score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> > > > > score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> > > > > score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> > > > > score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> > > > > score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> > > > > score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> > > > > score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> > > > > score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
> > > > >
> > > > > TO
> > > > >
> > > > > score RCVD_IN_SORBS_BLOCK 0
> > > > > score RCVD_IN_SORBS_DUL 0
> > > > > score RCVD_IN_SORBS_HTTP 0
> > > > > score RCVD_IN_SORBS_MISC 0
> > > > > score RCVD_IN_SORBS_SMTP 0
> > > > > score RCVD_IN_SORBS_SOCKS 0
> > > > > score RCVD_IN_SORBS_WEB 0
> > > > > score RCVD_IN_SORBS_ZOMBIE 0
> > > > >
> > > > > Stop the 'cost' of the lookup?
> > > > 
> > > > DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
> > > > positive you want to.
> > > Why?
> > > 
> > > Will it result in a nuclear war?
> > > 
> > And blood will flow from the elevators!
> NO WAY! Will there be any Al Bowlly music playing in the background?
> > 
> > It might get overwritten if updated. The safe bet is to put it in
> > local.cf. (Any .cf in /etc/mail/spamassassin will work afaik).
> On my box this is a symlink to /etc/spamassassin. It will read .cf fine,
> but it won't tolerate a subdirectory 'custom_rules' with .cf
> > 
> > Besides from a logical point of view it makes sense for me to have all
> > my rules in one file/dir, and leave the standard files alone so i can
> > blame other people when things go wrong :)
> > You know the saying "Code like the person who's gonna be maintaining the
> > code is a homicidal maniac"?
> Windows Vista?
> > It's the same for sysadmining.
> So, to disable these rules and stop the Sorbs lookups from happening
> just how do we do it ? If we should not alter the score here do we just
> paste the above block into a file like custom_sorbs.cf and that will do
> it or will the built in rule take precedence?
> > 
> 

The /etc/mail/spamassassin ( or /etc/spamassassin in your case) is the
custom dir. Just put them in there.

Anything you put into rules in /etc/mail/spamassassin will take
presedence over rules made with sa-update or installed with
Spamassassin.

So putting these in /etc/... will disable SORBS lookups altogether.

score RCVD_IN_SORBS_BLOCK 0
score RCVD_IN_SORBS_DUL 0
score RCVD_IN_SORBS_HTTP 0
score RCVD_IN_SORBS_MISC 0
score RCVD_IN_SORBS_SMTP 0
score RCVD_IN_SORBS_SOCKS 0
score RCVD_IN_SORBS_WEB 0
score RCVD_IN_SORBS_ZOMBIE 0

Run 'man spamassassin' and read the 'CONFIGURATION FILES' chapter to get
a full understanding.

With regards,
Kasper

Re: New type of spam... (very curious)

Posted by "richard@buzzhost.co.uk" <ri...@buzzhost.co.uk>.

On Thu, 2009-07-02 at 08:28 +0200, Kasper Sacharias Eenberg wrote:
> On Thu, 2009-07-02 at 05:32 +0100, richard@buzzhost.co.uk wrote:
> > On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
> > > On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
> > > >
> > > > But for the paranoid will changing 50_scores.cf from;
> > > >
> > > > score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> > > > score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> > > > score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> > > > score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> > > > score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> > > > score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> > > > score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> > > > score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
> > > >
> > > > TO
> > > >
> > > > score RCVD_IN_SORBS_BLOCK 0
> > > > score RCVD_IN_SORBS_DUL 0
> > > > score RCVD_IN_SORBS_HTTP 0
> > > > score RCVD_IN_SORBS_MISC 0
> > > > score RCVD_IN_SORBS_SMTP 0
> > > > score RCVD_IN_SORBS_SOCKS 0
> > > > score RCVD_IN_SORBS_WEB 0
> > > > score RCVD_IN_SORBS_ZOMBIE 0
> > > >
> > > > Stop the 'cost' of the lookup?
> > > 
> > > DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
> > > positive you want to.
> > Why?
> > 
> > Will it result in a nuclear war?
> > 
> And blood will flow from the elevators!
NO WAY! Will there be any Al Bowlly music playing in the background?
> 
> It might get overwritten if updated. The safe bet is to put it in
> local.cf. (Any .cf in /etc/mail/spamassassin will work afaik).
On my box this is a symlink to /etc/spamassassin. It will read .cf fine,
but it won't tolerate a subdirectory 'custom_rules' with .cf
> 
> Besides from a logical point of view it makes sense for me to have all
> my rules in one file/dir, and leave the standard files alone so i can
> blame other people when things go wrong :)
> You know the saying "Code like the person who's gonna be maintaining the
> code is a homicidal maniac"?
Windows Vista?
> It's the same for sysadmining.
So, to disable these rules and stop the Sorbs lookups from happening
just how do we do it ? If we should not alter the score here do we just
paste the above block into a file like custom_sorbs.cf and that will do
it or will the built in rule take precedence?
>

Re: New type of spam... (very curious)

Posted by Kasper Sacharias Eenberg <ks...@hovmark.dk>.

On Thu, 2009-07-02 at 05:32 +0100, richard@buzzhost.co.uk wrote:
> On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
> > On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
> > >
> > > But for the paranoid will changing 50_scores.cf from;
> > >
> > > score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> > > score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> > > score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> > > score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> > > score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> > > score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> > > score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> > > score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
> > >
> > > TO
> > >
> > > score RCVD_IN_SORBS_BLOCK 0
> > > score RCVD_IN_SORBS_DUL 0
> > > score RCVD_IN_SORBS_HTTP 0
> > > score RCVD_IN_SORBS_MISC 0
> > > score RCVD_IN_SORBS_SMTP 0
> > > score RCVD_IN_SORBS_SOCKS 0
> > > score RCVD_IN_SORBS_WEB 0
> > > score RCVD_IN_SORBS_ZOMBIE 0
> > >
> > > Stop the 'cost' of the lookup?
> > 
> > DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
> > positive you want to.
> Why?
> 
> Will it result in a nuclear war?
> 
And blood will flow from the elevators!

It might get overwritten if updated. The safe bet is to put it in
local.cf. (Any .cf in /etc/mail/spamassassin will work afaik).

Besides from a logical point of view it makes sense for me to have all
my rules in one file/dir, and leave the standard files alone so i can
blame other people when things go wrong :)

You know the saying "Code like the person who's gonna be maintaining the
code is a homicidal maniac"?
It's the same for sysadmining.

With regards,
Kasper

Re: New type of spam... (very curious)

Posted by "richard@buzzhost.co.uk" <ri...@buzzhost.co.uk>.

On Wed, 2009-07-01 at 16:13 -0600, LuKreme wrote:
> On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
> >
> > But for the paranoid will changing 50_scores.cf from;
> >
> > score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> > score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> > score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> > score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> > score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> > score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> > score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> > score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
> >
> > TO
> >
> > score RCVD_IN_SORBS_BLOCK 0
> > score RCVD_IN_SORBS_DUL 0
> > score RCVD_IN_SORBS_HTTP 0
> > score RCVD_IN_SORBS_MISC 0
> > score RCVD_IN_SORBS_SMTP 0
> > score RCVD_IN_SORBS_SOCKS 0
> > score RCVD_IN_SORBS_WEB 0
> > score RCVD_IN_SORBS_ZOMBIE 0
> >
> > Stop the 'cost' of the lookup?
> 
> DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
> positive you want to.
Why?

Will it result in a nuclear war?

Re: New type of spam... (very curious)

Posted by LuKreme <kr...@kreme.com>.

On 1-Jul-2009, at 06:47, richard@buzzhost.co.uk wrote:
>
> But for the paranoid will changing 50_scores.cf from;
>
> score RCVD_IN_SORBS_BLOCK 0 # n=1 n=2 n=3
> score RCVD_IN_SORBS_DUL 0 1.615 0 0.877 # n=0 n=2
> score RCVD_IN_SORBS_HTTP 0 0.001 0 0.001 # n=0 n=2
> score RCVD_IN_SORBS_MISC 0 0.001 0 0.353 # n=0 n=2
> score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3
> score RCVD_IN_SORBS_SOCKS 0 0.182 0 0.801 # n=0 n=2
> score RCVD_IN_SORBS_WEB 0 1.117 0 0.619 # n=0 n=2
> score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3
>
> TO
>
> score RCVD_IN_SORBS_BLOCK 0
> score RCVD_IN_SORBS_DUL 0
> score RCVD_IN_SORBS_HTTP 0
> score RCVD_IN_SORBS_MISC 0
> score RCVD_IN_SORBS_SMTP 0
> score RCVD_IN_SORBS_SOCKS 0
> score RCVD_IN_SORBS_WEB 0
> score RCVD_IN_SORBS_ZOMBIE 0
>
> Stop the 'cost' of the lookup?

DO NOT EDIT 5-_Scores.cf. Don't do it. No, not even if you're 100%  
positive you want to.

If you want to change the scores, put them in local.cf, where all  
other config changes go. Or, put them in some other .cf file in the  
same folder as local.cf.  Maybe sorbs0.cf would be a good name.

DO NOT edit the default files of SA. Ever.

-- 
The early bird gets the worm, but the second mouse gets the cheese.