You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Andreas Schulze <sc...@andreasschulze.de> on 2011/02/17 15:23:05 UTC
using spamhaus droplist with sa ?
Hello,
http://www.spamhaus.org/faq/answers.lasso?section=DROP FAQ
mention as very last point to use the Spamhaus Drop list with SA.
is anybody doing this and can explain it in detail ?
Thanks
Andreas
Re: using spamhaus droplist with sa ?
Posted by Bowie Bailey <Bo...@BUC.com>.
On 2/18/2011 9:30 AM, Ken A wrote:
>
>
> On 2/17/2011 6:52 PM, Warren Togami Jr. wrote:
>> On 2/17/2011 5:40 AM, RW wrote:
>>>
>>> The suggestion is that it be scored higher for that reason.
>>
>> Or just outright block all MTA connections from anything listed in
>> zen.spamhaus.org, which seems to be safe. Large sites I know have been
>> doing that for years without any complaints.
>
> But, Zen contains some infected hosts, not just known spam orgs. That
> would make it a bit hard for a small sender with an infection problem
> to discover the problem, right? Not very polite to block them at the
> firewall, imo. Maybe we need a new type of ICMP response for infected
> hosts?
Block them at the MTA, not the firewall. This way they get a rejection
message telling them that they are listed on Zen.
--
Bowie
Re: using spamhaus droplist with sa ?
Posted by Ken A <ka...@pacific.net>.
On 2/17/2011 6:52 PM, Warren Togami Jr. wrote:
> On 2/17/2011 5:40 AM, RW wrote:
>>
>> The suggestion is that it be scored higher for that reason.
>
> Or just outright block all MTA connections from anything listed in
> zen.spamhaus.org, which seems to be safe. Large sites I know have been
> doing that for years without any complaints.
But, Zen contains some infected hosts, not just known spam orgs. That
would make it a bit hard for a small sender with an infection problem to
discover the problem, right? Not very polite to block them at the
firewall, imo. Maybe we need a new type of ICMP response for infected
hosts?
Ken
> Warren
>
--
Ken Anderson
Pacific Internet - http://www.pacific.net
Re: using spamhaus droplist with sa ?
Posted by "Warren Togami Jr." <wt...@gmail.com>.
On 2/17/2011 5:40 AM, RW wrote:
>
> The suggestion is that it be scored higher for that reason.
Or just outright block all MTA connections from anything listed in
zen.spamhaus.org, which seems to be safe. Large sites I know have been
doing that for years without any complaints.
Warren
Re: using spamhaus droplist with sa ?
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2011/02/22 3:55 PM, Adam Katz wrote:
> That's nontrivial since there is no DNSBL serving it. Setting one up
> requires regularly scraping that data.
Actually, the DROP-file format is directly compatible with rbldnsd.
However, DROP still wasn't meant to be used this way. Use it in BGP or
router ACL's instead.
--
/Jason
Re: using spamhaus droplist with sa ?
Posted by Adam Katz <an...@khopis.com>.
Andreas Schulze began:
>>>> http://www.spamhaus.org/faq/answers.lasso?section=DROP+FAQ
>>>> mention as very last point to use the Spamhaus Drop list with
>>>> SA.
Yet Another Ninja continued:
>>> "DROP is a tiny subset of the SBL designed for use by firewalls
>>> and routing equipment."
>>>
>>> Using it postqueue is pretty pointless as its basically a "safe"
>>> subset of SBL
RW added:
>> The suggestion is that it be scored higher for that reason.
>>>> is anybody doing this and can explain it in detail ?
Yet Another Ninja answered:
> if that is what you wish, you can setup a local rbldnsd zone and
> query that.
That's nontrivial since there is no DNSBL serving it. Setting one up
requires regularly scraping that data. The same would go if you were to
create a SpamAssassin rule from it.
As a proof-of-concept, I have done the latter and added it as
KHOP_SPAMHAUS_DROP and KHOP_SPAMHAUS_DROP_LE (which checks only the
last-external relay) to my data-scraping sa-update channel
khop-sc-neighbors for testing. It only runs in certain circumstances
and is scored very low as its still testing. The resulting rule
contains a 5817-char regexp (from 3632 IP addresses in 402 CIDRs from a
6311-char source), which is more than twice the size of KHOP_SC_TOP200,
the channel's previously longest entry; twice the space for twice the
entries (18x the IPs).
Like KHOP_SC_TOP200, I optimized for performance by scoring it zero
(skipping its evaluation) in the presence of DNSEval:
score KHOP_SPAMHAUS_DROP 0.5 0 0.5 0
if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) )
score KHOP_SPAMHAUS_DROP (0) (0.3) (0) (0.1)
endif
I've had this sitting in SVN for a few days now. It hits almost
nothing, but it is actually interesting; only 72% of the broader rule's
hits are mirrored in RCVD_IN_SBL. The _LE rule has 93% overlap with SBL
(I was expecting 99+%).
The biggest surprise was that both rules have almost their entire score
map matching corpus messages at or under 8 points.
Corpus T_KHOP_SPAMHAUS_DROP T_KHOP_SPAMHAUS_DROP_LE
DateRev #spam spam% ham% s/o rank SBL% spam% ham% s/o rank SBL%
20110221 576k .0323 .0030 .914 .54 72 .0217 0 1.000 .52 93
20110220 599k .0314 .0031 .911 .54 72 .0209 0 1.000 .53 93
20110219 176k .0996 .0041 .960 .55 72 .0660 0 1.000 .53 93
20110218 595k .0315 .0031 .910 .54 72 (not added yet)
PMCs: I'd love to see the timing.log output so as to better measure
these rules' merit. Actually, why isn't that data public on ruleqa? If
it's too time-consuming, restrict it to the weekly network runs.
Re: using spamhaus droplist with sa ?
Posted by Yet Another Ninja <ax...@gmail.com>.
On 2011-02-17 16:40, RW wrote:
> On Thu, 17 Feb 2011 15:29:07 +0100
> Yet Another Ninja<ax...@gmail.com> wrote:
>
>> On 2011-02-17 15:23, Andreas Schulze wrote:
>>> Hello,
>>>
>>> http://www.spamhaus.org/faq/answers.lasso?section=DROP FAQ
>>> mention as very last point to use the Spamhaus Drop list with SA.
>>>
>>> is anybody doing this and can explain it in detail ?
>>>
>>> Thanks
>>> Andreas
>>>
>>
>> "DROP is a tiny subset of the SBL designed for use by firewalls and
>> routing equipment."
>>
>> Using it postqueue is pretty pointless as its basically a "safe"
>> subset of SBL
>
> The suggestion is that it be scored higher for that reason.
if that is what you wish, you can setup a local rbldnsd zone and query that.
Re: using spamhaus droplist with sa ?
Posted by RW <rw...@googlemail.com>.
On Thu, 17 Feb 2011 15:29:07 +0100
Yet Another Ninja <ax...@gmail.com> wrote:
> On 2011-02-17 15:23, Andreas Schulze wrote:
> > Hello,
> >
> > http://www.spamhaus.org/faq/answers.lasso?section=DROP FAQ
> > mention as very last point to use the Spamhaus Drop list with SA.
> >
> > is anybody doing this and can explain it in detail ?
> >
> > Thanks
> > Andreas
> >
>
> "DROP is a tiny subset of the SBL designed for use by firewalls and
> routing equipment."
>
> Using it postqueue is pretty pointless as its basically a "safe"
> subset of SBL
The suggestion is that it be scored higher for that reason.
Re: using spamhaus droplist with sa ?
Posted by Yet Another Ninja <ax...@gmail.com>.
On 2011-02-17 15:23, Andreas Schulze wrote:
> Hello,
>
> http://www.spamhaus.org/faq/answers.lasso?section=DROP FAQ
> mention as very last point to use the Spamhaus Drop list with SA.
>
> is anybody doing this and can explain it in detail ?
>
> Thanks
> Andreas
>
"DROP is a tiny subset of the SBL designed for use by firewalls and
routing equipment."
Using it postqueue is pretty pointless as its basically a "safe" subset
of SBL
Re: using spamhaus droplist with sa ?
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2011/02/17 9:23 AM, Andreas Schulze wrote:
> Hello,
>
> http://www.spamhaus.org/faq/answers.lasso?section=DROP FAQ
> mention as very last point to use the Spamhaus Drop list with SA.
>
> is anybody doing this and can explain it in detail ?
>
I played around with this a number of years ago and found it fairly
useless in the context of blocking spam. The DROP list isn't meant to
be used in such a way because this address space isn't typically the
actual source of spam. Instead, the space is more likely used to
control botnets, run scans, DOS attacks and other day-to-day operations.
The DROP list is best used on routers running BGP in an effort to stop
everything prior to a spam run.
--
/Jason