You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ryan Moore <ry...@perigee.net> on 2005/10/21 22:22:38 UTC
Re: Bogus X-Authentication-Warning:
This thread is ancient I know, but I am still using the rule posted below but
had to make an update to it (in case anyone else also uses this rule).
I changed __X_AUTH_WARN_3 to read:
header __X_AUTH_WARN_3 X-Authentication-Warning !~ /(?:using -f|owned
process doing -bs)/
to accomodate for the following valid header:
X-Authentication-Warning: some.host.com: username owned process doing -bs
Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
> ----- Original Message -----
> From: Mike Hogsett <ho...@csl.sri.com>
> To: Mike Hogsett <ho...@csl.sri.com>
> CC: spamassassin-users@incubator.apache.org
> Sent: 05/26/2004 2:15:58 PM -0400
> Subject: Bogus X-Authentication-Warning:
>
> [ First, let me apologize for consuming a few more than my share of
> electrons on this... ]
>
> I think I've improved the fake X-Authentication-Warning header check.
>
> I incorporated a few other rules that were mentioned into the following.
> I am not a regex guru so this will likely be able to be improved or made
> more efficient.
>
> header __X_AUTH_WARN_0 exists:X-Authentication-Warning
> header __X_AUTH_WARN_1 X-Authentication-Warning =~ /^(?:[a-z]{4,20}[\-\.\,]? ){2,8}/ # no /i, trailing space
> header __X_AUTH_WARN_2 X-Authentication-Warning =~ /\b[A-Z]{2,5}[a-z]{5,7}[0-9]{2}\b/
> header __X_AUTH_WARN_3 X-Authentication-Warning !~ /using -f/
> meta CSL_X_AUTH_WARN (__X_AUTH_WARN_0 && (__X_AUTH_WARN_1 || __X_AUTH_WARN_2 || __X_AUTH_WARN_3))
> describe CSL_X_AUTH_WARN Fake X-Authentication-Warning header
> score CSL_X_AUTH_WARN 4.5
>
Re: Bogus X-Authentication-Warning:
Posted by Ryan Moore <ry...@perigee.net>.
> ----- Original Message -----
> From: Robert Menschel <Ro...@Menschel.net>
> To: Ryan Moore <ry...@perigee.net>
> CC: Spamassassin-Users <us...@spamassassin.apache.org>
> Sent: 10/23/2005 4:38:13 PM -0400
> Subject: Bogus X-Authentication-Warning:
>
> SA 3.1.0 uses:
> 20_head_tests.cf:header X_AUTH_WARN_FAKED X-Authentication-Warning !~
> /(?:set sender to \S{2,80} using -f|owned process doing -bs|claimed to be|
> didn.t use HELO protocol)/ [if-unset: host.example.com: foo owned process doing -bs]
>
> Bob Menschel
>
Ah, not sure how I missed that when checking my dist rules in
usr/share/spamassin. Thanks for the notice, I'll remove that custom rule now.
--
Ryan Moore
----------
Perigee.net Corporation
704-849-8355 (sales)
704-849-8017 (tech)
www.perigee.net
Re[2]: Bogus X-Authentication-Warning:
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Ryan,
Friday, October 21, 2005, 1:22:38 PM, you wrote:
RM> This thread is ancient I know, but I am still using the rule posted below but
RM> had to make an update to it (in case anyone else also uses this rule).
RM> I changed __X_AUTH_WARN_3 to read:
RM> header __X_AUTH_WARN_3 X-Authentication-Warning !~ /(?:using -f|owned
RM> process doing -bs)/
RM> to accomodate for the following valid header:
RM> X-Authentication-Warning: some.host.com: username owned process doing -bs
SA 3.1.0 uses:
20_head_tests.cf:header X_AUTH_WARN_FAKED X-Authentication-Warning !~
/(?:set sender to \S{2,80} using -f|owned process doing -bs|claimed to be|
didn.t use HELO protocol)/ [if-unset: host.example.com: foo owned process doing -bs]
Bob Menschel