You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Chris <cp...@embarqmail.com> on 2014/07/27 20:08:07 UTC
BOTNET hits on ham
I keep getting BOTNET scores on Fox News Breaking News alerts from
FoxNews.com <fo...@newsletters.foxnews.com>
in /etc/mail/spamassassin/my-whitelis.cf I have this line -
whitelist_from_rcvd foxnews@newsletters.foxnews.com
newsletters.foxnews.com I've added this line to the BOTNET.cf file in
the same directory - botnet_pass_domains newsletters.foxnews
\.com or should that just be foxnews\.com I've also ran spamassassin
--add-addr-to-whitelist=foxnews@newsletters.foxnews.com none of these
seem to be working. I've restarted SA after each change to the .cf
files. What am I missing?
Chris
--
Chris
31.11°N 97.89°W (Elev. 1092 ft)
12:59:51 up 6 days, 19:13, 2 users, load average: 0.46, 0.28, 0.20
Ubuntu 14.04 LTS, kernel 3.13.0-32-generic
Re: BOTNET hits on ham
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
Congrats on these complete and comprehensible sentences. Must have taken
longer to write this reply, than throwing together your original
question.
On Sun, 2014-07-27 at 17:30 -0500, Chris wrote:
> I pasted the message headers, if you had wanted the SA headers also I
> would have provided them but you just said 'full headers' which I took
> to be the actual message headers.
>
> > Dude, if you want help, if you want others to spend their time on your
> > problems, you really should spend at least a few minutes to properly
> > outline your problem and write a coherent, detailed summary. Including
> > proper grammar, full sentences, and some formatting.
> Dude, I'm not going to get into a pissing contest with anyone here,
> disregard this issue anyway, I seem to have gotten it fixed.
Just in case it turns out it hasn't been fixed, see my answer (which you
snipped) for detailed explanation, pinpointing bad options and showing
and explaining correct options.
> And I don't know where you get off saying I'm unfriendly and
> disrespectful.
Maybe someone else can help you with this. I sure won't.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: BOTNET hits on ham
Posted by Chris <cp...@embarqmail.com>.
On Mon, 2014-07-28 at 00:21 +0200, Karsten Bräckelmann wrote:
> On Sun, 2014-07-27 at 16:06 -0500, Chris wrote:
> > On Sun, 2014-07-27 at 22:21 +0200, Karsten Bräckelmann wrote:
>
> > > Please do use line-breaks where appropriate.
> > >
> > > Also, we'll need the sample, at least the full headers. Put them up a
> > > pastebin and provide the link.
> >
> > Link to the headers - http://pastebin.com/evcz7HBe and a somewhat
> > straightened out above post:
>
> Wow. About the absolute minimum of what I requested. And you even
> removed text.
I pasted the message headers, if you had wanted the SA headers also I
would have provided them but you just said 'full headers' which I took
to be the actual message headers.
> Dude, if you want help, if you want others to spend their time on your
> problems, you really should spend at least a few minutes to properly
> outline your problem and write a coherent, detailed summary. Including
> proper grammar, full sentences, and some formatting.
>
> You are being very unfriendly and disrespectful.
Dude, I'm not going to get into a pissing contest with anyone here, disregard this
issue anyway, I seem to have gotten it fixed. And I don't know where you
get off saying I'm unfriendly and disrespectful.
--
Chris
31.11°N 97.89°W (Elev. 1092 ft)
17:26:01 up 1:46, 1 user, load average: 0.14, 0.21, 0.23
Ubuntu 14.04 LTS, kernel 3.13.0-32-generic
Re: BOTNET hits on ham
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2014-07-27 at 16:06 -0500, Chris wrote:
> On Sun, 2014-07-27 at 22:21 +0200, Karsten Bräckelmann wrote:
> > Please do use line-breaks where appropriate.
> >
> > Also, we'll need the sample, at least the full headers. Put them up a
> > pastebin and provide the link.
>
> Link to the headers - http://pastebin.com/evcz7HBe and a somewhat
> straightened out above post:
Wow. About the absolute minimum of what I requested. And you even
removed text.
Dude, if you want help, if you want others to spend their time on your
problems, you really should spend at least a few minutes to properly
outline your problem and write a coherent, detailed summary. Including
proper grammar, full sentences, and some formatting.
You are being very unfriendly and disrespectful.
Well, since at least you provided the headers, on to your issue anyway.
There are no SA headers in the paste. It is unclear, which relay
actually runs SA (two internal relays before, and one after fetchmail).
Moreover, the score and list of tests hit is missing.
> In my /etc/mail/spamassassin/my-whitelist.cf
> whitelist_from_rcvd foxnews@newsletters.foxnews.com newsletters.foxnews.com
The message is NOT received from newsletters.* but vmta.response.*
This whitelist flavor operates on the rDNS as provided by your MX. That
Received line looks a bit odd, though, and it appears there is no rDNS
mentioned but bare IPs and the sender's HELO. If that is true, even
correcting the second argument won't be sufficient.
Note that whitelist_from_rcvd requires your internal_networks to be
correct. (Whether the default is sufficient or you need to add the
internal relays, depends on which relay SA runs. See above.)
Since the message is SPF and DomainKey signed, you could better use
whitelist_auth anyway.
Also see the documentation, section Whitelist and Blacklist Options.
http://spamassassin.apache.org/doc/Mail_SpamAssassin_Conf.html
> BOTNET.cf file in
> botnet_pass_domains newsletters.foxnews\.com
> or should that just be foxnews\.com?
botnet_pass_domains operates on the rDNS. Just as above, you are
exempting the wrong sender SMTP.
Dropping the hostname and sticking to the domain only should also work,
based on some quick code glimpsing -- this option is only anchored at
the end.
> I've also ran
> spamassassin --add-addr-to-whitelist=foxnews@newsletters.foxnews.com
This works on the AWL. It is unrelated to the whitelist_* options.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: BOTNET hits on ham
Posted by Chris <cp...@embarqmail.com>.
On Sun, 2014-07-27 at 22:21 +0200, Karsten Bräckelmann wrote:
> On Sun, 2014-07-27 at 13:08 -0500, Chris wrote:
> > I keep getting BOTNET scores on Fox News Breaking News alerts from
> > FoxNews.com <fo...@newsletters.foxnews.com>
> > in /etc/mail/spamassassin/my-whitelis.cf I have this line -
> > whitelist_from_rcvd foxnews@newsletters.foxnews.com
> > newsletters.foxnews.com I've added this line to the BOTNET.cf file in
> > the same directory - botnet_pass_domains newsletters.foxnews
> > \.com or should that just be foxnews\.com I've also ran spamassassin
> > --add-addr-to-whitelist=foxnews@newsletters.foxnews.com none of these
> > seem to be working. I've restarted SA after each change to the .cf
> > files. What am I missing?
>
> Please do use line-breaks where appropriate.
>
> Also, we'll need the sample, at least the full headers. Put them up a
> pastebin and provide the link.
>
>
Link to the headers - http://pastebin.com/evcz7HBe and a somewhat
straightened out above post:
In my /etc/mail/spamassassin/my-whitelist.cf
whitelist_from_rcvd foxnews@newsletters.foxnews.com
newsletters.foxnews.com
BOTNET.cf file in
botnet_pass_domains newsletters.foxnews\.com
or should that just be foxnews\.com?
I've also ran
spamassassin --add-addr-to-whitelist=foxnews@newsletters.foxnews.com
--
Chris
31.11°N 97.89°W (Elev. 1092 ft)
16:03:38 up 24 min, 1 user, load average: 0.09, 0.27, 0.55
Ubuntu 14.04 LTS, kernel 3.13.0-32-generic
Re: BOTNET hits on ham
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Sun, 2014-07-27 at 13:08 -0500, Chris wrote:
> I keep getting BOTNET scores on Fox News Breaking News alerts from
> FoxNews.com <fo...@newsletters.foxnews.com>
> in /etc/mail/spamassassin/my-whitelis.cf I have this line -
> whitelist_from_rcvd foxnews@newsletters.foxnews.com
> newsletters.foxnews.com I've added this line to the BOTNET.cf file in
> the same directory - botnet_pass_domains newsletters.foxnews
> \.com or should that just be foxnews\.com I've also ran spamassassin
> --add-addr-to-whitelist=foxnews@newsletters.foxnews.com none of these
> seem to be working. I've restarted SA after each change to the .cf
> files. What am I missing?
Please do use line-breaks where appropriate.
Also, we'll need the sample, at least the full headers. Put them up a
pastebin and provide the link.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}