You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Thomas Cameron <th...@camerontech.com> on 2004/12/04 03:04:36 UTC
Can someone better explain ALL_TRUSTED to me?
Since upgrading to 3.0.1 I have actually gotten a few more spams than
with 3.0.0. SA is still catching well over 99% so I am certainly not
complaining - I've gone from no spams in my inbox to about three a week.
The thing I've noticed on all of the ones which get through is that
ALL_TRUSTED is one of the tests listed. I am not sure what that means.
The only explanation I've found is that it means that the message never
passed through an untrusted host. What is an "untrusted host?" I am
not sure why it fired on the e-mail below... I certainly wouldn't
consider the sending server a trusted host, so I would think that it
should be considered untrusted. I am afraid I am unclear on the
concept.
Can someone take pity and explain? :-)
Thomas
Spam message follows:
Return-Path: <in...@aplustransporters.com>
Received: from tweed.32s (e82-103-142-226s.easyspeedy.com
[82.103.142.226]
(may be forged)) by mail.camerontech.com (8.13.1/8.13.1) with
ESMTP id
iB40beHT010334 for <th...@camerontech.com>; Fri, 3 Dec
2004
18:37:45 -0600
From: "aplustransporters.com" <in...@aplustransporters.com>
To: thomas.cameron@camerontech.com
Subject: This Auto Transport Company Might Interest You
MIME-Version: 1.0
Precedence: bulk
Errors-To: null@tweed.32s
Content-type: text/html
Message-Id: <20...@tweed.32s>
Date: Fri, 3 Dec 2004 08:40:52 -0500 (EST)
X-Virus-Scanned: ClamAV 0.80/614/Wed Dec 1 09:44:43 2004 clamav-milter
version 0.80j on mail.camerontech.com
X-Virus-Status: Clean
X-Spam-Status: No, score=4.7 required=5.0 tests=ALL_TRUSTED,
DNS_FROM_AHBL_RHSBL,EXCUSE_3,HTML_40_50,HTML_FONT_BIG,
HTML_IMAGE_ONLY_24,HTML_MESSAGE,HTML_TAG_EXIST_TBODY,INFO_TLD,
MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,URIBL_OB_SURBL,
URIBL_WS_SURBL autolearn=no version=3.0.1
X-Spam-Level: ****
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on
mail.camerontech.com
X-Greylist: Delayed for 02:40:21 by milter-greylist-1.6rc1
(mail.camerontech.com [24.173.79.19]); Fri, 03 Dec 2004 18:37:48
-0600 (CST)
X-Evolution-Source: imap://thomas.cameron@mail.camerontech.com/
<HTML><BODY bgColor=#ffffff><TABLE width=100%><TR><TD
bgColor=#800080><center><B><a href="http://www.aplustransporters.com"
style="text-decoration: none"><font color=#FF0000 size=4
face="Arial">The
Car Shipping Experts</font></a></B></TD></TR></TABLE><TABLE
borderColor=#b5107b cellSpacing=0 cellPadding=5 width=100%
bgColor=#ffffff
border=1><TBODY><TR><TD><TABLE><TBODY><TR><TD vAlign=top>
<center><b>D<FONT face=Arial>o you need, or know of
someone who needs a Car Transported to another state?</b><BR><a
href="http://www.aplustransporters.com"><img border=0
src="http://www.aplustransporters.com/images/image1.jpg"
width=257 height=110></a><p><FONT size=4>Online State-of-the-art
computer tracking system<br>Office: Mon-Fri 10am to 7pm
"Eastern'</font><br><b><font size=5 color=#FF0000>Phone:
(866) 498-3535</FONT><br><font size=2>Visit our site for an <U><a
href="http://www.aplustransporters.com">Instant online
quote</a></U></B></font><FONT size=4> <font
color=#FF0000>24-7</font><br><FONT color=#0000FF><b>America's leading
Transport Company.<br>'Come experience our award winning customer
service for yourself'</b></FONT></font></center><P><FONT
face=Arial><B><FONT size=2> We take great pride in our car
shipping
service. We arrange transports for relocation individuals,
college students, dealerships and our specialty: SNOWBIRDS !
We can move your car coast to coast and most points in
between.<P> We understand that having
someone move your auto is no small matter - your car is not
only an expensive possession, it's also part of your family.
Our 5 Star Carriers take great care to ensure that your car is
protected from start to finish. And unlike other carriers,
once your car is on our truck, it doesn't get off until it
reaches its destination - there's no loading and reloading at
big consolidation centers. Minimized handling means a minimum
risk of problems. The most trusted in the
business.</B></FONT></FONT></P></TD></TR></TBODY></TABLE><a
href="http://be8zuz5wyg.j.zzinc.info/?3911"><hr size=1 width=90%
color=#800080></a></TD></TR></TBODY></TABLE><CENTER><p><FONT
face="tahoma, arial" size=2>To be removed from any future mailings,
please <a href="mailto:info@aplustransporters.com">Click
Here</a><br>Or send all inquiries to:<br>3936 S. Semoran Blvd
#114. Orlando, FL 32822</FONT></CENTER></BODY></HTML>
RE: Can someone better explain ALL_TRUSTED to me?
Posted by Matt Kettler <mk...@comcast.net>.
At 05:55 AM 12/6/2004 -0500, Dan Barker wrote:
>I don't like this assumption that /16 means "is you or at worst involves
>your ISP".
Yes, I agree there. In the modern era of ISPs getting tiny little blocks of
IPs from ARIN, a /16 is a lot of real estate and many ISPs would die for
the opportunity to get that much contiguous space... It seems rather
antique and foolish to think your ISP has blocks this large. Perhaps in
1998 this was commonplace, but now... not so.
However, the whole issue is still sidestepped by manually setting
trusted_networks.
Re: Can someone better explain ALL_TRUSTED to me?
Posted by Loren Wilton <lw...@earthlink.net>.
> My ISP provides me two subnets, 63.171.93.0/27 and 205.245.192/192. Even
> these don't match at the sixteen bit level. My Cisco's serial interface is
> 144.223.62.58. These three address don't match for ANY bits!
>
> My firewall nats IMail (172.27.0.5) to 63.171.93.5. Looking at received
> headers from a Spam with a 192.168.0.0/16 user, we see:
>
> Received: from EP.newsmail.com [211.74.70.84] by visioncomm.net
> (SMTPD32-8.14) id AF4F4B8004E; Sat, 13 Nov 2004 23:30:07 -0500
[211.74.70.84] Not received from your network, not trusted.
> Received: (qmail 21480 invoked from network); 13 Nov 2004 22:41:39 -0000
> Received: from unknown (HELO localhost.localdomain) (192.168.1.144)
> by 192.168.1.112 with SMTP; 13 Nov 2004 22:41:39 -0000
> Date: Sun, 14 Nov 2004 12:30:06 +0800
> Return-Path: sellimy@hotmail.com
> To: =?Big5?B?uXGkbLP4pqyl86rM?= <db...@visioncomm.com>
> From: =?Big5?B?xdbEUrRBwcqqq7r0?= <se...@hotmail.com>
> Reply-to: =?Big5?B?xdbEUrRBwcqqq7r0?= <se...@hotmail.com>
> Subject: =?Big5?B?qMm9R7bcoUi7tMNQtlK79KRAqK2wt7Fkr7eywKFJoXY=?=
> Message-ID: <3e...@localhost.localdomain>
> X-Priority: 3
> X-Mailer: !?SuperSEND.Mailer
> MIME-Version: 1.0
> Content-Transfer-Encoding: 8bit
> Content-Type: text/html; charset="Big5"
> X-Envelope-From:<se...@hotmail.com>
>
> Here's another spam, from an address matching my trusted network, that did
> NOT trigger the ALL_TRUSTED test:
>
> Received: from pabis.net.pl [213.159.110.58] by visioncomm.net
> (SMTPD32-8.14) id AAA317970074; Mon, 15 Nov 2004 01:20:19 -0500
[213.159.110.58] Not from your network, not trusted.
> Received: from pabis.net.pl [172.16.1.58] by 7e1h6.pabis.net.pl with SMTP;
> Mon, 15 Nov 2004 01:14:37 -0500
> Return-Path: sherri@cuestajardins.com.br
> Content-Type: text/html;
> charset=us-ascii
> Content-Transfer-Encoding: 7bit
> X-Mailer: Mozilla 4.7 [en] (Win95; I)
> Message-Id: <0u...@pabis.net.pl>
> From: vallentine@sebraees.com.br
> Subject: claim your 500 dollar eBay store credit
> Date: Mon, 15 Nov 2004 01:14:37 -0500
> CC: webmaster@visioncomm.com,
> info@visioncomm.com
> X-Envelope-From:<va...@sebraees.com.br>
>
> Looking at headers from a valid email with a 192.168.0.0/16 user, we see:
>
> >From <gf...@adranch.com> Tue Jun 19 10:51:20 2001
> Received: from sm10.texas.rr.com [24.93.35.222] by visioncomm.net with
ESMTP
> (SMTPD32-6.05) id A6E8BD014E; Tue, 19 Jun 2001 10:51:20 -0400
[24.93.35.222] Not from your network, not trusted
> Received: from [192.168.1.125] (cs2762-197.austin.rr.com [24.27.62.197])
> by sm10.texas.rr.com (8.12.0.Beta5/8.12.0.Beta5) with ESMTP id
> f5JEoYu3028287
> for <we...@smgrecords.com>; Tue, 19 Jun 2001 09:50:34 -0500
> User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022
> Date: Tue, 19 Jun 2001 09:51:26 -0500
> Subject: Shawn Mullins
> From: Gabrielle Faust <gf...@adranch.com>
> To: <we...@smgrecords.com>
> Message-ID: <B7...@adranch.com>
> Mime-version: 1.0
> Content-type: text/plain; charset="US-ASCII"
> Content-transfer-encoding: 7bit
> X-RCPT-TO: <we...@smgrecords.com>
>
> My local.cf says (in part):
> trusted_networks 172.0.0.0/8 <<< this should have been 172.24.0.0/13 - I
> just now changed it.
>
> hth
>
> Dan Barker
>
> <snip>
> The goal is to remove any relay steps that involve your network, relying
on
> /16 is good enough since anything on your /16 is you or at worst involves
> your ISP.)
> </snip>
RE: Can someone better explain ALL_TRUSTED to me?
Posted by Dan Barker <db...@visioncomm.net>.
I don't like this assumption that /16 means "is you or at worst involves
your ISP".
My ISP provides me two subnets, 63.171.93.0/27 and 205.245.192/192. Even
these don't match at the sixteen bit level. My Cisco's serial interface is
144.223.62.58. These three address don't match for ANY bits!
My firewall nats IMail (172.27.0.5) to 63.171.93.5. Looking at received
headers from a Spam with a 192.168.0.0/16 user, we see:
Received: from EP.newsmail.com [211.74.70.84] by visioncomm.net
(SMTPD32-8.14) id AF4F4B8004E; Sat, 13 Nov 2004 23:30:07 -0500
Received: (qmail 21480 invoked from network); 13 Nov 2004 22:41:39 -0000
Received: from unknown (HELO localhost.localdomain) (192.168.1.144)
by 192.168.1.112 with SMTP; 13 Nov 2004 22:41:39 -0000
Date: Sun, 14 Nov 2004 12:30:06 +0800
Return-Path: sellimy@hotmail.com
To: =?Big5?B?uXGkbLP4pqyl86rM?= <db...@visioncomm.com>
From: =?Big5?B?xdbEUrRBwcqqq7r0?= <se...@hotmail.com>
Reply-to: =?Big5?B?xdbEUrRBwcqqq7r0?= <se...@hotmail.com>
Subject: =?Big5?B?qMm9R7bcoUi7tMNQtlK79KRAqK2wt7Fkr7eywKFJoXY=?=
Message-ID: <3e...@localhost.localdomain>
X-Priority: 3
X-Mailer: !?SuperSEND.Mailer
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset="Big5"
X-Envelope-From:<se...@hotmail.com>
Here's another spam, from an address matching my trusted network, that did
NOT trigger the ALL_TRUSTED test:
Received: from pabis.net.pl [213.159.110.58] by visioncomm.net
(SMTPD32-8.14) id AAA317970074; Mon, 15 Nov 2004 01:20:19 -0500
Received: from pabis.net.pl [172.16.1.58] by 7e1h6.pabis.net.pl with SMTP;
Mon, 15 Nov 2004 01:14:37 -0500
Return-Path: sherri@cuestajardins.com.br
Content-Type: text/html;
charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: Mozilla 4.7 [en] (Win95; I)
Message-Id: <0u...@pabis.net.pl>
From: vallentine@sebraees.com.br
Subject: claim your 500 dollar eBay store credit
Date: Mon, 15 Nov 2004 01:14:37 -0500
CC: webmaster@visioncomm.com,
info@visioncomm.com
X-Envelope-From:<va...@sebraees.com.br>
Looking at headers from a valid email with a 192.168.0.0/16 user, we see:
>>From <gf...@adranch.com> Tue Jun 19 10:51:20 2001
Received: from sm10.texas.rr.com [24.93.35.222] by visioncomm.net with ESMTP
(SMTPD32-6.05) id A6E8BD014E; Tue, 19 Jun 2001 10:51:20 -0400
Received: from [192.168.1.125] (cs2762-197.austin.rr.com [24.27.62.197])
by sm10.texas.rr.com (8.12.0.Beta5/8.12.0.Beta5) with ESMTP id
f5JEoYu3028287
for <we...@smgrecords.com>; Tue, 19 Jun 2001 09:50:34 -0500
User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022
Date: Tue, 19 Jun 2001 09:51:26 -0500
Subject: Shawn Mullins
From: Gabrielle Faust <gf...@adranch.com>
To: <we...@smgrecords.com>
Message-ID: <B7...@adranch.com>
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
X-RCPT-TO: <we...@smgrecords.com>
My local.cf says (in part):
trusted_networks 172.0.0.0/8 <<< this should have been 172.24.0.0/13 - I
just now changed it.
hth
Dan Barker
<snip>
The goal is to remove any relay steps that involve your network, relying on
/16 is good enough since anything on your /16 is you or at worst involves
your ISP.)
</snip>
Re: Can someone better explain ALL_TRUSTED to me?
Posted by Matt Kettler <mk...@comcast.net>.
At 01:02 PM 12/5/2004 -0500, Theodore Heise wrote:
>I'm running 3.0.0 spamassassin (not spamd) on Slack 9.1, and have
>not manually configured trusted_networks. I assume I can do this in
>either /etc/mail/spamassassin/somename.cf (for site-wide use) or in
>~/.spamassassin/user_prefs (for individual users). Please correct
>me if I'm on the wrong track!
Yes. That's correct.
>The thing I can't figure out is what the defaults are.
The default is "auto detect".
The algorithm is described in Received.pm
Also, note that there's a minor discrepancy to be aware of. ALL_TRUSTED is
actually implemented as "NO_UNTRUSTED"... There's a bug open about that...
Here's the auto-detect algorithm. Works well in most cases, but has issues
in a few odd situations. It's generally best to manually configure and not
let SA try to make educated guesses:
# OK, infer the trusted/untrusted handover, if we don't have real info.
# Here's the algorithm used (taken from Dan's mail):
#
# Talking with Scott Banister (this was his idea) and Andrew Flury at
# IronPort, we came up with an alternate and easier algorithm that doesn't
# involve trees and we think should be good enough most of the time
# whenever trusted IP headers is not set. It also has the nice property
# of being very easy to implement, but it should, of course, be tested
# out.
#
# "first" = top Received line in the message
#
# "public" = not a local or private IP address
#
# "mypublicnet" = first public "by" address
#
# 1. Ignore all Received line where the "from" IP is in mypublicnet/16
# regardless of where they appear. (The goal is to remove any relay
# steps that involve your network, relying on /16 is good enough since
# anything on your /16 is you or at worst involves your ISP.)
#
# 2. Ignore all Received lines that contain local (127) or private (10.1,
# etc.) IP addresses anywhere, whether "from" or "by". (The goal
#
# 3. The first Received line that you don't ignore is the one that
# contains the "by" of your trusted relay and the "from" of the first
# untrusted relay (which is used for bondedsender testing and so on).
Re: Can someone better explain ALL_TRUSTED to me?
Posted by Theodore Heise <th...@heise.nu>.
On Sat, 4 Dec 2004, Matt Kettler wrote:
> At 08:04 PM 12/3/2004 -0600, Thomas Cameron wrote:
> >
> >The thing I've noticed on all of the ones which get through is that
> >ALL_TRUSTED is one of the tests listed.
>
> If your mailserver is NATed (or otherwise uses a reserved IP), you MUST
> define trusted_networks manually. This issue has been present since SA
> 2.60, but the introduction of the ALL_TRUSTED rule makes the symptoms of
> having a broken trust path very painful.
I'm running 3.0.0 spamassassin (not spamd) on Slack 9.1, and have
not manually configured trusted_networks. I assume I can do this in
either /etc/mail/spamassassin/somename.cf (for site-wide use) or in
~/.spamassassin/user_prefs (for individual users). Please correct
me if I'm on the wrong track!
The thing I can't figure out is what the defaults are. I've had
ALL_TRUSTED fire on a few e-mails, despite never having configured
it, and have been unable to find out what the default setting for
trusted_networks is. I've searched the web and my installation, and
come up empty. Is this hard coded into the application, and not
included in a config file anywhere?
Thanks for any help!
--
Theodore (Ted) Heise <th...@heise.nu> Bloomington, IN, USA
SOLVED Re: Can someone better explain ALL_TRUSTED to me?
Posted by Thomas Cameron <th...@camerontech.com>.
OK, after more R'ing TFM and some kind advice from a list member, I
think I understand now what has been happening.
>>From the Mail::SpamAssassin::Conf man page:
* if the ’from’ IP address is on the same /16 network as the top
Received line’s ’by’ host, it’s trusted
* if the address of the ’from’ host is in a reserved network range,
then it’s trusted
* if any addresses of the ’by’ host is in a reserved network
range, then it’s trusted
So the solution is to add these two lines to local.cf:
clear_trusted_networks
trusted_networks 127/8 24.173.79.19/32
IIUC this sets any traffic which originates from my server as trusted,
but all other traffic is not.
Thanks,
Thomas
Re: Can someone better explain ALL_TRUSTED to me?
Posted by Thomas Cameron <th...@camerontech.com>.
On Sat, 2004-12-04 at 03:20 -0500, Matt Kettler wrote:
> At 08:04 PM 12/3/2004 -0600, Thomas Cameron wrote:
> >Since upgrading to 3.0.1 I have actually gotten a few more spams than
> >with 3.0.0. SA is still catching well over 99% so I am certainly not
> >complaining - I've gone from no spams in my inbox to about three a week.
> >
> >The thing I've noticed on all of the ones which get through is that
> >ALL_TRUSTED is one of the tests listed.
>
> If your mailserver is NATed (or otherwise uses a reserved IP), you MUST
> define trusted_networks manually. This issue has been present since SA
> 2.60, but the introduction of the ALL_TRUSTED rule makes the symptoms of
> having a broken trust path very painful.
My mailserver is not NATted - it has a public IP address.
> Basicaly, ALL_TRUSTED should only fire if an email has only been
> transferred by hosts matching trusted_networks.
I do not have trusted_networks defined anywhere:
[root@mail ~]# cd /etc/mail/spamassassin/
[root@mail spamassassin]# grep -i trust *
[root@mail spamassassin]# cat local.cf
# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)
# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.
required_score 5
report_safe 1
rewrite_header subject **SPAM** _SCORE_
ok_languages en
ok_locales en
use_dcc 1
use_pyzor 1
use_razor2 1
> dig in the archvies.. this is a very well know, understood, and not an
> issue which can be fixed to make the automatic method work better for
> everyone.
Um, I have scoured the spamassassin.apache.org site and it is *not* well
described. You might understand it but I certainly don't.
> It's one of those problems where you can shift around what kinds
> of networks have the problem (NATed or not), and you can shift around what
> form the problem takes (FPs vs FNs), but there's no general-case algorithm
> that works well everywhere.
I am trying to understand why it is firing on my server. I do not have
anything listed as a trusted network.
Thomas
Re: Can someone better explain ALL_TRUSTED to me?
Posted by Matt Kettler <mk...@comcast.net>.
At 08:04 PM 12/3/2004 -0600, Thomas Cameron wrote:
>Since upgrading to 3.0.1 I have actually gotten a few more spams than
>with 3.0.0. SA is still catching well over 99% so I am certainly not
>complaining - I've gone from no spams in my inbox to about three a week.
>
>The thing I've noticed on all of the ones which get through is that
>ALL_TRUSTED is one of the tests listed.
If your mailserver is NATed (or otherwise uses a reserved IP), you MUST
define trusted_networks manually. This issue has been present since SA
2.60, but the introduction of the ALL_TRUSTED rule makes the symptoms of
having a broken trust path very painful.
Basicaly, ALL_TRUSTED should only fire if an email has only been
transferred by hosts matching trusted_networks.
dig in the archvies.. this is a very well know, understood, and not an
issue which can be fixed to make the automatic method work better for
everyone. It's one of those problems where you can shift around what kinds
of networks have the problem (NATed or not), and you can shift around what
form the problem takes (FPs vs FNs), but there's no general-case algorithm
that works well everywhere.