Re: Joe-job blowback

[Karsten Bräckelmann <gu...@rudersport.de>]

On Mon, 2009-08-31 at 12:13 -0800, Kevin Miller wrote:
> I'm seeing a lot of blowback from Russian servers due to my domain
> users being joe-jobbed. [...]

VBounce plugin.

Use it to filter / deliver hits into a dedicated folder, rather than
attempting to raise the score into oblivion. See 20_vbounce.cf and its
docs.

Also see quite a lot of related posts in the past by me, how to handle
VBounce hits.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

RE: Joe-job blowback

[Kevin Miller <Ke...@ci.juneau.ak.us>]

Karsten Bräckelmann wrote:
> Please keep list-posts on the list.

Yeah, sorry about that.  Most lists I'm on I just have to hit reply.  Some I have to hit Reply-All.  This one seems to vary with each user.  I prefer to hit reply and have it go back to the list but not everybody does.  I'm sure those wars were fought here long ago.  I'll try to remember to check my To: field before sending.


> On Mon, 2009-08-31 at 16:23 -0800, Kevin Miller wrote:
>> Karsten Bräckelmann wrote:
>>> VBounce plugin.
>> 
>> Yup, got it enabled.  Pretty minimal scoring though.  Followed the
>> instructions at http://wiki.apache.org/spamassassin/VBounceRuleset
>> to set it up. 
>> 
>>> Use it to filter / deliver hits into a dedicated folder, rather than
>>> attempting to raise the score into oblivion. See 20_vbounce.cf and
>>> its docs.
> 
> Sic.  Use the hits for filtering. NOT scoring bounces high. They are
> not spam, and they are likely to bias your Bayes database, if you
> treat them as such.  
> 
> $ grep -A 2 procmail 20_vbounce.cf
> 
> # If you use this, set up procmail or your mail app to spot the #
> "ANY_BOUNCE_MESSAGE" rule hits in the X-Spam-Status line, and move #
> messages that match that to a 'vbounce' folder.  
> 
> 
>>> Also see quite a lot of related posts in the past by me, how to
>>> handle VBounce hits.
>> 
>> Thanks, I'll check the archives...
> 
> Pretty much the above. :)  Don't raise the score. Treat the
> backscatter hitting that rule differently. 

Hmmm.  I see the point about the Bayes issue.  Not sure if I can use procmail in this case though, as my mx servers are just gateways.  The mail comes in, and is then processed by MailScanner (which calls spamassassin, among other things) and sent to an internal Exchange server.  No local mailboxes on the gateways.  But I may be able to set up some appropriate rules in MailScanner to accomplish the same thing.  I'll ask over on that list...

...Kevin
-- 
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

RE: Joe-job blowback

[Karsten Bräckelmann <gu...@rudersport.de>]

Please keep list-posts on the list.

On Mon, 2009-08-31 at 16:23 -0800, Kevin Miller wrote:
> Karsten Bräckelmann wrote:
> > VBounce plugin.
> 
> Yup, got it enabled.  Pretty minimal scoring though.  Followed the
> instructions at http://wiki.apache.org/spamassassin/VBounceRuleset to
> set it up.  
>  
> > Use it to filter / deliver hits into a dedicated folder, rather than
> > attempting to raise the score into oblivion. See 20_vbounce.cf and
> > its docs.  

Sic.  Use the hits for filtering. NOT scoring bounces high. They are not
spam, and they are likely to bias your Bayes database, if you treat them
as such.

$ grep -A 2 procmail 20_vbounce.cf

# If you use this, set up procmail or your mail app to spot the
# "ANY_BOUNCE_MESSAGE" rule hits in the X-Spam-Status line, and move
# messages that match that to a 'vbounce' folder.


> > Also see quite a lot of related posts in the past by me, how to
> > handle VBounce hits. 
> 
> Thanks, I'll check the archives...

Pretty much the above. :)  Don't raise the score. Treat the backscatter
hitting that rule differently.


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}