You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Daniel McDonald <da...@austinenergy.com> on 2013/02/12 19:47:32 UTC
X-Relay-Countries
I¹ve had a simple rule I use to see if mail is forwarded through a ³foreign
country²:
header RELAY_NOT_US X-Relay-Countries =~
/\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
describe RELAY_NOT_US Relayed though any country other than the US
score RELAY_NOT_US 0.01
I mostly use it in Meta¹s, but it¹s a nice flag when doing other
correlations.
Unfortunately, the perl expression doesn¹t work for countries like the
Ukraine (UA) or Russia (RU).
And I don¹t really want ! RELAY_US, for lots of reasons.
Can someone suggest an expression that will match any 2-capital letter word
other than US?
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: X-Relay-Countries
Posted by Henrik K <he...@hege.li>.
On Mon, Feb 18, 2013 at 07:18:17AM -0600, Daniel McDonald wrote:
> On 2/16/13 8:10 AM, "Henrik K" <he...@hege.li> wrote:
>
> > Well I updated http://mailfud.org/ip-country-fast/ for the last time..
> > (no, you don't need the authorities gifs)
> >
> > There is no excuse not using SpamAssassin 3.4 with Geo::IP support (also
> > ipv6 works). Like the wiki says.
>
> 45 open bugs targeted for that version, 5 of them blockers? Sounds like a
> valid excuse to me.
Eh, anyone that actually follows how development is going, SVN has been used
by many people (not least all developers) for a year if not several. It has
worked much better than 3.3 for a long time.
Re: X-Relay-Countries
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/16/13 8:10 AM, "Henrik K" <he...@hege.li> wrote:
> Well I updated http://mailfud.org/ip-country-fast/ for the last time..
> (no, you don't need the authorities gifs)
>
> There is no excuse not using SpamAssassin 3.4 with Geo::IP support (also
> ipv6 works). Like the wiki says.
45 open bugs targeted for that version, 5 of them blockers? Sounds like a
valid excuse to me.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: X-Relay-Countries
Posted by Henrik K <he...@hege.li>.
On Sat, Feb 16, 2013 at 12:21:55PM +0100, Benny Pedersen wrote:
> Walter Hurry skrev den 2013-02-15 19:59:
>
> >So I have up-to-date ip.gif and cc.gif. If anyone wants them, post
> >here
> >and I'll put them on an ftp site somewhere.
>
> nope its faster to get 4GB ram and build localy, and its creates 4
> gif files not just 2 as in the wiki says, this plugin is ok for ipv4
> only mailhosts, but if mailhost have ipv6 either need this module
> patched to ipv6 or change to geo-ip closed sources, with possible
> diffrent licenses then apache uses in spamassassin
World record for long sentence?
Well I updated http://mailfud.org/ip-country-fast/ for the last time..
(no, you don't need the authorities gifs)
There is no excuse not using SpamAssassin 3.4 with Geo::IP support (also
ipv6 works). Like the wiki says.
Re: X-Relay-Countries
Posted by Benny Pedersen <me...@junc.eu>.
Walter Hurry skrev den 2013-02-15 19:59:
> So I have up-to-date ip.gif and cc.gif. If anyone wants them, post
> here
> and I'll put them on an ftp site somewhere.
nope its faster to get 4GB ram and build localy, and its creates 4 gif
files not just 2 as in the wiki says, this plugin is ok for ipv4 only
mailhosts, but if mailhost have ipv6 either need this module patched to
ipv6 or change to geo-ip closed sources, with possible diffrent licenses
then apache uses in spamassassin
Re: X-Relay-Countries
Posted by Walter Hurry <wa...@gmail.com>.
On Thu, 14 Feb 2013 13:26:33 +0100, Benny Pedersen wrote:
> Steve Freegard skrev den 2013-02-12 21:19:
>
>> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
>
> and what date is the database from ?, ip2cc ipv4-addr, to show it when
> its build, to update it either use the new relay_country plugin or
> update ip2cc database, if its over 6 mounts its time for a change
The former option wasn't really available for me, so I followed the notes
at http://wiki.apache.org/spamassassin/RelayCountryPlugin as suggested by
Jeff Mincy.
First I installed IP::Country::Fast, and noted that the database was from
July 2009. So I downloaded the two files from
http://mailfud.org/ip-country-fast/ as mentioned in the wiki article.
Better: June 2012.
Finally I built them myself using the RIPE downloads, again as suggested
in the wiki article.
$ ip2cc 213.174.72.92
IP::Country modules (v2.27)
Copyright (c) 2002-05 Nigel Wetters Gourlay
Database updated Fri Feb 15 18:04:48 2013
Address: 213.174.72.92
Country: DK (Denmark)
$
So I have up-to-date ip.gif and cc.gif. If anyone wants them, post here
and I'll put them on an ftp site somewhere.
Re: X-Relay-Countries
Posted by Benny Pedersen <me...@junc.eu>.
Steve Freegard skrev den 2013-02-12 21:19:
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
and what date is the database from ?, ip2cc ipv4-addr, to show it when
its build, to update it either use the new relay_country plugin or
update ip2cc database, if its over 6 mounts its time for a change
Re: X-Relay-Countries
Posted by Steve Freegard <st...@fsl.com>.
On 12/02/13 18:47, Daniel McDonald wrote:
> I’ve had a simple rule I use to see if mail is forwarded through a
> “foreign country”:
>
> header RELAY_NOT_US X-Relay-Countries =~
> /\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
> describe RELAY_NOT_US Relayed though any country other than the US
> score RELAY_NOT_US 0.01
>
> I mostly use it in Meta’s, but it’s a nice flag when doing other
> correlations.
>
> Unfortunately, the perl expression doesn’t work for countries like the
> Ukraine (UA) or Russia (RU).
>
> And I don’t really want ! RELAY_US, for lots of reasons.
>
> Can someone suggest an expression that will match any 2-capital letter
> word other than US?
>
How about:
header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
Regards,
Steve.
Re: X-Relay-Countries
Posted by Jeff Mincy <je...@delphioutpost.com>.
From: Mike Grau <m....@kcc.state.ks.us>
Date: Tue, 12 Feb 2013 14:18:33 -0600
> Hmm.... I would do something like this (untested):
>
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
I've had to use, IIRC.
X-Relay-Countries =~ /\b(?!US|XX)([A-Z]{2})\b/
XX means unknown, mostly due to stale database. You can update the
IP::Country database. See:
http://wiki.apache.org/spamassassin/RelayCountryPlugin
-jeff
Re: X-Relay-Countries
Posted by Mike Grau <m....@kcc.state.ks.us>.
>
> Hmm.... I would do something like this (untested):
>
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
>
I've had to use, IIRC.
X-Relay-Countries =~ /\b(?!US|XX)([A-Z]{2})\b/
Re: X-Relay-Countries
Posted by Bowie Bailey <Bo...@BUC.com>.
On 2/12/2013 3:00 PM, David F. Skoll wrote:
> On Tue, 12 Feb 2013 19:57:28 +0000
> Martin Gregorie <ma...@gregorie.org> wrote:
>
>> header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
> No. We leave it as an exercise to the reader to find out why that
> solution is wrong.
Hmm.... I would do something like this (untested):
header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
--
Bowie
Re: X-Relay-Countries
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Tue, 12 Feb 2013 19:57:28 +0000
Martin Gregorie <ma...@gregorie.org> wrote:
> header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
No. We leave it as an exercise to the reader to find out why that
solution is wrong.
Regards,
David.
Re: X-Relay-Countries
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2013-02-12 at 14:15 -0500, David F. Skoll wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TV-Z][A-Z]|[A-Z][A-RT-Z])\b/
>
Shouldn't that be:
header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
> of course. Sorry!
>
BTW, its no wonder so much spam cones from the US since CANSPAM seems to
be utterly toothless. It reminds me of the Telephone Preference Service
here, which is supposed to block unwanted cold calls from telemarketers
but in practise all it does is to make apologetic noises.
Martin
Re: X-Relay-Countries
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Thu, 14 Feb 2013 12:21:33 +0000
Ned Slider <ne...@unixmail.co.uk> wrote:
> Nice idea, but why not just use SPF for fedex.com as they bother to
> publish an SPF record? Surely that has to be a far more reliable
> indicator it wasn't sent from fedex?
That works if the envelope sender is something@fedex.com, but if the header
sender is from fedex.com and the envelope sender is spammer@passes-spf.org
then SPF is useless.
I experimented with applying SPF tests to the header From: (which is against
the spec), but it had way too many false-positives.
> They might sign their mail too, but as I don't have any legitimate
> fedex mails to hand, I can't confirm that.
I don't believe they use DKIM.
Regards,
David.
Re: X-Relay-Countries
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/14/13 6:21 AM, "Ned Slider" <ne...@unixmail.co.uk> wrote:
> On 12/02/13 20:33, Daniel McDonald wrote:
>>
>> On 2/12/13 1:15 PM, "David F. Skoll"<df...@roaringpenguin.com> wrote:
>>
>>>
>>> PS: Beware of penalizing other countries too much. My mail originates
>>> from Canada and the PostgreSQL mailing list is (or used to be?) hosted
>>> in Panama. Furthermore, by far the lion's share of spam originates from
>>> the US.
>>
>> Yes, of course. But some mail just isn't likely to originate overseas. For
>> example, we have been getting a lot of phishes pretending to be FedEX
>> non-delivery notices. FedEX is based in the US, so if I see "FedEX" and
>> RELAY_NOT_US, and a couple of other spam signs, I can more safely conclude
>> it is spam....
>>
>
> Nice idea, but why not just use SPF for fedex.com as they bother to
> publish an SPF record? Surely that has to be a far more reliable
> indicator it wasn't sent from fedex?
>
>
> $ dig txt fedex.com
>
> ;; ANSWER SECTION:
> fedex.com. 10578 IN TXT "v=spf1
> redirect=_spf.infosec.fedex.com"
>
>
> They might sign their mail too, but as I don't have any legitimate fedex
> mails to hand, I can't confirm that.
>
We get plenty of messages from suppliers stating that they have made a
shipment, and the fedex tracking number is foo. But lately we've been
getting a lot of phishes where the link for the fedex tracking number
actually points to malware, and most of these are using cracked accounts and
are being generated on botnets, so I'm looking for a fedex "tracking link"
that didn't originate locally.
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281
Re: X-Relay-Countries
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 12/02/13 20:33, Daniel McDonald wrote:
>
> On 2/12/13 1:15 PM, "David F. Skoll"<df...@roaringpenguin.com> wrote:
>
>>
>> PS: Beware of penalizing other countries too much. My mail originates
>> from Canada and the PostgreSQL mailing list is (or used to be?) hosted
>> in Panama. Furthermore, by far the lion's share of spam originates from
>> the US.
>
> Yes, of course. But some mail just isn't likely to originate overseas. For
> example, we have been getting a lot of phishes pretending to be FedEX
> non-delivery notices. FedEX is based in the US, so if I see "FedEX" and
> RELAY_NOT_US, and a couple of other spam signs, I can more safely conclude
> it is spam....
>
Nice idea, but why not just use SPF for fedex.com as they bother to
publish an SPF record? Surely that has to be a far more reliable
indicator it wasn't sent from fedex?
$ dig txt fedex.com
;; ANSWER SECTION:
fedex.com. 10578 IN TXT "v=spf1
redirect=_spf.infosec.fedex.com"
They might sign their mail too, but as I don't have any legitimate fedex
mails to hand, I can't confirm that.
Re: X-Relay-Countries
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/12/13 1:15 PM, "David F. Skoll" <df...@roaringpenguin.com> wrote:
> On Tue, 12 Feb 2013 14:14:46 -0500
> "David F. Skoll" <df...@roaringpenguin.com> wrote:
>
>> header RELAY_NOT_US X-Relay-Countries =~
>> /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
>
> Emm... should be
>
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TV-Z][A-Z]|[A-Z][A-RT-Z])\b/
Quite right, and quite simple. Thanks!
>
> PS: Beware of penalizing other countries too much. My mail originates
> from Canada and the PostgreSQL mailing list is (or used to be?) hosted
> in Panama. Furthermore, by far the lion's share of spam originates from
> the US.
Yes, of course. But some mail just isn't likely to originate overseas. For
example, we have been getting a lot of phishes pretending to be FedEX
non-delivery notices. FedEX is based in the US, so if I see "FedEX" and
RELAY_NOT_US, and a couple of other spam signs, I can more safely conclude
it is spam....
Re: X-Relay-Countries
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Tue, 12 Feb 2013 14:14:46 -0500
"David F. Skoll" <df...@roaringpenguin.com> wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
Emm... should be
header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TV-Z][A-Z]|[A-Z][A-RT-Z])\b/
of course. Sorry!
Regards,
David.
Re: X-Relay-Countries
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Tue, 12 Feb 2013 12:58:40 -0600
Daniel McDonald <da...@austinenergy.com> wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}\b/
How about:
header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
Untested; use at your own risk. :)
Regards,
David.
PS: Beware of penalizing other countries too much. My mail originates
from Canada and the PostgreSQL mailing list is (or used to be?) hosted
in Panama. Furthermore, by far the lion's share of spam originates from
the US.
Re: X-Relay-Countries
Posted by Daniel McDonald <da...@austinenergy.com>.
On 2/12/13 12:47 PM, "Daniel McDonald" <da...@austinenergy.com>
wrote:
> I¹ve had a simple rule I use to see if mail is forwarded through a ³foreign
> country²:
>
> header RELAY_NOT_US X-Relay-Countries =~
> /\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
Oops. I was fiddling with the syntax trying to fix it. This is my current
rule:
header RELAY_NOT_US X-Relay-Countries =~ /\b[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}\b/
--
Daniel J McDonald, CCIE # 2495, CISSP # 78281