You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Giampaolo Tomassoni <g....@libero.it> on 2009/08/13 17:52:28 UTC
DKIM-Reputation list
Hi,
I was looking at some kind of open-source DKIM-signing piece of code, and
fall into this site:
http://www.dkim-reputation.org/
It has nothing to do with what I'm looking for, nevertheless it seemed
interesting to me and I wanted to give it a try.
Unfortunately, the software they propose would replace the actual
Mail::SpamAssassin::Plugin::DKIM file with their one, which seems extending
the former. I didn't yet decided for it.
Wouldn't it be interesting to merge their version of the DKIM plugin into
the SA main branch? Besides, I see they are publishing their code under the
very same Apache license SA adopts.
Also, I see they sent to SA some patch to the DKIM plugin in 2007 or the
like. Why their code didn't get in the main branch?
Thanks,
Giampaolo
RE: DKIM-Reputation list
Posted by Giampaolo Tomassoni <g....@libero.it>.
> -----Original Message-----
> From: Mark Martinec [mailto:Mark.Martinec+sa@ijs.si]
> Sent: Thursday, August 13, 2009 6:04 PM
> To: users@spamassassin.apache.org
> Subject: Re: DKIM-Reputation list
>
> Giampaolo,
>
> >
> > ...omissis...
> >
>
> Back in April (2009) I send to Florian Sager my version of
> the plugin, based on his work. Unlike the original suggestion
> (of modifying the DKIM plugin), my suggestion was to leave
> the DKIM.pm as it is, and add a separate plugin DKIMrep.pm
> to deal with reputations.
It sounds better to me too.
> Don't know how/if the project has progressed meanwhile.
> If anyone is interested, I can send him the DKIMrep.pm.
>
> Mark
Hi Mark.
Nice to see I'm not the only one tickled by the DKIM-reputation idea...
I see you sent the DKIMrep.pm offlist. Greylisting permitting, I'll let a
try to it and, of course, let you know.
Thank you very much,
Giampaolo
PS: I'm running SA 3.2.4. Is it ok with your DKIMrep or is it demanding for
the latest, bleeding-edge SA version?
Re: DKIM-Reputation list
Posted by Bowie Bailey <Bo...@BUC.com>.
Benny Pedersen wrote:
> On Thu, 13 Aug 2009 21:36:28 +0200, Mark Martinec
> <Ma...@ijs.si>
> wrote:
>
>
>> Does perl complain?
>> $ perl effectiveTLDs.pm
>>
>
> no errors
>
> so
>
> 'bar' => {},
> foo' => {},
> 'bar' => {},
>
> is valid for perl ?
>
> example in line around 2106
>
> but perl accept it, imho this does not mean that there is no errors
>
I don't see anything like that. As far as I can tell all of the lines
after the start of that section start with a single quote character. I
searched for lines that did not and found nothing.
The duplicated braces on some lines that you asked about previously are
grouping those lines together. Some extra line breaks and indentation
would make it more clear.
'bar' => { 'foo' => {},
'bat' => {}},
is equivelent to:
'bar => {
'foo' => {},
'bat' => {}
},
--
Bowie
Re: DKIM-Reputation list
Posted by Benny Pedersen <me...@junc.org>.
On Thu, 13 Aug 2009 21:36:28 +0200, Mark Martinec
<Ma...@ijs.si>
wrote:
> Does perl complain?
> $ perl effectiveTLDs.pm
no errors
so
'bar' => {},
foo' => {},
'bar' => {},
is valid for perl ?
example in line around 2106
but perl accept it, imho this does not mean that there is no errors
--
Benny Pedersen
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
Benny,
> > http://www.ijs.si/software/amavisd/effectiveTLDs.pm
>
> this file seams buggy, not all lines begins with a ' and others dont end
> with } but }}
>
> hope its just me that cant read perl :)
???
Does perl complain?
$ perl effectiveTLDs.pm
Mark
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
Giampaolo,
> The DKIMrep.pm loaded fine, but then it complained that the
> effectiveTLDs.pm file was not in the Mail::SpamAssassin::Plugin stock dir.
> I had to copy it there to fix this issue.
>
> I think it wouldn't be too bad to somehow have a way to specify the full
> path to effectiveTLDs.pm. Besides, it seems to me that this file lists all
> the well-known TLDs (for a quite obscure purpose to me). Since this list
> may suddenly change, I would think to this file more like a config one than
> code...
I know and I agree with you on all accounts, including the "obscure purpose".
Address the complaint to Florian Sager. There might be a newer version of
his work available.
Mark
Re: DKIM-Reputation list
Posted by Benny Pedersen <me...@junc.org>.
On Thu, 13 Aug 2009 20:06:01 +0200, Mark Martinec
<Ma...@ijs.si>
wrote:
> I've place it on the web page:
> http://www.ijs.si/software/amavisd/DKIMrep.pm
> http://www.ijs.si/software/amavisd/effectiveTLDs.pm
this file seams buggy, not all lines begins with a ' and others dont end
with } but }}
hope its just me that cant read perl :)
--
Benny Pedersen
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
On Monday 17 August 2009 11:50:53 Florian Sager wrote:
> Correct, there is only a dependency on the results of the DKIM.pm module.
> There are DKIM verifiers that add a "Authentication-Results" header to
> an email, these results would suffice to request data from
> dkim-reputation.org as well; duplicate DKIM checks (in a dkim proxy, in
> amavisd, in spamassassin, ...) should be avoided (well, the public keys
> for verification should be available in local DNS caches but anyway ...).
> @Mark: several equal DKIM checks can be automatically avoided if admins
> define trusted server-ids when configuring amavisd and/or spamassassin;
> if there is a trusted Authentication-Results header the results are
> copied to script internal DKIM result variables instead of running an
> additional verification (?).
It would certainly be possible to take verification results from
Authentication-Results header fields. I find it a bit tricky to reliably
recognize/configure which Authentication-Results are genuinely
inserted at our site and which are fake.
Btw, starting with SpamAssassin 3.3.0 and amavisd-new-2.6.3 the
DKIM verification is done only once, the SA plugin receives verification
results through API (passing the Mail::DKIM::Signature objects) and
does not call Mail::DKIM checking again.
Mark
Re: DKIM-Reputation list
Posted by Florian Sager <sa...@agitos.de>.
Giampaolo Tomassoni schrieb:
> AFAIK, Amavis is not involved: the Mail::SpamAssassin::Plugin::DKIMrep only
> uses DKIM signatures "passed" by Mail::SpamAssassin::Plugin::DKIM, which in
> turn uses Mail::DKIM to validate them.
>
> I believe Amavis do have independent DKIM code, which I would exclude is
> somehow involved in the process.
>
> Note, in example, that I'm testing DKIMrep by directly invoking SA on test
> messages and it seems to work to me. No "scent of amavis" around, then...
>
> Giampaolo
>
Correct, there is only a dependency on the results of the DKIM.pm module.
There are DKIM verifiers that add a "Authentication-Results" header to
an email, these results would suffice to request data from
dkim-reputation.org as well; duplicate DKIM checks (in a dkim proxy, in
amavisd, in spamassassin, ...) should be avoided (well, the public keys
for verification should be available in local DNS caches but anyway ...).
@Mark: several equal DKIM checks can be automatically avoided if admins
define trusted server-ids when configuring amavisd and/or spamassassin;
if there is a trusted Authentication-Results header the results are
copied to script internal DKIM result variables instead of running an
additional verification (?).
---
Let me summarize the small changes I plan to add to the dkim-reputation
system (those won't affect running implementations):
- the effective TLD rewriting at the client side will be removed, so
clients ask for
md5(local-part).md5(originator-domain).md5(signing-domain) only -->
easier to implement and no regular updates of TLD lists necessary
- to prevent that spammers always get a neutral reputation for the same
effective domain if they start to use a new subdomain for signing I
would do the effective TLD calculation on my side (only) and add the
worst value of an effective TLD to an unknown signing domain, e.g.
a.domain.tld has reputation x worse than neutral, so b.domain.tld will
get this reputation as well --> two records would be published (instead
of one like it is today)
- I want to clarifiy the use of user specific request parts below the
signing domain: it's necessary to stress that the content of i= has
clear priority. Signers should include an i= parameter to their mails
(unfortunately the existing DKIM signer implementations don't support
this sufficiently). The fallback is the use of addresses in the From
header (no combination with Sender header values for the ease of use).
Best regards,
Florian
RE: DKIM-Reputation list
Posted by Giampaolo Tomassoni <g....@libero.it>.
> -----Original Message-----
> From: R-Elists [mailto:lists07@abbacomm.net]
> Sent: Saturday, August 15, 2009 8:06 PM
> To: users@spamassassin.apache.org
> Subject: RE: DKIM-Reputation list
>
>
> is this DKIM-Reputation setup for any *general* current spamassassin
> deployment or does it only work with certain MTA setups ???
>
> i am asking because i believe what i saw was that Amavis was mentioned,
> and
> nothing else.
>
> TIA
Hi TIA (Transient Ischemic Event?),
AFAIK, Amavis is not involved: the Mail::SpamAssassin::Plugin::DKIMrep only
uses DKIM signatures "passed" by Mail::SpamAssassin::Plugin::DKIM, which in
turn uses Mail::DKIM to validate them.
I believe Amavis do have independent DKIM code, which I would exclude is
somehow involved in the process.
Note, in example, that I'm testing DKIMrep by directly invoking SA on test
messages and it seems to work to me. No "scent of amavis" around, then...
Giampaolo
> - rh
RE: DKIM-Reputation list
Posted by R-Elists <li...@abbacomm.net>.
is this DKIM-Reputation setup for any *general* current spamassassin
deployment or does it only work with certain MTA setups ???
i am asking because i believe what i saw was that Amavis was mentioned, and
nothing else.
TIA
- rh
RE: DKIM-Reputation list
Posted by Giampaolo Tomassoni <g....@libero.it>.
Hi Mark,
> -----Original Message-----
> From: Mark Martinec [mailto:Mark.Martinec+sa@ijs.si]
> Sent: Thursday, August 13, 2009 8:06 PM
> To: users@spamassassin.apache.org
> Subject: Re: DKIM-Reputation list
>
> Tobias, Giampaolo, Bill, and others
>
> > I'm interested too, thanks in advance
>
> I've place it on the web page:
> http://www.ijs.si/software/amavisd/DKIMrep.pm
> http://www.ijs.si/software/amavisd/effectiveTLDs.pm
>
> ...omissis...
>
I've setup my SA installation to use your DKIMrep plugin.
I first attempted putting DKIMrep.pm and effectiveTLDs.pm in my
/etc/spamassassin dir, loading them with:
loadplugin Mail::SpamAssassin::Plugin::DKIMrep
/etc/spamassassin/DKIMrep.pm
in init.pre.
The DKIMrep.pm loaded fine, but then it complained that the effectiveTLDs.pm
file was not in the Mail::SpamAssassin::Plugin stock dir. I had to copy it
there to fix this issue.
I think it wouldn't be too bad to somehow have a way to specify the full
path to effectiveTLDs.pm. Besides, it seems to me that this file lists all
the well-known TLDs (for a quite obscure purpose to me). Since this list may
suddenly change, I would think to this file more like a config one than
code...
Thank you,
Giampaolo
> Mark
RE: DKIM-Reputation list
Posted by Giampaolo Tomassoni <g....@libero.it>.
> Tobias, Giampaolo, Bill, and others
>
> > I'm interested too, thanks in advance
>
> I've place it on the web page:
> http://www.ijs.si/software/amavisd/DKIMrep.pm
> http://www.ijs.si/software/amavisd/effectiveTLDs.pm
Aaaah! Surfing time!
>
> ...omissis... (albeit interesting)
>
>
> I tested it with 3.3.0 and 3.2.5. Not that the DKIMrep plugin
> only has effect on messages with valid DKIM signatures, as
> verified by the existing DKIM plugin.
Hope 3.2.4 is fine enough, then...
I'll test it and let you know.
Thanks,
Giampaolo
>
> Mark
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
Tobias, Giampaolo, Bill, and others
> I'm interested too, thanks in advance
I've place it on the web page:
http://www.ijs.si/software/amavisd/DKIMrep.pm
http://www.ijs.si/software/amavisd/effectiveTLDs.pm
(the effectiveTLDs.pm is exactly the same as in the
Florian's package, the DKIMrep.pm is mostly Floarian's
code, but extracted from his original all-in-one plugin,
with my adaptation of the interfacing glue).
- Place DKIMrep.pm and effectiveTLDs.pm somewhere where
perl+SpamAssassin will be able to find them (perhaps
where other SA plugins reside), e.g. in
/usr/lib/perl5/site_perl/5.10.0/Mail/SpamAssassin/Plugin/
- add the following to your local.pre or wherever you load
your extra plugins from:
loadplugin Mail::SpamAssassin::Plugin::DKIMrep
- add the following to local.cf:
ifplugin Mail::SpamAssassin::Plugin::DKIM
ifplugin Mail::SpamAssassin::Plugin::DKIMrep
full DKIM_REPUT eval:check_dkim_reputation()
tflags DKIM_REPUT net
score DKIM_REPUT 0.1
describe DKIM_REPUT Signing domain reputation according to dkim-reputation.org
priority DKIM_REPUT 200
dkimrep_maxspamscore 0.5
dkimrep_maxhamscore -0.5
endif
endif
Its debug log area is 'dkimrep', so you can turn its logging on by
selecting this SA log area in your spamd or spamassassin or amavisd,
e.g.:
spamd --debug=noall,dkimrep [...]
amavisd -d noall,dkimrep (SA logging will show at log level 3)
I tested it with 3.3.0 and 3.2.5. Not that the DKIMrep plugin
only has effect on messages with valid DKIM signatures, as
verified by the existing DKIM plugin.
Mark
Re: DKIM-Reputation list
Posted by Tobias Lott <tl...@gamesnet.de>.
On Thu, 13 Aug 2009 18:13:31 +0200
Mark Martinec <Ma...@ijs.si> wrote:
> > > Don't know how/if the project has progressed meanwhile.
> > > If anyone is interested, I can send him the DKIMrep.pm.
> >
> > i like to try it
>
> Sent off-list.
>
> Mark
I'm interested too, thanks in advance
--
Tobias Lott
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
> > Don't know how/if the project has progressed meanwhile.
> > If anyone is interested, I can send him the DKIMrep.pm.
>
> i like to try it
Sent off-list.
Mark
Re: DKIM-Reputation list
Posted by Benny Pedersen <me...@junc.org>.
On Thu, 13 Aug 2009 18:04:04 +0200, Mark Martinec
<Ma...@ijs.si>
wrote:
> Don't know how/if the project has progressed meanwhile.
> If anyone is interested, I can send him the DKIMrep.pm.
i like to try it
--
Benny Pedersen
Re: DKIM-Reputation list
Posted by Mark Martinec <Ma...@ijs.si>.
Giampaolo,
> I was looking at some kind of open-source DKIM-signing piece of code, and
> fall into this site:
> http://www.dkim-reputation.org/
>
> It has nothing to do with what I'm looking for, nevertheless it seemed
> interesting to me and I wanted to give it a try.
>
> Unfortunately, the software they propose would replace the actual
> Mail::SpamAssassin::Plugin::DKIM file with their one, which seems extending
> the former. I didn't yet decided for it.
>
> Wouldn't it be interesting to merge their version of the DKIM plugin into
> the SA main branch? Besides, I see they are publishing their code under the
> very same Apache license SA adopts.
>
> Also, I see they sent to SA some patch to the DKIM plugin in 2007 or the
> like. Why their code didn't get in the main branch?
Back in April (2009) I send to Florian Sager my version of
the plugin, based on his work. Unlike the original suggestion
(of modifying the DKIM plugin), my suggestion was to leave
the DKIM.pm as it is, and add a separate plugin DKIMrep.pm
to deal with reputations.
Don't know how/if the project has progressed meanwhile.
If anyone is interested, I can send him the DKIMrep.pm.
Mark