why did spamassassin block this ?

[Lucio Chiappetti <lu...@lambrate.inaf.it>]

We have been very happily running spamassassin 3.0.4 under amavisd-new 
milter on Suse 9.2 since a couple of years, using the standard 
configuration recommended by the Italian GARR network.

Please avoid comments on "old version" or so, we are planning an overall 
update following an OS update in the coming months. I am asking here a 
VERY SPECIFIC question.

We are trying to debug a funny case of false positive (extremely rare 
otherwise) which occurred to us (the issue has been solved "by chance" but 
we do not understand why).

A colleague of us working remotely has set up (on a machine outside of our 
domain) a system which requires a registration and then sends a 
confirmation e-mail.

All such confirmation messages were blocked by our spamassassin with a 
score of about 8. This is an example of info in the header.

X-Spam-Status: Yes, hits=8.087 tag=-999 tag2=4.5 kill=4.5 tests=AWL,
BAYES_05,
  DNS_FROM_SECURITYSAGE, FORGED_RCVD_HELO, HTML_10_20, HTML_EXTRA_CLOSE,
  HTML_MESSAGE, HTML_SHORT_LENGTH, NO_REAL_NAME, UPPERCASE_25_50

As far as I understand, none of the above rules has a score above 0.38
(usually quite lower and marginal, 0.007 or 0.001). except AWL which has 1
(in fact the address is recorded in awlst with a score of 8).

The message itself looked sort of funny to me :

1) had in the header
    Content-Type: multipart/alternative;
         boundary="----=_NextPart_000_0024_01C93372.1920FB50"

2) but it did not consist of attachments, and the boundary itself
    did not appear anywhere in the message

3) the message itself consisted of two lines interspersed with a few
    HTML tags. This is an example

Ti confermiamo l'avvenuta registrazione al CRIS dell'XYZT di abcde<p>I 
dati di accesso sono:<p>userid: <b>XXXXXXXXX</b><br>password: YYYYYYY</b>

We suggested to our colleague to arrange so that everything was sent
in plain text. He did so (now there is no Content-Type in the header
and no HTML tags in the body), and now the messages are getting through.

But even if they were malformed, why should spamassassin assign such a 
huge score ?

I should add that when I did the experiments yesterday, I found the awlst 
on the main MX contained 33 hits (with the registration address and the 
first two bytes of the IP address), with an average score of 8, while the 
secondary MX contained one hit with a score of 9.1.

They were all recent since the registration address had just been created.

Yesterday I did a remove-address on both awlst's and re-run a single test, 
and that was immediately blocked with a score of 8 (so it did not depend 
on previous history of the address).

Then, when my colleague did his change, I did another remove-address and 
then things went through without any record in awlst.


-- 
Lucio Chiappetti - INAF/IASF - via Bassini 15 - I-20133 Milano (Italy)
For more info : http://www.iasf-milano.inaf.it/~lucio/personal.html
-----------------------------------------------------------------------
"Nature" on government cuts to research       http://snipurl.com/4erid
"Nature" e i tagli del governo alla ricerca   http://snipurl.com/4erko

Re: why did spamassassin block this ?

[mouss <mo...@netoyen.net>]

Lucio Chiappetti a écrit :
> We have been very happily running spamassassin 3.0.4 under amavisd-new
> milter on Suse 9.2 since a couple of years, using the standard
> configuration recommended by the Italian GARR network.
> 
> Please avoid comments on "old version" or so, we are planning an overall
> update following an OS update in the coming months. I am asking here a
> VERY SPECIFIC question.
> 
> We are trying to debug a funny case of false positive (extremely rare
> otherwise) which occurred to us (the issue has been solved "by chance"
> but we do not understand why).
> 
> A colleague of us working remotely has set up (on a machine outside of
> our domain) a system which requires a registration and then sends a
> confirmation e-mail.
> 
> All such confirmation messages were blocked by our spamassassin with a
> score of about 8. This is an example of info in the header.
> 
> X-Spam-Status: Yes, hits=8.087 tag=-999 tag2=4.5 kill=4.5 tests=AWL,
> BAYES_05,
>  DNS_FROM_SECURITYSAGE, FORGED_RCVD_HELO, HTML_10_20, HTML_EXTRA_CLOSE,
>  HTML_MESSAGE, HTML_SHORT_LENGTH, NO_REAL_NAME, UPPERCASE_25_50
> 

- you should upgrade :)
- you should disable securitysage. it lists the universe.
- check why the message triggered FORGED_RCVD_HELO.
- it is recommended to ask for "first/lasy name" and use them in the To
header.
- Similarly, it is recommended to have a display name in the From header.
- it is not very polite to send html-centric mail. In confirmation
requests, you generally want to maximize your chances of reaching the
recipient, and minimize (bullshit|blahblah) (however you name it).


> As far as I understand, none of the above rules has a score above 0.38
> (usually quite lower and marginal, 0.007 or 0.001). except AWL which has 1
> (in fact the address is recorded in awlst with a score of 8).
> 

If AWL gives you bad results, disable it until you can be sure to make
it work reliably. I found it to bring more trouble than help.

> The message itself looked sort of funny to me :
> [snip]

Re: why did spamassassin block this ?

[Matt Kettler <mk...@verizon.net>]

Matt Kettler wrote:
> Lucio Chiappetti wrote:
>   
>> We have been very happily running spamassassin 3.0.4 under amavisd-new
>> milter on Suse 9.2 since a couple of years, using the standard
>> configuration recommended by the Italian GARR network.
>>
>> Please avoid comments on "old version" or so, we are planning an
>> overall update following an OS update in the coming months. I am
>> asking here a VERY SPECIFIC question.
>>
>> We are trying to debug a funny case of false positive (extremely rare
>> otherwise) which occurred to us (the issue has been solved "by chance"
>> but we do not understand why).
>>
>> A colleague of us working remotely has set up (on a machine outside of
>> our domain) a system which requires a registration and then sends a
>> confirmation e-mail.
>>
>> All such confirmation messages were blocked by our spamassassin with a
>> score of about 8. This is an example of info in the header.
>>
>> X-Spam-Status: Yes, hits=8.087 tag=-999 tag2=4.5 kill=4.5 tests=AWL,
>> BAYES_05,
>>  DNS_FROM_SECURITYSAGE, FORGED_RCVD_HELO, HTML_10_20, HTML_EXTRA_CLOSE,
>>  HTML_MESSAGE, HTML_SHORT_LENGTH, NO_REAL_NAME, UPPERCASE_25_50
>>     
>
> That looks like a mimedefang header. As best I can tell here, SA did its
> job and generated a score of over 8 points, but mimedefang failed to
> react to the fact that it was over the kill threshold.
>
> (SA doesn't support a "kill" threshold anyway).
>   
Nevermind.. I mis-read the subject...

>
>
>   

Re: why did spamassassin block this ?

[Matt Kettler <mk...@verizon.net>]

Lucio Chiappetti wrote:
> We have been very happily running spamassassin 3.0.4 under amavisd-new
> milter on Suse 9.2 since a couple of years, using the standard
> configuration recommended by the Italian GARR network.
>
> Please avoid comments on "old version" or so, we are planning an
> overall update following an OS update in the coming months. I am
> asking here a VERY SPECIFIC question.
>
> We are trying to debug a funny case of false positive (extremely rare
> otherwise) which occurred to us (the issue has been solved "by chance"
> but we do not understand why).
>
> A colleague of us working remotely has set up (on a machine outside of
> our domain) a system which requires a registration and then sends a
> confirmation e-mail.
>
> All such confirmation messages were blocked by our spamassassin with a
> score of about 8. This is an example of info in the header.
>
> X-Spam-Status: Yes, hits=8.087 tag=-999 tag2=4.5 kill=4.5 tests=AWL,
> BAYES_05,
>  DNS_FROM_SECURITYSAGE, FORGED_RCVD_HELO, HTML_10_20, HTML_EXTRA_CLOSE,
>  HTML_MESSAGE, HTML_SHORT_LENGTH, NO_REAL_NAME, UPPERCASE_25_50

That looks like a mimedefang header. As best I can tell here, SA did its
job and generated a score of over 8 points, but mimedefang failed to
react to the fact that it was over the kill threshold.

(SA doesn't support a "kill" threshold anyway).

Re: why did spamassassin block this ?

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 23.10.08 11:05, Lucio Chiappetti wrote:
> We have been very happily running spamassassin 3.0.4 under amavisd-new 
> milter on Suse 9.2 since a couple of years, using the standard 
> configuration recommended by the Italian GARR network.
> 
> Please avoid comments on "old version" or so, we are planning an overall 
> update following an OS update in the coming months. I am asking here a 
> VERY SPECIFIC question.

however the problem IS that you are using old version. This version even
does not support sa-update. That means that any rules hitting everything
(quite common for blacklists some time after they are shut down).

> X-Spam-Status: Yes, hits=8.087 tag=-999 tag2=4.5 kill=4.5 tests=AWL,
> BAYES_05,
>  DNS_FROM_SECURITYSAGE, FORGED_RCVD_HELO, HTML_10_20, HTML_EXTRA_CLOSE,
   ^^^^^^^^^^^^^^^^^^^^^
old, obsolete, hitting everything rule. remove it.

>  HTML_MESSAGE, HTML_SHORT_LENGTH, NO_REAL_NAME, UPPERCASE_25_50
> 
> As far as I understand, none of the above rules has a score above 0.38
> (usually quite lower and marginal, 0.007 or 0.001). except AWL which has 1
> (in fact the address is recorded in awlst with a score of 8).

What about X-Spam-Report: header that should contain proper explanation with
used scores? 

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin, 1759