You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by SpankTheSpam <sp...@gmail.com> on 2007/11/11 13:56:56 UTC
URICountry not working - any clue?
Hi
I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
local.cf:
loadplugin Mail::SpamAssassin::Plugin::URICountry
uricountry URICOUNTRY_PL PL
header URICOUNTRY_PL eval:check_uricountry('URICOUNTRY_PL')
describe URICOUNTRY_PL Contains a URI hosted in PL
tflags URICOUNTRY_PL net
score URICOUNTRY_PL 54
but the message sent from polish servers gets NO additional scoring because
of that rule. I can see URICountry in spamassassin -D -t < testmessage:
[1445] dbg: plugin: Mail::SpamAssassin::Plugin::URICountry=HASH(0x88b4d2c)
implements 'parsed_metadata', priority 0
[1445] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x88edd24)
implements 'parsed_metadata', priority 0
[1445] dbg: debug: URICountry smtp.wp.pl in smtp.wp.pl
[1445] dbg: debug: URICountry http://smtp.wp.pl in smtp.wp.pl
[1445] dbg: debug: URICountry http://pop3.wp.pl in pop3.wp.pl
[1445] dbg: debug: URICountry pop3.wp.pl in pop3.wp.pl
[1445] dbg: debug: URICountry http://poczta.wp.pl/autoryzacja/ in
poczta.wp.pl
[1445] dbg: debug: URICountry mailto:poczta@wp.pl in wp.pl
[1445] dbg: debug: URICountry http://profil.wp.pl/pomoc.html in profil.wp.pl
[1445] dbg: debug: URICountry
http://klik.wp.pl/?adr=http://corto.www.wp.pl/as/kultura1.html&sid=92 in
klik.wp.pl
[1445] dbg: debug: URICountry http://corto.www.wp.pl/as/kultura1.html&sid=92
in corto.www.wp.pl
[1445] dbg: debug: URICountry
http://klik.wp.pl/?adr=http%3A%2F%2Fcorto.www.wp.pl%2Fas%2Fkultura1.html&sid=92
in klik.wp.pl
[1445] dbg: debug: URICountry http://spik.wp.pl in spik.wp.pl
[1445] dbg: debug: URICountry http://profil.wp.pl/antyspam.html in
profil.wp.pl
[1445] dbg: debug: URICountry http://pop3.wp.pl in pop3.wp.pl
[1445] dbg: debug: URICountry http://smtp.wp.pl in smtp.wp.pl
[1445] dbg: debug: URICountry http://profil.wp.pl/profil.html#telefon in
profil.wp.pl
[1445] dbg: debug: URICountry http://poczta.wp.pl in poczta.wp.pl
[1445] dbg: debug: URICountry smtp.wp.pl in PL
[1445] dbg: debug: URICountry pop3.wp.pl in PL
[1445] dbg: debug: URICountry spik.wp.pl in PL
[1445] dbg: debug: URICountry wp.pl in PL
[1445] dbg: debug: URICountry profil.wp.pl in PL
[1445] dbg: debug: URICountry klik.wp.pl in PL
[1445] dbg: debug: URICountry corto.www.wp.pl in PL
[1445] dbg: debug: URICountry poczta.wp.pl in PL
[1445] dbg: debug: URICountry hit rule: pl
and the result is that message passes the spam filter, while my spam score
is 5, so it should be killed.
What may be the clue?
Kind regards,
S.
--
View this message in context: http://www.nabble.com/URICountry-not-working---any-clue--tf4785757.html#a13691080
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: URICountry not working - any clue?
Posted by Derek Harding <de...@innovyx.com>.
SpankTheSpam wrote:
> but the message sent from polish servers gets NO additional scoring because
> of that rule. I can see URICountry in spamassassin -D -t < testmessage:
>
URICountry doesn't score based on country of origin (that's
RelayCountry). URICountry scores based on the country in which URLs
referenced in the email are hosted.
Derek
Re: URICountry not working - any clue?
Posted by Matt Kettler <mk...@verizon.net>.
SpankTheSpam wrote:
> Hi
>
> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
> local.cf:
>
> loadplugin Mail::SpamAssassin::Plugin::URICountry
>
> uricountry URICOUNTRY_PL PL
> header URICOUNTRY_PL eval:check_uricountry('URICOUNTRY_PL')
> describe URICOUNTRY_PL Contains a URI hosted in PL
> tflags URICOUNTRY_PL net
> score URICOUNTRY_PL 54
>
> but the message sent from polish servers gets NO additional scoring because
> of that rule. I can see URICountry in spamassassin -D -t < testmessage:
>
>
<snip>
> [1445] dbg: debug: URICountry hit rule: pl
>
> and the result is that message passes the spam filter, while my spam score
> is 5, so it should be killed.
> What may be the clue?
>
Did the message wind up having URICOUNTRY_PL in the hits list? Did it
have a coresoponding score of 54? Is there anything else in the hits
that might have reduced the score (ie: USER_IN_WHITELIST)?
I tested it on my SA 3.2.3 and it worked fine:
X-Spam-Status: Yes, score=37.4 required=5.0
tests=AWL,BAD_ENC_HEADER,BAYES_99,
FROM_LOCAL_DIGITS,FROM_LOCAL_HEX,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,
MIME_HTML_ONLY,NO_DNS_FOR_FROM,PLING_QUERY,URICOUNTRY_PL
shortcircuit=no
autolearn=spam version=3.2.3
X-Spam-Report:
* 54 URICOUNTRY_PL Contains a URI hosted in PL
RE: URICountry not working - any clue?
Posted by Michael Scheidell <sc...@secnap.net>.
Matt is right.. Uri country and relay-country not related.
Might go over to the amavisd-new groups and ask.
If SA sees it and amavisd-new doesn't, then ask in the amavisd group.
--
Michael Scheidell, CTO
Office: 561-999-5000 x 1259
Direct: 561-939-7259
Real time security alerts: http://www.secnap.com/news
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_________________________________________________________________________
Re: URICountry not working - any clue?
Posted by SpankTheSpam <sp...@gmail.com>.
Also, Ive noticed, that RelayCountry plugin does not work also. Of course I
do have IP-Country perl module. Whats wrong with those two, is there any
magic needed to use it with amavisd?
--
View this message in context: http://www.nabble.com/URICountry-not-working---any-clue--tf4785757.html#a13691339
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: URICountry not working - any clue?
Posted by SpankTheSpam <sp...@gmail.com>.
Matt Kettler-3 wrote:
>
> Byung-Hee HWANG wrote:
>> hi,
>>
>> On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
>>
>>> Hi
>>>
>>> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3
>>> and
>>> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
>>> local.cf:
>>>
>> [...]
>>
>> well, imho, its using is not fair to over the world. because there
>> regarding spam country may/might be a little bit pure email users. we
>> can use another way instead of the dangerous way. i would like to here
>> some opinion about that..
>>
>>
>
> Uricountry, relaycountry, etc are all quite useful, but I agree their
> use must be reasonably tempered.
>
> I strongly disagree with using either of these systems to assign more
> than half your spam threshold to any message. Country of origin or
> hosting site alone is not a very good sole criteria for declaring a
> message to be spam.
>
> However, in my case I do receive a few nonspam messages from Korea each
> year, like this message for example, and all are quite clearly nonspam
> and technical in nature... I also receive around a thousand spam
> messages that were sent from infected hosts in Korea each year (mostly
> controlled by American spammers). As a result, I assign 1.5 points (of a
> 5.0 threshold) to messages delivered to my network from Korea. This
> helps catch some of the more evasive spam, but I also have yet to have
> it cause a single false positive on a nonspam message. (Your message
> would have totaled 1.5/5.0 if it was sent directly, as it caught no
> other positive scoring rules)
>
> This is even more true for web hosting. There's no reason an american
> company can't have a website hosted overseas. So many of their products
> are made there, so why shouldn't the websites be hosted there?
>
> Unfortunately, like any rule, there's a lot of admins out there who
> think in absolutes, and assign absurd scores to rules. This is, of
> course, highly contrary to the whole design of SpamAssassin, which
> exists because Justin got tired of single-criteria decisions for spam
> causing false positives. I guess there's a human tendency to see a high
> probability and treat that as proof positive. (We all like to
> over-simplify things).
>
> I guess I failed to point out to "spankthespam" that using a 54 point
> score on a rule is quite unwise.
>
>
>
>
Oh, no, dont worry, I am not those people ;) I set it that high only for
testing purposes to be absolute sure that the plugin and the rule is
working, so I dont have to count all the points and wonder if my "-1" was
actually taken or not.
Beside the fact, I am using those two (relay country and uri country) to
"add" negative points for certain countries (like Poland where most of our
customers reside) rather than to add for all other world.
But the plugins are working now, it seems that it needs amavisd restart to
get new plugins, even if amavisd is calling spamassassin each time the
message comes in.
Thanks a lot for your help.
P.S. Is there any plugin and/or rule that could help me checking if the
sender and recipient addressess were added in RFC - way, that is in <>
brackets and add some points if not?
--
View this message in context: http://www.nabble.com/URICountry-not-working---any-clue--tf4785757.html#a13730770
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: URICountry not working - any clue?
Posted by Byung-Hee HWANG <bh...@izb.knu.ac.kr>.
hi,
On Tue, 2007-11-13 at 08:04 -0500, Matt Kettler wrote:
> Byung-Hee HWANG wrote:
> > hi,
> >
> > On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
> >
> >> Hi
> >>
> >> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
> >> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
> >> local.cf:
> >>
> > [...]
> >
> > well, imho, its using is not fair to over the world. because there
> > regarding spam country may/might be a little bit pure email users. we
> > can use another way instead of the dangerous way. i would like to here
> > some opinion about that..
> >
> >
>
> Uricountry, relaycountry, etc are all quite useful, but I agree their
> use must be reasonably tempered.
>
> I strongly disagree with using either of these systems to assign more
> than half your spam threshold to any message. Country of origin or
> hosting site alone is not a very good sole criteria for declaring a
> message to be spam.
>
> However, in my case I do receive a few nonspam messages from Korea each
> year, like this message for example, and all are quite clearly nonspam
> and technical in nature... I also receive around a thousand spam
> messages that were sent from infected hosts in Korea each year (mostly
> controlled by American spammers). As a result, I assign 1.5 points (of a
> 5.0 threshold) to messages delivered to my network from Korea. This
> helps catch some of the more evasive spam, but I also have yet to have
> it cause a single false positive on a nonspam message. (Your message
> would have totaled 1.5/5.0 if it was sent directly, as it caught no
> other positive scoring rules)
>
> This is even more true for web hosting. There's no reason an american
> company can't have a website hosted overseas. So many of their products
> are made there, so why shouldn't the websites be hosted there?
>
> Unfortunately, like any rule, there's a lot of admins out there who
> think in absolutes, and assign absurd scores to rules. This is, of
> course, highly contrary to the whole design of SpamAssassin, which
> exists because Justin got tired of single-criteria decisions for spam
> causing false positives. I guess there's a human tendency to see a high
> probability and treat that as proof positive. (We all like to
> over-simplify things).
>
> I guess I failed to point out to "spankthespam" that using a 54 point
> score on a rule is quite unwise.
your opinion is resonable, thanks!
respect,
bh
--
"Why do they bother your father with business on a day like this?"
"Because they know that by tradition no Sicilian can refuse a request on his
daughter's wedding day."
-- Kay Adams and Michael Corleone, "Chapter 1", page 26-27
Re: URICountry not working - any clue?
Posted by Matt Kettler <mk...@verizon.net>.
Byung-Hee HWANG wrote:
> hi,
>
> On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
>
>> Hi
>>
>> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
>> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
>> local.cf:
>>
> [...]
>
> well, imho, its using is not fair to over the world. because there
> regarding spam country may/might be a little bit pure email users. we
> can use another way instead of the dangerous way. i would like to here
> some opinion about that..
>
>
Uricountry, relaycountry, etc are all quite useful, but I agree their
use must be reasonably tempered.
I strongly disagree with using either of these systems to assign more
than half your spam threshold to any message. Country of origin or
hosting site alone is not a very good sole criteria for declaring a
message to be spam.
However, in my case I do receive a few nonspam messages from Korea each
year, like this message for example, and all are quite clearly nonspam
and technical in nature... I also receive around a thousand spam
messages that were sent from infected hosts in Korea each year (mostly
controlled by American spammers). As a result, I assign 1.5 points (of a
5.0 threshold) to messages delivered to my network from Korea. This
helps catch some of the more evasive spam, but I also have yet to have
it cause a single false positive on a nonspam message. (Your message
would have totaled 1.5/5.0 if it was sent directly, as it caught no
other positive scoring rules)
This is even more true for web hosting. There's no reason an american
company can't have a website hosted overseas. So many of their products
are made there, so why shouldn't the websites be hosted there?
Unfortunately, like any rule, there's a lot of admins out there who
think in absolutes, and assign absurd scores to rules. This is, of
course, highly contrary to the whole design of SpamAssassin, which
exists because Justin got tired of single-criteria decisions for spam
causing false positives. I guess there's a human tendency to see a high
probability and treat that as proof positive. (We all like to
over-simplify things).
I guess I failed to point out to "spankthespam" that using a 54 point
score on a rule is quite unwise.
Re: URICountry not working - any clue?
Posted by Byung-Hee HWANG <bh...@izb.knu.ac.kr>.
hi,
On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
> Hi
>
> I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
> amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
> local.cf:
[...]
well, imho, its using is not fair to over the world. because there
regarding spam country may/might be a little bit pure email users. we
can use another way instead of the dangerous way. i would like to here
some opinion about that..
respect,
bh
--
"If by some misfortune an honest man like yourself made enemies they would
become my enemies and then, believe me, they would fear you."
"Be my friend. I accept."
-- Vito Corleone and Amerigo Bonasera, "Chapter 1", page 32-33
RE: URICountry not working - any clue?
Posted by SpankTheSpam <sp...@gmail.com>.
>
>Try adding this to local.cf:
>add_header all Relay-Country _RELAYCOUNTRY_
>
What sould it do? I have added it, and it does not add any headers to
messages, nor makes URICountry working...
--
View this message in context: http://www.nabble.com/URICountry-not-working---any-clue--tf4785757.html#a13691272
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: URICountry not working - any clue?
Posted by Matt Kettler <mk...@verizon.net>.
Michael Scheidell wrote:
> We had a similar issue, don't know if it was resolved.
> (but since this might be an amavisd-new issue, try the amavisd-new mail
> group)
>
> Try adding this to local.cf:
> add_header all Relay-Country _RELAYCOUNTRY_
>
>
That's got to do with the RelayCountry plugin, which is completely
different from the URICountry plugin. One looks at Relays, the other at
URI's.
RE: URICountry not working - any clue?
Posted by Michael Scheidell <sc...@secnap.net>.
We had a similar issue, don't know if it was resolved.
(but since this might be an amavisd-new issue, try the amavisd-new mail
group)
Try adding this to local.cf:
add_header all Relay-Country _RELAYCOUNTRY_
--
Michael Scheidell, CTO
Office: 561-999-5000 x 1259
Direct: 561-939-7259
Real time security alerts: http://www.secnap.com/news
_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_________________________________________________________________________