You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Wo...@ebewe.com on 2004/10/20 08:00:34 UTC
How to get rid of messages like this
Who can help please ?
Wolfgang
----- Weitergeleitet von Wolfgang Fuertbauer/EBEWE/AT am 20.10.2004 08:00
-----
"kam perkins" <an...@mail.bulgaria.com>
19.10.2004 23:28
Bitte antworten an
"kam perkins" <an...@mail.bulgaria.com>
An
"Lorinda Mcdonald" <ce...@ebewe.com>
Kopie
Thema
We may be able to help you with your student loans.
Discover how to destroy your Card balances using a highly effective,
extremely simple, Card debt
For the rest of the story about destroying debt, visit us here
http://fo.WNeU.wealthproductmaker.com/e3/
Destroy card debt totally -- cancelled, terminated--legally.
no, then the link and address above
It is a marvel, remarked the President, thoughtfully. More! It is a real
miracle
We are living in an age of wonders, my young friend.
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: Re: Re: How to get rid of messages like this
Posted by Sahil Tandon <sa...@hamla.org>.
Quoting Wolfgang.Fuertbauer@ebewe.com:
> Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: domain
> "surbl-org-permanent-test-point.com" listed (URIBL_SC_SURBL): 127.0.0.2
It's working.
--
Sahil Tandon
Re: Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
auto-whitelisting turned off;
Oct 20 17:29:25 saxophon spamd[16359]: debug: uri found:
mailto:w.fuertbauer@eunet.at
Oct 20 17:29:25 saxophon spamd[16359]: debug: uri found:
mailto:fw@ebewe.com
Oct 20 17:29:25 saxophon spamd[16359]: debug: uri found: http://127.0.0.2/
Oct 20 17:29:25 saxophon spamd[16359]: debug: uri found:
http://surbl-org-permanent-test-point.com/
Oct 20 17:29:25 saxophon spamd[16359]: debug: URIDNSBL: domains to query:
eunet.at surbl-org-permanent-test-point.com 127.0.0.2 ebewe.com
Oct 20 17:29:25 saxophon spamd[16359]: debug: is Net::DNS::Resolver
available? yes
Oct 20 17:29:25 saxophon spamd[16359]: debug: Net::DNS version: 0.48
...
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: query for eunet.at
took 1 seconds to look up (multi.surbl.org.:eunet.at)
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: query for
ebewe.com took 1 seconds to look up (multi.surbl.org.:ebewe.com)
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: domain
"surbl-org-permanent-test-point.com" listed (URIBL_SC_SURBL): 127.0.0.2
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: query for
surbl-org-permanent-test-point.com took 1 seconds to look up
(multi.surbl.org.:surbl-org-permanent-test-point.com)
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: queries completed:
6 started: 4
Oct 20 17:29:26 saxophon spamd[16359]: debug: URIDNSBL: queries active: at
Wed Oct 20 17:29:26 2004
Sahil Tandon <sa...@hamla.org> schrieb am 20.10.2004 15:43:01:
> Quoting Wolfgang.Fuertbauer@ebewe.com:
> [debug output]
> > What's wrong ? Please help
> Show more debug info. Does spamd at least hit multi.surbl.org? Also,
turn on
> SA header tagging for *all* emails (set the threshold to -999), and
> see if your
> test messages are coming from an auto-whitelisted source. I had the
same
> problem.
> --
> Sahil Tandon
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: Re: How to get rid of messages like this
Posted by Sahil Tandon <sa...@hamla.org>.
Quoting Wolfgang.Fuertbauer@ebewe.com:
[debug output]
> What's wrong ? Please help
Show more debug info. Does spamd at least hit multi.surbl.org? Also, turn on
SA header tagging for *all* emails (set the threshold to -999), and see if your
test messages are coming from an auto-whitelisted source. I had the same
problem.
--
Sahil Tandon
Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
spamd running without -L or --locale
sample debug output:
Oct 20 13:21:39 saxophon spamd[3697]: debug: decoding: no encoding
detected
Oct 20 13:21:39 saxophon spamd[3697]: debug: URIDNSBL: domains to query:
Oct 20 13:21:39 saxophon spamd[3697]: debug: is Net::DNS::Resolver
available? yes
Oct 20 13:21:39 saxophon spamd[3697]: debug: Net::DNS version: 0.48
What's wrong ? Please help
Wolfgang
Jeff Chan <je...@surbl.org> schrieb am 20.10.2004 12:41:01:
> On Wednesday, October 20, 2004, 3:35:18 AM, Wolfgang Fuertbauer wrote:
> > UAAH; I misunderstood
> > both coming trough! not dedected as spam
> Then there's probably something wrong with your SpamAssassin
> installation. Are your other network tests working? Here
> are some things you can check:
> http://www.surbl.org/faq.html#nettest
> If you recently added SURBL support to SpamAssassin but are not
> seeing any SURBL (or other RBL hits), check that you have enabled
> network tests.
> For example, if you're using spamd, make sure it's started
> without the -L or --local flags, which force local tests only.
> If you are running Amavis, make sure amavisd.conf has
> $sa_local_tests_only = 0. (Uncomment this line if it was
> commented out before, then set the value to zero to enable
> network tests.)
> If you are using MIMEDefang, make sure you set $SALocalTestsOnly
> to zero:
> # If boolean true, skip SA network tests
> $SALocalTestsOnly = 0;
>
> to enable SpamAssassin network tests from your mimedefang-filter.
> Jeff C.
> --
> Jeff Chan
> mailto:jeffc@surbl.org
> http://www.surbl.org/
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: How to get rid of messages like this
Posted by Jeff Chan <je...@surbl.org>.
On Wednesday, October 20, 2004, 3:35:18 AM, Wolfgang Fuertbauer wrote:
> UAAH; I misunderstood
> both coming trough! not dedected as spam
Then there's probably something wrong with your SpamAssassin
installation. Are your other network tests working? Here
are some things you can check:
http://www.surbl.org/faq.html#nettest
If you recently added SURBL support to SpamAssassin but are not
seeing any SURBL (or other RBL hits), check that you have enabled
network tests.
For example, if you're using spamd, make sure it's started
without the -L or --local flags, which force local tests only.
If you are running Amavis, make sure amavisd.conf has
$sa_local_tests_only = 0. (Uncomment this line if it was
commented out before, then set the value to zero to enable
network tests.)
If you are using MIMEDefang, make sure you set $SALocalTestsOnly
to zero:
# If boolean true, skip SA network tests
$SALocalTestsOnly = 0;
to enable SpamAssassin network tests from your mimedefang-filter.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
UAAH; I misunderstood
both coming trough! not dedected as spam
Wolfgang
Jeff Chan <je...@surbl.org> schrieb am 20.10.2004 10:58:42:
> Please send yourself a message with:
> http://surbl-org-permanent-test-point-MUNGED.com/
> or:
> http://127.0.0.2-MUNGED/
> in the body of the message, and with -MUNGED removed.
> These are to test the URI detection and processing
> of your SpamAssassin, not for browsing. ;-)
> Jeff C.
> --
> Jeff Chan
> mailto:jeffc@surbl.org
> http://www.surbl.org/
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: How to get rid of messages like this
Posted by Jeff Chan <je...@surbl.org>.
Please send yourself a message with:
http://surbl-org-permanent-test-point-MUNGED.com/
or:
http://127.0.0.2-MUNGED/
in the body of the message, and with -MUNGED removed.
These are to test the URI detection and processing
of your SpamAssassin, not for browsing. ;-)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Re: Re: How to get rid of messages like this
Posted by "Adam D. Barratt" <sp...@adam-barratt.org.uk>.
On Wednesday, October 20, 2004 10:09 AM, Wolfgang.Fuertbauer@ebewe.com
<Wo...@ebewe.com> wrote:
> "Loren Wilton" <lw...@earthlink.net> schrieb am 20.10.2004 11:05:56:
>
>>>> If you send yourself a message with:
>>>> http://surbl-org-permanent-test-point-MUNGED.com/
[...]
>> Remove the "-MUNGED" from the URL above.
>
> http://surbl-org-permanent-test-point.com/
> same result: Message from browser: ... could not be found. Please
> check the name ....
*Don't* try to open them in a browser. Put the URLs in the body of an
e-mail, and send it to yourself.
hth
Adam
Re: Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
"Loren Wilton" <lw...@earthlink.net> schrieb am 20.10.2004 11:05:56:
> > > If you send yourself a message with:
> > > http://surbl-org-permanent-test-point-MUNGED.com/
> > Message from browser:
> > ... could not be found. Please check the name ....
> >
> > > or:
> > > http://127.0.0.2-MUNGED/
> >
> > detto
> >
> > confusion ;)
> Remove the "-MUNGED" from the URL above.
http://surbl-org-permanent-test-point.com/
same result: Message from browser: ... could not be found. Please check
the name ....
http://127.0.0.2
nothing (blank page)
is something wrong with my SURBL setup ?
Wolfgang
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: Re: How to get rid of messages like this
Posted by Loren Wilton <lw...@earthlink.net>.
> > If you send yourself a message with:
> > http://surbl-org-permanent-test-point-MUNGED.com/
> Message from browser:
> ... could not be found. Please check the name ....
>
> > or:
> > http://127.0.0.2-MUNGED/
>
> detto
>
> confusion ;)
Remove the "-MUNGED" from the URL above.
Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
Jeff Chan <je...@surbl.org> schrieb am 20.10.2004 09:16:03:
> On Tuesday, October 19, 2004, 11:58:25 PM, Wolfgang Fuertbauer wrote:
> > this IS from SA 3.0
> >>spamassassin --version
> >>SpamAssassin version 3.0.0
> >> running on Perl version
> Make sure you have a recent Net::DNS installed.
Net::DNS 0.48
cpan> install Net::DNS
Net::DNS is up to date.
> If you send yourself a message with:
> http://surbl-org-permanent-test-point-MUNGED.com/
Message from browser:
... could not be found. Please check the name ....
> or:
> http://127.0.0.2-MUNGED/
detto
confusion ;)
Wolfgang
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: How to get rid of messages like this
Posted by Jeff Chan <je...@surbl.org>.
On Tuesday, October 19, 2004, 11:58:25 PM, Wolfgang Fuertbauer wrote:
> this IS from SA 3.0
>>spamassassin --version
>>SpamAssassin version 3.0.0
>> running on Perl version
Make sure you have a recent Net::DNS installed.
If you send yourself a message with:
http://surbl-org-permanent-test-point-MUNGED.com/
or:
http://127.0.0.2-MUNGED/
without the "-MUNGED"s, do you see SURBL and SBL scores?
If not, your SA 3.0 installation may not be quite right....
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Re: How to get rid of messages like this
Posted by Wo...@ebewe.com.
Jeff
this IS from SA 3.0
>spamassassin --version
>SpamAssassin version 3.0.0
> running on Perl version
here is my conf:
##----------------------------------
## general-Options
##----------------------------------
trusted_networks 172.16/16
razor_config /home/exim/.razor/razor-agent.conf
use_dcc 1
dcc_path /usr/sbin/dccproc
use_pyzor 1
pyzor_path /usr/bin/pyzor
use_bayes 1
auto_learn 1
use_auto_whitelist 1
#
use_hashcash 1
# don't change to text/plain
defang_mime 0
# these language-codes are OK
# ok_locales en ru zh
ok_locales all
#
# auto-whitelist
#
auto_whitelist_path ~/.spamassassin/auto-whitelist
auto_whitelist_file_mode 0666
##----------------------------------
## EBEWE Scores
##----------------------------------
score HABEAS_SWE -2.0
Jeff Chan <je...@surbl.org> schrieb am 20.10.2004 08:51:52:
> On Tuesday, October 19, 2004, 11:29:17 PM, Loren Wilton wrote:
> > Some of the SARE rules should handle that sort of spam. SURBL would
> > probably have caught the sender.
> > Loren
> wealthproductmaker.com is on SURBL lists WS and JP. The message
> would have been tagged based on that domain in message body URIs.
> (I assume that's what Loren meant and not "sender", since SURBLs
> are not intended to be used on headers.)
> This is also (annoyingly) indicated in the headers of Wolfgang's
> message, since ASF sees fit to process the SA mailing list
> messages using SpamAssassin, which of course is an absurd policy:
> > X-ASF-Spam-Status: No, hits=1.4 required=10.0
> > tests=NO_REAL_NAME,SPF_HELO_PASS,SPF_PASS,URIBL_SBL,URIBL_WS_SURBL
> Looks like the domain also resolves to a name server in
> sbl.spamhaus.org, which means SpamAssassin 3.0 would also
> tag it with uridnsbl in the rule called URIBL_SBL.
> Wolfgang, if you use SpamAssassin 3.0, it will catch these.
> Jeff C.
> --
> Jeff Chan
> mailto:jeffc@surbl.org
> http://www.surbl.org/
----------------------------------------------------------------------
Wolfgang Fuertbauer (E-Mail: Wolfgang.Fuertbauer@ebewe.com)
EBEWE Pharma Tel: ++43 7665 8123 315
Mondseestrasse 11 Fax: ++43 7665 8123 11
4866 Unterach, Austria
http://www.ebewe.com
Re: How to get rid of messages like this
Posted by Jeff Chan <je...@surbl.org>.
On Tuesday, October 19, 2004, 11:29:17 PM, Loren Wilton wrote:
> Some of the SARE rules should handle that sort of spam. SURBL would
> probably have caught the sender.
> Loren
wealthproductmaker.com is on SURBL lists WS and JP. The message
would have been tagged based on that domain in message body URIs.
(I assume that's what Loren meant and not "sender", since SURBLs
are not intended to be used on headers.)
This is also (annoyingly) indicated in the headers of Wolfgang's
message, since ASF sees fit to process the SA mailing list
messages using SpamAssassin, which of course is an absurd policy:
> X-ASF-Spam-Status: No, hits=1.4 required=10.0
> tests=NO_REAL_NAME,SPF_HELO_PASS,SPF_PASS,URIBL_SBL,URIBL_WS_SURBL
Looks like the domain also resolves to a name server in
sbl.spamhaus.org, which means SpamAssassin 3.0 would also
tag it with uridnsbl in the rule called URIBL_SBL.
Wolfgang, if you use SpamAssassin 3.0, it will catch these.
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: How to get rid of messages like this
Posted by Loren Wilton <lw...@earthlink.net>.
Some of the SARE rules should handle that sort of spam. SURBL would
probably have caught the sender.
Loren