Re: Spammed by Non-delivery-report? (someone is using my email to spam)

[Justin Mason <jm...@jmason.org>]

Bob Mortimer writes:
> On Friday 01 Sep 2006 10:23, Justin Mason wrote:
> 
> > There's also a very good ruleset I've been using for a while now, at
> >
> > http://svn.apache.org/repos/asf/spamassassin/rules/trunk/sandbox/jm/20_vbou
> >nce.cf
> >
> > It catches almost all my unwanted bounces.  Requires a little hand-editing
> > before it'll work, though, which is why it's not yet part of the default
> > distro (I hope to have that fixed for 3.2.0).
> 
> I'm getting loads of failed delivery reports mainly from joe-jobbed emails 
> purporting to have come from several of my domains so tried installing this. 
> I'm running SpamAssassin (3.1.7) via amavisd-new (2.4.3) on a Mandrake box.
> 
> I've checked the debug log and it seems to be loading the plugin OK:
> 
> [16989] dbg: config: using "/etc/mail/spamassassin" for site rules dir
> [16989] dbg: config: read file /etc/mail/spamassassin/20_vbounce.cf
> [16989] dbg: config: read file /etc/mail/spamassassin/local.cf
> 
> then I get:
> 
> [16989] dbg: plugin: fixed relative path: /etc/mail/spamassassin/VBounce.pm
> [16989] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce 
> from /etc/mail/spamassassin/VBounce.pm
> [16989] dbg: plugin: registered 
> Mail::SpamAssassin::Plugin::VBounce=HASH(0x8e433ec)
> 
> which again looks OK, but later I get:
> 
> [16989] dbg: rules: no method found for eval test have_any_bounce_relays
> rules: failed to run __HAVE_BOUNCE_RELAYS test, skipping:
>         (Can't locate object method "have_any_bounce_relays" via package 
> "Mail::SpamAssassin::PerMsgStatus" 
> at /usr/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/PerMsgStatus.pm line 
> 2638.)
> 
> Can anyone point me in the right direction please?

that sounds like the plugin .pm file didn't load correctly.
Can you check to ensure you have the most recent version (of both
.pm and .cf)?  And post the entire debug log of "spamassassin -D --lint"?

--j.

Re: Spammed by Non-delivery-report? (someone is using my email to spam)

[Bob Mortimer <Bo...@mortimer.nildram.co.uk>]

On Friday 13 Oct 2006 15:32, Justin Mason wrote:

> that sounds like the plugin .pm file didn't load correctly.
> Can you check to ensure you have the most recent version (of both
> .pm and .cf)?  And post the entire debug log of "spamassassin -D --lint"?

Thanks Justin, I only downloaded the .pm and .cf recently but ISTR I had to 
grub around a bit to find the .pm
 Debug log posted below:

[root@linux ]# spamassassin -D --lint
[19368] dbg: logger: adding facilities: all
[19368] dbg: logger: logging level is DBG
[19368] dbg: generic: SpamAssassin version 3.1.7
[19368] dbg: config: score set 0 chosen.
[19368] dbg: util: running in taint mode? yes
[19368] dbg: util: taint mode: deleting unsafe environment variables, 
resetting PATH
[19368] dbg: util: PATH included '/sbin', keeping
[19368] dbg: util: PATH included '/usr/sbin', keeping
[19368] dbg: util: PATH included '/bin', keeping
[19368] dbg: util: PATH included '/usr/bin', keeping
[19368] dbg: util: PATH included '/usr/X11R6/bin', keeping
[19368] dbg: util: PATH included '/usr/local/bin', keeping
[19368] dbg: util: PATH included '/usr/local/sbin', keeping
[19368] dbg: util: final PATH set 
to: /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin
[19368] dbg: message: ---- MIME PARSER START ----
[19368] dbg: message: main message type: text/plain
[19368] dbg: message: parsing normal part
[19368] dbg: message: added part, type: text/plain
[19368] dbg: message: ---- MIME PARSER END ----
[19368] dbg: dns: is Net::DNS::Resolver available? yes
[19368] dbg: dns: Net::DNS version: 0.52
[19368] dbg: diag: perl platform: 5.008007 linux
[19368] dbg: diag: module installed: Digest::SHA1, version 2.10
[19368] dbg: diag: module installed: MIME::Base64, version 3.05
[19368] dbg: diag: module installed: HTML::Parser, version 3.45
[19368] dbg: diag: module installed: DB_File, version 1.811
[19368] dbg: diag: module installed: Net::DNS, version 0.52
[19368] dbg: diag: module installed: Net::SMTP, version 2.29
[19368] dbg: diag: module installed: Mail::SPF::Query, version 1.997
[19368] dbg: diag: module installed: IP::Country::Fast, version 309.002
[19368] dbg: diag: module installed: Razor2::Client::Agent, version 2.77
[19368] dbg: diag: module not installed: Net::Ident ('require' failed)
[19368] dbg: diag: module not installed: IO::Socket::INET6 ('require' failed)
[19368] dbg: diag: module not installed: IO::Socket::SSL ('require' failed)
[19368] dbg: diag: module installed: Time::HiRes, version 1.68
[19368] dbg: diag: module installed: DBI, version 1.48
[19368] dbg: diag: module installed: Getopt::Long, version 2.34
[19368] dbg: diag: module installed: LWP::UserAgent, version 2.033
[19368] dbg: diag: module installed: HTTP::Date, version 1.46
[19368] dbg: diag: module installed: Archive::Tar, version 1.26
[19368] dbg: diag: module installed: IO::Zlib, version 1.04
[19368] dbg: ignore: using a test message to lint rules
[19368] dbg: config: using "/etc/mail/spamassassin" for site rules pre files
[19368] dbg: config: read file /etc/mail/spamassassin/init.pre
[19368] dbg: config: read file /etc/mail/spamassassin/v310.pre
[19368] dbg: config: read file /etc/mail/spamassassin/v312.pre
[19368] dbg: config: using "/usr/share/spamassassin" for sys rules pre files
[19368] dbg: config: using "/usr/share/spamassassin" for default rules dir
[19368] dbg: config: read file /usr/share/spamassassin/10_misc.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_advance_fee.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_anti_ratware.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_body_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_compensate.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_drugs.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_head_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_html_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_meta_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_net_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_phrases.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_porn.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_ratware.cf
[19368] dbg: config: read file /usr/share/spamassassin/20_uri_tests.cf
[19368] dbg: config: read file /usr/share/spamassassin/23_bayes.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_accessdb.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_antivirus.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_body_tests_es.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_body_tests_pl.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_dcc.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_dkim.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_domainkeys.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_hashcash.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_pyzor.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_razor2.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_replace.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_spf.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_textcat.cf
[19368] dbg: config: read file /usr/share/spamassassin/25_uribl.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_de.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_fr.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_it.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_nl.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_pl.cf
[19368] dbg: config: read file /usr/share/spamassassin/30_text_pt_br.cf
[19368] dbg: config: read file /usr/share/spamassassin/50_scores.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_awl.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_whitelist.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_whitelist_dk.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_whitelist_dkim.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_whitelist_spf.cf
[19368] dbg: config: read file /usr/share/spamassassin/60_whitelist_subject.cf
[19368] dbg: config: using "/etc/mail/spamassassin" for site rules dir
[19368] dbg: config: read file /etc/mail/spamassassin/20_vbounce.cf
[19368] dbg: config: read file /etc/mail/spamassassin/local.cf
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x81fdd6c)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x8fd3964)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::SPF=HASH(0x8ff6c18)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::DCC from @INC
[19368] dbg: dcc: local tests only, disabling DCC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::DCC=HASH(0x8fd6a48)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[19368] dbg: pyzor: local tests only, disabling Pyzor
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::Pyzor=HASH(0x8fd8d1c)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::Razor2 from @INC
[19368] dbg: razor2: local tests only, skipping Razor
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::Razor2=HASH(0x9067a7c)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[19368] dbg: reporter: local tests only, disabling SpamCop
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::SpamCop=HASH(0x906fd78)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::AWL=HASH(0x90962d0)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::AutoLearnThreshold 
from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0x90b0088)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::WhiteListSubject from 
@INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x901cb94)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x9200450)
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags from @INC
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x851fb3c)
[19368] dbg: config: adding redirector regex: /^http:
\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i
[19368] dbg: config: adding redirector regex: /^http:\/\/www(?:\d+)?
\.nate\.com\/r\/\w+\/(.*)$/i
[19368] dbg: config: adding redirector regex: /^http:\/\/.
+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i
[19368] dbg: config: adding redirector regex: /^http:
\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i
[19368] dbg: config: adding redirector regex: /^http:\/\/(?:.*?
\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i
[19368] dbg: config: adding redirector regex: 
m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&#])'i
[19368] dbg: config: adding redirector regex: m'^https?:/*(?:
[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i
[19368] dbg: config: adding redirector regex: m'/(?:index.php)?
\?.*(?<=[?&])URL=(.*?)(?:$|[&#])'i
[19368] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.
\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&#])'i
[19368] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.
\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])site:(.*?)(?:$|
%20|[\s+&#])'i
[19368] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.
\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:
$|%22|["\s+&#])'i
[19368] dbg: config: adding redirector regex: m'^http:/*(?:\w+\.)?google(?:\.
\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&#])'i
[19368] dbg: plugin: fixed relative path: /etc/mail/spamassassin/VBounce.pm
[19368] dbg: plugin: loading Mail::SpamAssassin::Plugin::VBounce 
from /etc/mail/spamassassin/VBounce.pm
[19368] dbg: plugin: registered 
Mail::SpamAssassin::Plugin::VBounce=HASH(0x901d608)
[19368] dbg: plugin: Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x851fb3c) 
implements 'finish_parsing_end'
[19368] dbg: replacetags: replacing tags
[19368] dbg: replacetags: done replacing tags
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_toks
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_seen
[19368] dbg: bayes: found bayes db version 3
[19368] dbg: bayes: DB journal sync: last sync: 0
[19368] dbg: bayes: not available for scanning, only 118 spam(s) in bayes DB < 
200
[19368] dbg: bayes: untie-ing
[19368] dbg: bayes: untie-ing db_toks
[19368] dbg: bayes: untie-ing db_seen
[19368] dbg: config: score set 0 chosen.
[19368] dbg: message: ---- MIME PARSER START ----
[19368] dbg: message: main message type: text/plain
[19368] dbg: message: parsing normal part
[19368] dbg: message: added part, type: text/plain
[19368] dbg: message: ---- MIME PARSER END ----
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_toks
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_seen
[19368] dbg: bayes: found bayes db version 3
[19368] dbg: bayes: DB journal sync: last sync: 0
[19368] dbg: bayes: not available for scanning, only 118 spam(s) in bayes DB < 
200
[19368] dbg: bayes: untie-ing
[19368] dbg: bayes: untie-ing db_toks
[19368] dbg: bayes: untie-ing db_seen
[19368] dbg: dns: is DNS available? 0
[19368] dbg: metadata: X-Spam-Relays-Trusted:
[19368] dbg: metadata: X-Spam-Relays-Untrusted:
[19368] dbg: metadata: X-Spam-Relays-Internal:
[19368] dbg: metadata: X-Spam-Relays-External:
[19368] dbg: message: no encoding detected
[19368] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x81fdd6c) 
implements 'parsed_metadata'
[19368] dbg: rules: local tests only, ignoring RBL eval
[19368] dbg: check: running tests for priority: 0
[19368] dbg: rules: running header regexp tests; score so far=0
[19368] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
[19368] dbg: rules: ran header rule __SANE_MSGID ======> got hit: 
"<11...@lint_rules>
[19368] dbg: rules: "
[19368] dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit: 
"@lint_rules>"
[19368] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit: 
"1160756125"
[19368] dbg: eval: all '*From' addrs: ignore@compiling.spamassassin.taint.org
[19368] dbg: eval: all '*To' addrs:
[19368] dbg: rules: ran eval rule NO_RELAYS ======> got hit
[19368] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit
[19368] dbg: rules: running body-text per-line regexp tests; score so 
far=-0.001
[19368] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"
[19368] dbg: uri: running uri tests; score so far=-0.001
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_toks
[19368] dbg: bayes: tie-ing to DB file R/O /root/.spamassassin/bayes_seen
[19368] dbg: bayes: found bayes db version 3
[19368] dbg: bayes: DB journal sync: last sync: 0
[19368] dbg: bayes: not available for scanning, only 118 spam(s) in bayes DB < 
200
[19368] dbg: bayes: not scoring message, returning undef
[19368] dbg: bayes: DB expiry: tokens in DB: 11325, Expiry max size: 150000, 
Oldest atime: 1128718040, Newest atime: 1129204568, Last expire: 0, Current 
time: 1160756127
[19368] dbg: bayes: DB journal sync: last sync: 0
[19368] dbg: bayes: untie-ing
[19368] dbg: bayes: untie-ing db_toks
[19368] dbg: bayes: untie-ing db_seen
[19368] dbg: rules: no method found for eval test have_any_bounce_relays
[19368] warn: rules: failed to run __HAVE_BOUNCE_RELAYS test, skipping:
[19368] warn:  (Can't locate object method "have_any_bounce_relays" via 
package "Mail::SpamAssassin::PerMsgStatus" 
at /usr/lib/perl5/site_perl/5.8.7/Mail/SpamAssassin/PerMsgStatus.pm line 
2638.
[19368] warn: )
[19368] dbg: rules: running raw-body-text per-line regexp tests; score so 
far=-0.001
[19368] dbg: rules: running full-text regexp tests; score so far=-0.001
[19368] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x81fdd6c) 
implements 'check_tick'
[19368] dbg: check: running tests for priority: 500
[19368] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x81fdd6c) 
implements 'check_post_dnsbl'
[19368] dbg: rules: running meta tests; score so far=-0.001
[19368] dbg: rules: running header regexp tests; score so far=1.866
[19368] dbg: rules: running body-text per-line regexp tests; score so 
far=1.866
[19368] dbg: uri: running uri tests; score so far=1.866
[19368] dbg: rules: running raw-body-text per-line regexp tests; score so 
far=1.866
[19368] dbg: rules: running full-text regexp tests; score so far=1.866
[19368] dbg: check: running tests for priority: 1000
[19368] dbg: rules: running meta tests; score so far=1.866
[19368] dbg: rules: running header regexp tests; score so far=1.866
[19368] dbg: rules: running body-text per-line regexp tests; score so 
far=1.866
[19368] dbg: uri: running uri tests; score so far=1.866
[19368] dbg: rules: running raw-body-text per-line regexp tests; score so 
far=1.866
[19368] dbg: rules: running full-text regexp tests; score so far=1.866
[19368] dbg: check: is spam? score=1.866 required=5
[19368] dbg: check: tests=MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS,TO_CC_NONE
[19368] dbg: check: 
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__UNUSABLE_MSGID
[19368] warn: lint: 1 issues detected, please rerun with debug enabled for 
more information


-- 
Regards,

Bob