Discuss April 2004

discuss@lists.surbl.org

60 participants
132 discussions

Start a nNew thread

Test domains for ws.surbl.org
by ITReading ITReading 14 Apr '04

14 Apr '04

Is there a test record in ws.surbl.org? Thanks, Charles

2 1

Re: [SURBL-Discuss] What list does ws.surbl.org represent?
by William Stearns 13 Apr '04

13 Apr '04

Good morning, Charles, > >>> William Stearns <wstearns(a)pobox.com> 04/13/2004 9:39:49 AM >>> > Good day, > > On Tue, 13 Apr 2004, ITReading ITReading wrote: > > > I'm sure this has already been clarified, but I think I may not have > > joined the list when it was mentioned. Does ws.surbl.org reflect the > > contents of "sa-blacklist-uri.cf" or "sa-blacklist" or both? > > Both lists contain essentially the same domains, but check > different things. sa-blacklist.cf checks the sender domain, > sa-blacklist.uri.cf checks urls in the body of the mail. > So the ws.surbl.org really replaces the sa-blacklist.uri.cf. On Tue, 13 Apr 2004, Charles Solomon wrote: > Thanks William, > One more question. Since both lists contain the same domains, and this > list is now published at ws.surbl.org, couldn't I implement something > like the following in addition to the SpamCopURI to get the benefits of > SA-Blacklist in the FROM headers? > > header RCVD_IN_WSSURBL eval:check_rbl('ws.surbl.org', '127.0.0.2') > describe RCVD_IN_SORBS WS-SURBL: sender is listed in ws.surbl.org > tflags RCVD_IN_SORBS net I honestly don't know the answer to that. Does anyone know if that will successfully check the sender domain? Cheers, - Bill --------------------------------------------------------------------------- The woods are lovely, dark and deep. But I have promises to keep, and lines to code before I sleep, And lines to code before I sleep. -- Stephen Williams (Courtesy of Ben Woodard <bwoodard(a)cisco.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

2 1

RE: [SURBL-Discuss] SURBL test
by Kevin Hanser 13 Apr '04

13 Apr '04

-----Original Message----- From: Don Newcomer [mailto:newcomer@dickinson.edu] Sent: Tuesday, April 13, 2004 14:22 To: SURBL Discussion List Subject: [SURBL-Discuss] SURBL test I'm in the process of building SpamCopURI 0.09 on a Tru64 UNIX v5.1B box using Perl 5.8.3. The 'make test' phase failed on only one test: PERL_DL_NONLAZY=1 /usr/ucb/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........NOK 5# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay Don, Someone else posted on the MailScanner list a fix that got me past this problem. On line 25 of the dnsrbl.t file, change the IP address from 211.147.224.30 to 127.0.0.2. That seems to make the test complete properly... I think someone also said that it was fixed in the next version, but one of the developers should be able to confirm that... k

4 4

SURBL test
by Don Newcomer 13 Apr '04

13 Apr '04

I'm in the process of building SpamCopURI 0.09 on a Tru64 UNIX v5.1B box using Perl 5.8.3. The 'make test' phase failed on only one test: PERL_DL_NONLAZY=1 /usr/ucb/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/bad..............ok t/blacklist........ok t/cache............ok t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25) t/dnsrbl...........NOK 5# Looks like you failed 1 tests of 6. t/dnsrbl...........dubious Test returned status 1 (wstat 256, 0x100) DIED. FAILED test 5 Failed 1/6 tests, 83.33% okay t/good.............ok t/ipaddress........ok t/longhostname.....ok t/mailto...........ok t/merge_urls.......ok t/shorthostname....ok t/spamcop_fetch....ok t/spamcopuri.......ok t/whitelist........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/dnsrbl.t 1 256 6 1 16.67% 5 Failed 1/13 test scripts, 92.31% okay. 1/63 subtests failed, 98.41% okay. *** Exit 2 Stop. Given that the test at line 25 of t/dnsrbl.t goes to "http://211.147.224.30/baddy" and when I telnet to that address, port 80, it refuses my connection, can I safely assume that all went well and install the software? Thanks in advance. ================================================================================ Don Newcomer Dickinson College Senior Manager, Systems P.O. Box 1773 newcomer(a)dickinson.edu Carlisle, PA 17013 Phone: (717) 245-1256 FAX: (717) 245-1690

1 0

Re: [SURBL-Discuss] t/dnsrbl...........ok 4/6# Failed test (t/dnsrbl.t at line 25)
by Scott Truman 13 Apr '04

13 Apr '04

Hi, I too am getting the exact same errors. I eagerly await that fix. Cheers Scott

2 2

What list does ws.surbl.org represent?
by ITReading ITReading 13 Apr '04

13 Apr '04

I'm sure this has already been clarified, but I think I may not have joined the list when it was mentioned. Does ws.surbl.org reflect the contents of "sa-blacklist-uri.cf" or "sa-blacklist" or both? Thanks! Charles

3 2

Redirects and obfuscated urls
by John Fawcett 13 Apr '04

13 Apr '04

I saw a post on NANAE over the weekend about surbl and it looks like one of the best ideas I've seen. Almost every spam mail I get contains a spamvertized domain, so with good data this method has the potential to block nearly 100% of spam. Spamvertized domains are an essential resource for spammers and are usually longer lived then the abused servers used to send out spam runs. I've set up SpamAssassin and SpamCopURI. I've checked the emails which are not being picked up by surbl and there is a recurring pattern: 1) Redirects 2) Obfuscated urls For example, this was not picked up. <a href=http://drs.yahoo.com/higherillomened./mensuraltalk/*%68ttp://enginery.s hopinternetbuy.biz/%75n%73ub.html target=_blank> shopinternetbuy.biz is in sc.surbl.org. The logic of the parsing engine needs to be enhanced to deal with these cases. This is probably only the start, because spammers will find other ways to get around surbl once it starts being used widely. I'd offer to look at it, but I wouldn't know where to start with perl. John

2 3

DNS load on slartibartfast.pa.net
by William Stearns 13 Apr '04

13 Apr '04

Good evening, all, It's still early in the project, but a few quick observations. Using dnstop and tethereal, I've seen that in the last 24 hours we've had 570K DNS queries to slart, the 5th/6th nameserver for {sa,sc}.surbl.org. 84% of those - 475K queries - have been to surbl.org. The next closest was in-addr.arpa with 12K and 7500 or less for everything else (that "everything else" category includes being a primary or secondary for 130 other domains and the primary nameserver for 28 machines). Of that 475K, 400K were to sc.surbl.org and 43K to sa.surbl.org. I suppose the rest were to jeff.chan.rox.surbl.org. *smile* More recent nameserver stats show the RBL is hovering around 90.2% of the queries to that nameserver. Oh, and did I mention that the nameserver is running on one of 27 User-Mode Linux virtual machines (*) running on top of a dual 1.4Ghz P3? The host machine load runs from 3.0 - 5.0 (but 2 of that is from the distributed.net CPU sponge, so really the load is 1.0 - 3.0). It'll be interesting to see just how high the load goes as more people come on, especially when SA 3.0 comes out. *gulp* :-) Cheers, - Bill * http://66.59.109.137:1500 , http://www.stearns.org/slartibartfast/uml-coop.current.html --------------------------------------------------------------------------- "NT 5.0 is the last nail in the Unix coffin. Interestingly, Unix isn't in the coffin... It's wondering what the heck is sealing itself into a wooden box 6 feet underground..." (Courtesy of Jason McMullan <jmcc(a)grits.visus.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

5 6

Here it comes.
by William Stearns 13 Apr '04

13 Apr '04

Good afternoon, all, The slashdot effect is probably hammering surbl.org right now. Someone posted surbl.org to http://slashdot.org/ The slashdot comments aren't terribly positive - I have no problem with that. I figure I'll keep contributing as long as it continues to be useful. Cheers, - Bill --------------------------------------------------------------------------- "NT 5.0 is the last nail in the Unix coffin. Interestingly, Unix isn't in the coffin... It's wondering what the heck is sealing itself into a wooden box 6 feet underground..." (Courtesy of Jason McMullan <jmcc(a)grits.visus.com>) -------------------------------------------------------------------------- William Stearns (wstearns(a)pobox.com). Mason, Buildkernel, freedups, p0f, rsync-backup, ssh-keyinstall, dns-check, more at: http://www.stearns.org --------------------------------------------------------------------------

4 4

RFC: New name for sa.surbl.org
by Jeff Chan 13 Apr '04

13 Apr '04

OK Looks like someone (lol I'm nominated, I guess) needs to put his foot down and set a new name for sa.surbl.org, our RBL version of Bill Stearns' sa-blacklist SA ruleset. I suggested "sb", though that's slightly confusing with sc. Bill suggested ws or sb would work for him. Does anyone else have any comments or idea? We should change this soon before too many people start coding in "sa.surbl.org". Please comment if you have any. ;-) Thanks, Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

4 7

← Newer
1
...
8
9
10
11
12
13
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2004