Discuss April 2004

discuss@lists.surbl.org

60 participants
132 discussions

Error with the new Spamcop URI rule file
by Chris 23 Apr '04

23 Apr '04

Came home to the below errors today in my log. This is after I removed the # comment # spamcop_uri_resolve_open_redirects 1 Security Violations =-=-=-=-=-=-=-=-=-= Apr 22 15:47:09 chris spamd[19353]: Failed to run SPAMCOP_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/SpamCopURI.pm line 116, <GEN83> line 117. ) Apr 22 15:47:09 chris spamd[19353]: Failed to run WS_URI_RBL SpamAssassin test, skipping: ^I(Modification of non-creatable array value attempted, subscript -1 at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/SpamCopURI.pm line 116, <GEN83> line 117. ) Any ideas anyone? Chris -- Regards Chris A 100% Microsoft free computer Registered Linux User 283774 http://counter.li.org 7:18pm up 16 days, 1:54, 2 users, load average: 0.41, 0.48, 0.46

4 6

RE: [SURBL-Discuss] BigEvil + MidEvil as SURBL
by Chris Santerre 23 Apr '04

23 Apr '04

> -----Original Message----- > From: John Wilcock [mailto:john@tradoc.fr] > Sent: Thursday, April 22, 2004 2:26 AM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] BigEvil + MidEvil as SURBL > > > On Wed, 21 Apr 2004 14:49:51 -0700, Jeff Chan wrote: > > >> > 1) BigEvil wildcards. Not sure how you would handle these. > > >> Something like > > >> > evil\d{2,4}spam\.com is a general wildcard. Some of those > > >> domains don't even > > >> > exhist. Not sure how SURBL will handle that. > > >> > > >> Yes, I should have mentioned that I'm simply discarding them. > > >> Unfortunately there's no easy way to deal with them. Domains > > >> without any patterns in them, which are a majority, come right > > >> through. The script is at: > > > > > Can we make sure that when you announce this to the > public that they know > > > this! :) > > > I can see the flurry of emails now. > > > > Definitely will mention the differences in the announcement and > > web site! > > Perhaps the ideal would be if the script that converts bigevil to rbl > form could also generate a separate "wildevil" cf file containing only > the wildcard entries from bigevil, so that people can have the best of > both worlds... > > John. Hold off on the wilcard idea for now. Let me figure out with the other guys what we are doing. A few ideas in the mix. But I would let wildcards stay as a regex file. It is crazy to try to lookup things like /\dmeds\d{2,6}\.(?:com|net|biz)/ , that would take a looong time to do just that one! --Chris

3 2

MIMEDefang
by Justin 23 Apr '04

23 Apr '04

Howdy. Can anyone tell me if the SpamCopURI can be used with MIMEDefang. Ie, not running spamd but instead loading the SA perl stuff into memory at launch? spamd isn't going to be an option for me any more so I'm hoping it's possible to use SpamCopURI with MD. Thanks Justin

1 0

And away we go!
by Doc Schneider 22 Apr '04

22 Apr '04

Just wanted to let you all know I now have ws/be/sc all being parsed with the URI plugin. I'll be sure to let you all know how it works. spamassassin -D --lint had no errors so should be ok. -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

5 6

[SURBL-Discuss] Make test error with Mail-SpamAssassin-SpamCopURI-0.12
by RW Hawkins 22 Apr '04

22 Apr '04

I am trying to get the SpamCopURI working with our Spamassassin setup. I think this approach to spam smashing is very promising, great work! The error I get is as follows: [root@mail-in Mail-SpamAssassin-SpamCopURI-0.12]# perl Makefile.PL Checking if your kit is complete... Looks good Writing Makefile for Mail::SpamAssassin::SpamCopURI [root@mail-in Mail-SpamAssassin-SpamCopURI-0.12]# make mkdir blib mkdir blib/lib mkdir blib/lib/Mail mkdir blib/lib/Mail/SpamAssassin mkdir blib/arch mkdir blib/arch/auto mkdir blib/arch/auto/Mail mkdir blib/arch/auto/Mail/SpamAssassin mkdir blib/arch/auto/Mail/SpamAssassin/SpamCopURI mkdir blib/lib/auto mkdir blib/lib/auto/Mail mkdir blib/lib/auto/Mail/SpamAssassin mkdir blib/lib/auto/Mail/SpamAssassin/SpamCopURI mkdir blib/man3 cp lib/Mail/SpamAssassin/PerMsgStatus.pm blib/lib/Mail/SpamAssassin/PerMsgStatus.pm cp lib/Mail/SpamAssassin/SpamCopURI.pm blib/lib/Mail/SpamAssassin/SpamCopURI.pm cp lib/Mail/SpamAssassin/Conf.pm blib/lib/Mail/SpamAssassin/Conf.pm Manifying blib/man3/Mail::SpamAssassin::PerMsgStatus.3 Manifying blib/man3/Mail::SpamAssassin::SpamCopURI.3 Manifying blib/man3/Mail::SpamAssassin::Conf.3 [root@mail-in Mail-SpamAssassin-SpamCopURI-0.12]# make test PERL_DL_NONLAZY=1 /usr/local/bin/perl -Iblib/arch -Iblib/lib -I/usr/lib/perl5/5.00503/i386-linux -I/usr/lib/perl5/5.00503 -e 'use Test::Harness qw(&runtests $verbose); $verbose=0; runtests @ARGV;' t/*.t t/blacklist.........syntax error at blib/lib/Mail/SpamAssassin/SpamCopURI.pm line 107, near "$f :" BEGIN failed--compilation aborted at t/blacklist.t line 4. # No tests run! dubious Test returned status 255 (wstat 65280, 0xff00) Undefined subroutine &Test::Harness::WCOREDUMP called at /usr/lib/perl5/5.00503/Test/Harness.pm line 288. make: *** [test_dynamic] Error 255 From past user errors I am guessing I have something out of date, but not sure exactly what. Thanks in advance, RW

3 5

RE: [SURBL-Discuss] And away we go!
by Chris Santerre 22 Apr '04

22 Apr '04

> -----Original Message----- > From: Doc Schneider [mailto:maddoc@maddoc.net] > Sent: Thursday, April 22, 2004 11:51 AM > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] And away we go! > > > Chris Santerre wrote: > >>-----Original Message----- > >>From: David Coulson [mailto:david@davidcoulson.net] > >>Sent: Thursday, April 22, 2004 9:38 AM > >>To: SURBL Discussion list > >>Subject: Re: [SURBL-Discuss] And away we go! > >> > >> > >>SpamCopURI stats for one domain here for this morning. > >> > >>Total: 33024 > >>SC 22090 > >>WS 19029 > >>BE 3597 > >> > >>On a similar note, Spamhaus' XBL got hit 23847 times which > is pretty > >>impressive. > >> > >>David > >> > > > > > > And BE will ALWAYS be lower...Why? I use RBLs at the MTA level :) > > > > I knew it would effect my file, but I couldn't let the > company take a hit > > for BigEvil sake. > > I left bigevil.cf in my spamassassin directory and added the RBL for > be.surbl.org and both are catching things!! > > Maybe a suggestion. Might want to make a limited bigevil > which just does > the variable domains. And then folks can use it along with > the RBL be. > Did that make sense? You took the thoughts right out of my noggin! > > Damn I either need a new unix sleep command or more coffee! 8*)) I have a thermos by my monitor at all times. A pot takes to long to brew. A thermos is instant ;) > > I'll run some stats from my test here in a bit and we shall > see what is > what. > > Chris as always you are a "big nerd" HAR! > Oh yeah! Straight C student! And I went to school for none of this stuff. > -Doc (Who has been a nerd for almost half a century!) Ouch! You should take a nap after reading this ;) --Chris

1 0

RE: [SURBL-Discuss] BigEvil + MidEvil as SURBL
by Chris Santerre 22 Apr '04

22 Apr '04

> -----Original Message----- > From: Simon Byrnand [mailto:simon@igrin.co.nz] > Sent: Wednesday, April 21, 2004 6:16 PM > To: Jeff Chan; SURBL Discussion list > Subject: Re: [SURBL-Discuss] BigEvil + MidEvil as SURBL > > > At 09:49 22/04/2004, you wrote: > > > >> > 1) BigEvil wildcards. Not sure how you would handle these. > > >> Something like > > >> > evil\d{2,4}spam\.com is a general wildcard. Some of those > > >> domains don't even > > >> > exhist. Not sure how SURBL will handle that. > > >> > > >> Yes, I should have mentioned that I'm simply discarding them. > > >> Unfortunately there's no easy way to deal with them. Domains > > >> without any patterns in them, which are a majority, come right > > >> through. The script is at: > > > > > Can we make sure that when you announce this to the > public that they know > > > this! :) > > > I can see the flurry of emails now. > > Right near the top of > http://spamcheck.freeapp.net/bigevil.domains.afterwhitelist there is > 123-ebiz - is that a mistake or parsing error ? > Dang it! Thanks. Removed for tomorrow. --Chris

1 0

All three! Sorry it is rather long.
by Doc Schneider 22 Apr '04

22 Apr '04

X-Spam-Status: Yes, hits=26.7 required=5.0 tests=BE_URI_RBL,BigEvilList_148, BigEvilList_156,CLICK_BELOW,DATE_IN_FUTURE_03_06,EvilNumber_A_5XX_1, HTML_COMMENT_SAVED_URL,HTML_IMAGE_ONLY_04,HTML_IMAGE_RATIO_04, HTML_LINK_CLICK_HERE,HTML_MESSAGE,HTML_TITLE_UNTITLED, MAILTO_SUBJ_REMOVE,MAILTO_TO_REMOVE,MIME_HTML_ONLY, RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL,RCVD_IN_NJABL_SPAM,RCVD_IN_SBL, RCVD_IN_SORBS,WS_URI_RBL autolearn=no version=2.63 X-Spam-Report: * 2.0 EvilNumber_A_5XX_1 BODY: Phone number or address pulled from spam * 0.9 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area * 0.1 HTML_LINK_CLICK_HERE BODY: HTML link text says "click here" * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.8 HTML_COMMENT_SAVED_URL BODY: HTML message is a saved web page * 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 0.7 HTML_TITLE_UNTITLED BODY: HTML title contains "Untitled" * 1.5 HTML_IMAGE_ONLY_04 BODY: HTML: images with 200-400 bytes of words * 1.3 MAILTO_SUBJ_REMOVE BODY: mailto URI includes removal text * 3.0 WS_URI_RBL URI's domain appears in database at ws.surbl.org * [22.moosq.com is blacklisted in SpamCop RBL at] [ws.surbl.org] * 3.0 BE_URI_RBL URI's domain appears in database at be.surbl.org * [www.surveylocator.com is blacklisted in SpamCop] [RBL at be.surbl.org] * 3.0 BigEvilList_156 URI: Generated BigEvilList_156 * 3.0 BigEvilList_148 URI: Generated BigEvilList_148 * 0.0 MAILTO_TO_REMOVE URI: Includes a 'remove' email address * 2.8 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date * 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net * [Blocked - see <http://www.spamcop.net/bl.shtml?69.6.15.122>] * 1.3 RCVD_IN_SBL RBL: Received via a relay in Spamhaus Block List * [<http://www.spamhaus.org/SBL/sbl.lasso?query=SBL6636>] * 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS * [69.6.15.122 listed in dnsbl.sorbs.net] * 0.1 RCVD_IN_NJABL RBL: Received via a relay in dnsbl.njabl.org * [69.6.15.122 listed in dnsbl.njabl.org] * 0.6 RCVD_IN_NJABL_SPAM RBL: NJABL: sender is confirmed spam source * [69.6.15.122 listed in dnsbl.njabl.org] * 0.0 CLICK_BELOW Asks you to click below -- -Doc --- MomNDoc Online Consultants http://www.maddoc.net/ momndoc(a)maddoc.net

1 0

RE: [SURBL-Discuss] And away we go!
by Chris Santerre 22 Apr '04

22 Apr '04

> -----Original Message----- > From: David Coulson [mailto:david@davidcoulson.net] > Sent: Thursday, April 22, 2004 9:38 AM > To: SURBL Discussion list > Subject: Re: [SURBL-Discuss] And away we go! > > > SpamCopURI stats for one domain here for this morning. > > Total: 33024 > SC 22090 > WS 19029 > BE 3597 > > On a similar note, Spamhaus' XBL got hit 23847 times which is pretty > impressive. > > David > And BE will ALWAYS be lower...Why? I use RBLs at the MTA level :) I knew it would effect my file, but I couldn't let the company take a hit for BigEvil sake. --Chris

2 1

Trouble installing SpamCopURI
by Bo Stark 22 Apr '04

22 Apr '04

I get "Can't locate Mail/SpamAssassin.pm in @INC" error msg then I run perl Makefile.PL. Do I need root access? Because I don't have that. Also Im not running SpamAssassin as spamd. Is it possible to install anyway? b.

3 3

← Newer
1
2
3
4
5
6
7
8
...
14
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss April 2004