Discuss

discuss@lists.surbl.org

1862 discussions

Is spamd broken?
by John Andersen 03 Jun '04

03 Jun '04

Folks here probably remember me whining about never once seeing a surbl hit in my spam even after wadeing thru hundreds of spams. Several users gave me hints which I dutifully carried out (thanks guys). John Fawcett even sent me a spammer's web URI that was guarenteed to trigger the Spamcop URI code and it did when fired off manually with a command line like /usr/bin/spamassassin -D -t < message-file > output-file 2>&1 BUT STILL no Surbl hits. Just as a lark I remove the spamd line from my procmailrc and replaced it with /usr/bin/spamassassin -a AND IT WORKS? So, what's wrong with spamd? Is it not capable of handling anything but the basic rules? -- _____________________________________ John Andersen

2 1

Re: SURBL and hitpoints
by Jeff Chan 02 Jun '04

02 Jun '04

On Wednesday, June 2, 2004, 4:55:29 AM, Martin Lyberg wrote: > Lucas Albers wrote: >> My average score on spam increased signifigantly. >> I'll have to enable redirector checks because many spammers are now using >> redirectors. > Does anybody know why this isn't enabled by default? Is the > redirector-list accurate or should i add/remove anything from the list? > Will the cpu-load increase significant? Yes, the redirection checks are disabled by default to save some resources like CPU and network traffic. If your message volume isn't too large then you can probably enable it. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

rbldnsd is not responding
by Ricardo 02 Jun '04

02 Jun '04

Dear list, Help! We are trying to setup a local rbldnsd with rsynced data to answer the DNS queries, but the rbldnsd is not responding. I started it manually with this command: % /usr/local/sbin/rbldnsd -u rbldns -b 127.0.0.1/53 -w /usr/local/etc/rbldnsd sc.surbl.org:dnset:sc.surbl.org.rbldnsd ws.surbl.org:dnset:ws.surbl.org.rbldnsd It started with no errors, and with an expected output (as seen on http://www.surbl.org/rbldnsd-howto.html): rbldnsd: listening on 127.0.0.1/53 rbldnsd: dnset:sc.surbl.org.rbldnsd: 20040602 131207: e/w=504/0 rbldnsd: dnset:ws.surbl.org.rbldnsd: 20040602 131208: e/w=12297/0 rbldnsd: zones reloaded, time 0.2e/0.0u sec rbldnsd: rbldnsd version 0.992 (7 Mar 2004) started (1 socket(s), 2 zone(s)) If I test our cached DNS system: % nslookup adulteroticfiction-MUNGED.com.sc.surbl.org 127.0.0.1 *** Can't find server name for address 127.0.0.1: Query refused *** Default servers are not available If I use the default DNS, of course it works: % nslookup adulteroticfiction-MUNGED.com.sc.surbl.org Server: server4.mpc.com.br Address: 200.246.0.252 Name: adulteroticfiction-MUNGED.com.sc.surbl.org Address: 127.0.0.2 There's no other DNS on the machine, nor errors on /var/log/messages. I also tried to use the FreeBSD version of the startup script. This are the versions of the softwares: - FreeBSD 4.9-RELEASE-p3 - rbl dns daemon version 0.992 (7 Mar 2004) Any hints to solve this will be greatly appreciated! []s! -- ... Press any key to continue or any other key to quit.

2 1

Rsync request
by Ricardo 31 May '04

31 May '04

Hi list! :) I'd like to know if is normal to have a certain delay in a response after request for a rsync using http://www.surbl.org/rsync-signup.html I did it on 05/24, if I'm not mistaken... []s! -- ... No Mice were harmed in the creation of this message. Two dogs got sick, and a cat ran away. But no mice were harmed.

3 2

SV: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make test e rror
by Martin Lyberg 31 May '04

31 May '04

Hi Eric, Thanks for all help, that seem to solve my problem. SPAMCOP_URI is now installed and im getting loads of hit on the SURBL-lists :) Thank you! / Martin : -----Ursprungligt meddelande----- : Från: Eric Kolve [mailto:ekolve@comcast.net] : Skickat: den 28 maj 2004 01:20 : Till: Martin Lyberg : Kopia: 'SURBL Discussion list ' : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - : Make test e rror : : : On Thu, May 27, 2004 at 10:09:14PM +0200, Martin Lyberg wrote: : > Hi Eric, : > : > That is correct, if this is the message you mean? : > : > perl Makefile.PL : > # SAPATH /usr/lib/perl5/site_perl/5.8.0 : > # installsitelib /usr/lib/perl5/site_perl/5.8.0 : > # INSTALLDIRS site : > Warning: prerequisite URI 1.28 not found. We have 1.21. : > Writing Makefile for Mail::SpamAssassin::SpamCopURI : > : > Which URI package do i need to download through CPAN in this case? : Install this package: : : http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/URI-1.30.tar.gz : : : --eric : : : > : > Thanks in advance : > : > / Martin : > : > -----Original Message----- : > From: Eric Kolve : > To: SURBL Discussion list : > Sent: 5/27/2004 6:34 PM : > Subject: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI - Make : > test e rror : > : > You need the URI package from CPAN. You should have received : > a warning when you attempted to install (if not let me know). : > : > --eric : > : > : > On Thu, May 27, 2004 at 02:52:28PM +0200, Martin Lyberg wrote: : > > Hi! : > > : > > I solved the problem by this thread: : > > : > > http://lists.surbl.org/pipermail/discuss/2004-May/000522.html : > > : > > But now i can't get through 'make test'. This gives me the : > > following: : > > : > > make test : > > : > > ---snip--- : > > : > > Failed 9/9 tests, 0.00% okay : > > t/whitelist........Can't locate URI/QueryParam.pm in @INC (@INC : > contains: : > > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib : > > /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/arch : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 . : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 : > > /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > /usr/lib/perl5/5.8.0/i386-linux-thread-multi : /usr/lib/perl5/5.8.0 .) : > at : > > : > : /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/Spa : > mC : > opUR : > > I.pm line 5. : > > BEGIN failed--compilation aborted at : > > : > : /root/Mail-SpamAssassin-SpamCopURI-0.16/blib/lib/Mail/SpamAssassin/Spa : > mC : > opUR : > > I.pm line 5. : > > Compilation failed in require at t/whitelist.t line 6. BEGIN : > > failed--compilation aborted at t/whitelist.t line 6. # Looks like : > > your test died before it could output anything. : > > t/whitelist........dubious : > > : > > Test returned status 2 (wstat 512, 0x200) : > > DIED. FAILED tests 1-6 : > > Failed 6/6 tests, 0.00% okay : > > Failed Test Stat Wstat Total Fail Failed List of Failed : > > : > : ---------------------------------------------------------------------- : > -- : > ---- : > > --- : > > t/blacklist.t 2 512 4 4 100.00% 1-4 : > > t/dnsrbl.t 2 512 6 6 100.00% 1-6 : > > t/extract_urls.t 2 512 15 15 100.00% 1-15 : > > t/mailto.t 2 512 1 1 100.00% 1 : > > t/open_redirect.t 2 512 5 5 100.00% 1-5 : > > t/spamcopuri.t 2 512 9 9 100.00% 1-9 : > > t/whitelist.t 2 512 6 6 100.00% 1-6 : > > Failed 7/7 test scripts, 0.00% okay. 46/46 subtests failed, 0.00% : > okay. : > > make: *** [test_dynamic] Error 2 : > > : > > Any solution to this problem? Just before i did upgrade Net::DNS : > through : > > CPAN. : > > : > > Thank you. : > > : > > / Martin : > > : > > : > > : > > : -----Ursprungligt meddelande----- : > > : Från: Eric Kolve [mailto:ekolve@comcast.net] : > > : Skickat: den 27 maj 2004 14:11 : > > : Till: SURBL Discussion list : > > : Ämne: Re: [SURBL-Discuss] Problems installing SPAMCOP_URI : > > : : > > : : > > : On Thu, May 27, 2004 at 01:44:02PM +0200, Martin Lyberg wrote: : > > : > : Hi : > > : > : : > > : > : I've been reading alot about SURBL in SA-mailinglist, now : > > : > : i've decided to give it a try. But im having trouble : > > : > : installing SpamcopUri. : > > : > : : > > : > : I have the following system: RH9, Postfix, SA 2.63 : > > : > : : > > : > : I get the following: : > > : > : : > > : > : Perl Makefile.pl : > > : > : : > > : > : Can't locate Mail/SpamAssassin.pm in @INC (@INC contains: : > > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/5.8.0 : > > : > : /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl : > > : > : /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl : > > : > : /usr/lib/perl5/5.8.0/i386-linux-thread-multi : > > : > : /usr/lib/perl5/5.8.0 .) at Makefile.PL line 3. BEGIN : > > : > : failed--compilation aborted at Makefile.PL line 3. : > > : > : : > > : > : What is wrong here? : > > : : > > : It looks like 'Perl' (was that really what was executed) : > > : couldn't find Mail::SpamAssassin. Do you know where it's : > > : installed? This appears to be an issue with the @INC. : > > : : > > : : > > : --eric : > > : : > > : : > > : > : > > : > Does anyone know a solution to this problem? Is there : any easy : > > : > solution? : > > : > : > > : > Thanks in advance : > > : > : > > : > / Martin : > > : > _______________________________________________ : > > : > Discuss mailing list : > > : > Discuss(a)lists.surbl.org : > > : > http://lists.surbl.org/mailman/listinfo/discuss : > > : _______________________________________________ : > > : Discuss mailing list : > > : Discuss(a)lists.surbl.org : > > : http://lists.surbl.org/mailman/listinfo/discuss : > > : : > > : > > _______________________________________________ : > > Discuss mailing list : > > Discuss(a)lists.surbl.org : > > http://lists.surbl.org/mailman/listinfo/discuss : > : > _______________________________________________ : > Discuss mailing list : > Discuss(a)lists.surbl.org : > http://lists.surbl.org/mailman/listinfo/discuss :

6 12

SpamCopURI+ --lint
by Cami 30 May '04

30 May '04

Hi All, I'm using the SA Mail-SpamAssassin-SpamCopURI-0.17 plugin, (i've installed the packages required) and i'm getting the following errors when running spamassassin --lint: [spamwall01][/etc/mail/spamassassin]# spamassassin --lint Failed to compile URI SpamAssassin tests, skipping: (syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule WS_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 1, near "eval:" syntax error at /etc/mail/spamassassin/spamcop_uri.cf, rule SPAMCOP_URI_RBL, line 6, near "} }" ) Is this something to worry about? (i thought --lint should not return any errors..) Regards, Cami

2 2

FW: SURBL+ Checker Submission
by Chris Santerre 28 May '04

28 May '04

Currently people are using the SARE website to report domains to me. This is the kind of report I get. I've munged the email and IP of the reporter. Most of the time the entire spam is also included. I get about 12 a day. However I'n not going to be adding domains like this to BE in the very near future. These should start going to an address for WS until Paul gets his project up? If so, all I need is an email address. Thanks, --Chris >-----Original Message----- >From: SURBL+ Checker [mailto:surbl@rulesemporium.com] >Sent: Friday, May 28, 2004 10:05 AM >To: csanterre(a)MerchantsOverseas.com >Subject: SURBL+ Checker Submission > > >Date: Fri May 28 09:04:38 2004 >Reporter: Adam <munged(a)npower.com> >Reporter IP: 62.xxx.25.19 >Reporter Desc: Another spam domain. > >Applicable List: URIBL:be.surbl.org >Reported URI/IP: tonightafter.com > >Email Source: >---------------------------------------- > >Message sent in plain text: > >One of your buddies hooked you up on a date with another buddy. > >http://tonightafter.com/confirm/?oc=50798885 > > > > > > > > > > > > > > > > > > >Don't want these notifications? >http://tonightafter.com/remove/?oc=50798885 > > > >nsophomoricdelude aspersion ephesus gigaherz kinshasha >teratology stalwart bebop intensive whatnot insert badge >quality aldermen copter assail testament pistol been bystander >cost beneficent clinician cyclops falsify matrices breadroot >bushel charcoal dwindle kobayashi > >obrassymediate moneymake calvinist osiris insupportable >intrigue cavemen bonito pig digital derelict doctrinaire >badinage mathematician television rhyme matsumoto vacuolate >conceptual landmark typhon > >Message headers: > >Received: from pcp01061328pcs.summit01.tn.comcast.net >([68.60.16.253]) by > kfnfw01.npower.com via smtpd (for [10.52.40.144]) with >SMTP; 28 May 2004 > 00:28:05 UT >X-Message-Info: 8Uiw9j262CPXfyuJXQ22mxd155uwrqaGHxilJIixvYYgxv4up >Received: from yahoo.com ([205.138.1.111]) by co14-p82.yahoo.com with > Microsoft SMTPSVC (7.7.6206.9972); Fri, 28 May 2004 14:31:14 -0200 >Received: from yahoo.com (yahoo.com [174.174.7.190]) by yahoo.com > (8.12.10/8.12.9) with ESMTP id pwe4JO051427 for ><bizbox(a)npower.com>; Fri, > 28 May 2004 13:32:14 -0300 (EST) (envelope-from >Janis(a)tonightafter.com) >Received: from CB2790413 (modemcable76.3-14.h.yahoo.com >[104.92.164.94]) > (authenticated bits=5) by yahoo.com (8.12.10/8.12.9) with ESMTP id > JSN20ruz28I294295 for <bizbox(a)npower.com>; Fri, 28 May >2004 15:31:14 > -0100 (EST) (envelope-from Janis(a)tonightafter.com) >Message-ID: ><24163mv103bhg9$p099VO137sg38$81VOT691LRT3@yak19370990924877> >From: "Lula French" <Janis(a)tonightafter.com> >To: <Bizbox> >Subject: RE: tempted by love? >Date: Fri, 28 May 2004 11:31:14 -0500 >MIME-Version: 1.0 >Content-Type: multipart/alternative; boundary="--15104472402585470068" > >----15104472402585470068 >Content-Type: text/plain >Content-Transfer-Encoding: 7Bit > >----15104472402585470068-- > >---------------------------------------- > >

2 1

RE: [SURBL-Discuss] OT: RBL needed!
by Chris Santerre 28 May '04

28 May '04

>-----Original Message----- >From: Doc Schneider [mailto:maddoc@maddoc.net] >Sent: Friday, May 28, 2004 9:55 AM >To: SURBL Discuss >Subject: [SURBL-Discuss] OT: RBL needed! > > >This Off topic but figured most of us all get hit with this stuff. > >I am in need of a bit of help. > >I got a whole bunch of open relays doing rumpelstiltskin(sic) >attacks on >both my main mailserver and my seconary MX server... hitting the >secondary and making it throttle the main one. > >Anyway is there a way to use some of these RBLs to basically >deny these >open relays to be able to even attempt these attacks? > >I'm running Sendmail 8.12.11 on Linux... both these boxen run RH 6.2 >and are really locked down against other attacks. > >I use to just drop routes to these idiots but never a good solution >IMNSHO 8*) > >I looked through the sendmail FAQs and didn't find anything that was >helpful. > >Any idea would be more then welcome. > Did you mean something like sorbs.net? http://www.dnsbl.us.sorbs.net/using.html See the Zones Available towards the bottom. HTH, Chris Santerre System Admin and SARE Ninja http://www.rulesemporium.com 'It is not the strongest of the species that survives, not the most intelligent, but the one most responsive to change.' Charles Darwin

1 0

Re: Anti-SURBL technique ?
by Jeff Chan 28 May '04

28 May '04

On Friday, May 28, 2004, 3:48:15 AM, Rikhardur EGILSSON wrote: > From: jdow [mailto:jdow@earthlink.net] See: http://article.gmane.org/gmane.mail.spam.spamassassin.general/50187 >> If it hurts when you put your finger in the pencil sharpener and turn the >> crank don't do it. >> Simply cancel all redirects as spam. If someone legitimate is not courteous >> enough to send it "clear" then "scroom." > Good point, but how do I do that ? > If I understand the SURBL documentation corectly > "spamcop_uri_resolve_open_redirects" will only work on those domains > explicitly named in "open_redirect_list_spamcop_uri" not every spammer > throwaway domain.. We could probably put together a small paper on the subject of redirection sites. First thing to note is that there are different types. Some like the yahoo redirection site show the destination URI clearly contained within the original URI. Others like tinyurl or the spammer redirection site you found encode the destination site so that it's not plainly visible in the original URI. The latter have been called "opaque" and the former "open" redirections. Probably there are other names also, but you get the idea. urirhsbl in SA 3.0 will check all the domains visible in the URI against the SURBL it's called on (perhaps up to some limited number of URIs), including checking the redirection sites themselves. If the "redirect resolution" feature is enabled, SpamCopURI in SA 2.63 will attempt to resolve the Location header using the redirection server, but I'm not sure whether it can do so on an opaque redirection or not. All of the previous answers also apply. Reporting spams to SpamCop which have any visible black hat redirection sites will get them into sc.surbl.org unless we specifically whitelist them, which we would not do for purely spammer redirectors such as the one you found. In that way, even an opaque redirection site will get listed if it's a bad guy redirection site, as opposed to a mostly legitimate one like Yahoo's. Jeff C. -- Jeff Chan mailto:jeffc@surbl.org http://www.surbl.org/

1 0

Some issues with get_uri_list
by Yusuf Goolamabbas 28 May '04

28 May '04

Hi, Since SURBL relies extensively on SA's get_uri_list/uri_to_domain I thought it might be appropiate to discuss possible FP's/FN's on this list so as to alert other members to bugs/spammer tricks etc and also be able to provide reduced testcases/fixes to SA developers upstream. One example I've recently filed in SA's bugzilla is http://bugzilla.spamassassin.org/show_bug.cgi?id=3427 Regards, Yusuf

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss