On Thursday 13 November 2003 09:04 am, Derek Jennings wrote: > Later:- > I tried out your rules and get these errors when I run spamd -D > debug: Failed to parse line in SpamAssassin configuration, skipping: tflags > RCVD_IN_EASY Possible that additional CR/LF have been introduced by my posting. I will attach the original here as a text file and hope that it gets through to the list. If not, I can send it to you direct through email.
> Is that syntax correct? I notice the line > tflags X_SORBS_OPEN_HTTP net > *does* parse correctly. Try the standalone file and tell me if you still have problems, I have none on mine and I also run 2.60. > By the way:- > Have you tried activating the dcc test? > For me spamd hogs 100%CPU and locks up if I enable dcc (Yes dcc is > installed) No, I run Razor but don't see any advantage to running more than one distributed checksum list and Razor already works well enough for me. Fact is that there are few spams that are caught by Razor that also aren't flagged by the DNSBL checks, anyway. -- Bryan Phinney Software Test Engineer
# EASYNET_NL is the Easynet.nl List: http://blackholes.easynet.nl . header RCVD_IN_EASY rbleval:check_rbl('relay', 'blackholes.easynet.nl.') describe RCVD_IN_EASY Received via EASYed relay, see http://blackholes.easynet.nl tflags RCVD_IN_EASY # use *.blackholes.us DNSBL's # $Id: blackholes.cf,v 1.2 2002/08/07 06:23:58 pancrace Exp $ header RCVD_IN_ARGENTINA eval:check_rbl('country', 'argentina.blackholes.us.') describe RCVD_IN_ARGENTINA Received from Argentina header RCVD_IN_BRAZIL eval:check_rbl('country', 'brazil.blackholes.us.') describe RCVD_IN_BRAZIL Received from Brazil header RCVD_IN_CHINA eval:check_rbl('country', 'china.blackholes.us.') describe RCVD_IN_CHINA Received from China header RCVD_IN_JAPAN eval:check_rbl('country', 'japan.blackholes.us.') describe RCVD_IN_JAPAN Received from Japan header RCVD_IN_KOREA eval:check_rbl('country', 'korea.blackholes.us.') describe RCVD_IN_KOREA Received from Korea header RCVD_IN_NIGERIA eval:check_rbl('country', 'nigeria.blackholes.us.') describe RCVD_IN_NIGERIA Received from Nigeria header RCVD_IN_RUSSIA eval:check_rbl('country', 'russia.blackholes.us.') describe RCVD_IN_RUSSIA Received from Russia header RCVD_IN_SINGAPORE eval:check_rbl('country', 'singapore.blackholes.us.') describe RCVD_IN_SINGAPORE REceived from Singapore header RCVD_IN_TAIWAN eval:check_rbl('country', 'taiwan.blackholes.us.') describe RCVD_IN_TAIWAN Received from Taiwan header RCVD_IN_THAILAND eval:check_rbl('country', 'thailand.blackholes.us.') describe RCVD_IN_THAILAND Received from Thailand score RCVD_IN_ARGENTINA 7.0 score RCVD_IN_BRAZIL 7.0 score RCVD_IN_CHINA 7.0 score RCVD_IN_JAPAN 7.0 score RCVD_IN_KOREA 7.0 score RCVD_IN_NIGERIA 7.0 score RCVD_IN_RUSSIA 7.0 score RCVD_IN_SINGAPORE 2.0 score RCVD_IN_TAIWAN 7.0 score RCVD_IN_THAILAND 2.0 header RCVD_IN_BROADWING eval:check_rbl('isp', 'broadwing.blackholes.us.') describe RCVD_IN_BROADWING Received from Broadwing network space header RCVD_IN_CIBERLYNX eval:check_rbl('isp', 'ciberlynx.blackholes.us.') describe RCVD_IN_CIBERLYNX Received from Ciberlynx network space header RCVD_IN_CW eval:check_rbl('isp', 'cw.blackholes.us.') describe RCVD_IN_CW Received from Cable and Wireless network space header RCVD_IN_ELI eval:check_rbl('isp', 'eli.blackholes.us.') describe RCVD_IN_ELI Received from ELI network space header RCVD_IN_EPOCH eval:check_rbl('isp', 'epoch.blackholes.us.') describe RCVD_IN_EPOCH Received from Epoch network space header RCVD_IN_HE eval:check_rbl('isp', 'he.blackholes.us.') describe RCVD_IN_HE Received from Hurricane Electric network space header RCVD_IN_INFLOW eval:check_rbl('isp', 'inflow.blackholes.us.') describe RCVD_IN_INFLOW Received from Inflow network space header RCVD_IN_INTERNAP eval:check_rbl('isp', 'internap.blackholes.us.') describe RCVD_IN_INTERNAP Received from Internap network space header RCVD_IN_LEVEL3 eval:check_rbl('isp', 'level3.blackholes.us.') describe RCVD_IN_LEVEL3 Received from Level 3 network space header RCVD_IN_RACKSPACE eval:check_rbl('isp', 'rackspace.blackholes.us.') describe RCVD_IN_RACKSPACE Received from Rackspace network space header RCVD_IN_RR eval:check_rbl('isp', 'rr.blackholes.us.') describe RCVD_IN_RR Received from Road Runner network space header RCVD_IN_SKYNETWEB eval:check_rbl('isp', 'skynetweb.blackholes.us.') describe RCVD_IN_SKYNETWEB Received from SkynetWeb network space header RCVD_IN_VALUEWEB eval:check_rbl('isp', 'valueweb.blackholes.us.') describe RCVD_IN_VALUEWEB Received from Valueweb/Cybergate network space header RCVD_IN_VERIO eval:check_rbl('isp', 'verio.blackholes.us.') describe RCVD_IN_VERIO Received from Verio network space header RCVD_IN_WANADOOFR eval:check_rbl('isp', 'wanadoo-fr.blackholes.us.') describe RCVD_IN_WANADOOFR Received from Wanadoo.fr network space header RCVD_IN_XO eval:check_rbl('isp', 'xo.blackholes.us.') describe RCVD_IN_XO Received from XO/Concentric network space header RCVD_IN_SORBS eval:check_rbl('isp', 'dnsbl.sorbs.net.') describe RCVD_IN_SORBS Received from IP in dnsbl.sorbs.net header RCVD_IN_SPEWS eval:check_rbl('isp', 'l1.spews.dnsbl.sorbs.net.') describe RCVD_IN_SPEWS Received from IP in Spews.sorbs.net header RCVD_IN_ROGERS eval:check_rbl('isp', 'rogers.blackholes.us.') describe RCVD_IN_ROGERS Received from rogers network space score RCVD_IN_BROADWING 2.0 score RCVD_IN_CIBERLYNX 2.0 score RCVD_IN_CW 2.0 score RCVD_IN_ELI 2.0 score RCVD_IN_EPOCH 2.0 score RCVD_IN_HE 2.0 score RCVD_IN_INFLOW 2.0 score RCVD_IN_INTERNAP 2.0 score RCVD_IN_LEVEL3 2.0 score RCVD_IN_RACKSPACE 2.0 score RCVD_IN_RR 6.0 score RCVD_IN_SKYNETWEB 2.0 score RCVD_IN_VALUEWEB 2.0 score RCVD_IN_VERIO 2.0 score RCVD_IN_WANADOOFR 2.0 score RCVD_IN_XO 2.0 score RCVD_IN_SORBS 6.0 score RCVD_IN_ROGERS 6.0 score RCVD_IN_CBL 6.0 score RCVD_IN_SBL 7.0 score RCVD_IN_BL_SPAMCOP_NET 7.0 score RCVD_IN_EASY 7.0 score RCVD_IN_SPEWS 7.0 score RCVD_IN_DSBL 7.0 #Single Zone BL's first #CBL.ABUSEAT.ORG is a DNSBL of senders who have sent to spamtrap addresses. This one is pretty good at hitting crap spammers not caught by some others, especially clueless cable modem spammers. header RCVD_IN_CBL rbleval:check_rbl('relay', 'cbl.abuseat.org') describe RCVD_IN_CBL DNSBL: sender has sent spam to spamtraps tflags RCVD_IN_CBL net # Multizone / Multi meaning BLs next # SORBS, like MAPS RBL+ is a multi-meaning BL, so it is treated separately header RCVD_IN_SORBS rbleval:check_rbl('sorbs', 'dnsbl.sorbs.net.') describe RCVD_IN_SORBS Received via a relay in dnsbl.sorbs.net tflags RCVD_IN_SORBS # X prefix was used to insure that it was run at the end, but it's not needed # anymore since we run the rule with rblreseval -- Marc header X_SORBS_OPEN_HTTP rbleval:check_rbl_results_for('sorbs', '127.0.0.2') describe X_SORBS_OPEN_HTTP DNSBL: sender is Confirmed Open Proxy tflags X_SORBS_OPEN_HTTP net header X_SORBS_SOCKS rbleval:check_rbl_results_for('sorbs', '127.0.0.3') describe X_SORBS_SOCKS DNSBL: sender ip address Confirmed Open Socks Proxy tflags X_SORBS_SOCKS header X_SORBS_MISC rbleval:check_rbl_results_for('sorbs', '127.0.0.4') describe X_SORBS_MISC DNSBL: sender is Confirmed Open Misc Proxy tflags X_SORBS_MISC header X_SORBS_SMTP rbleval:check_rbl_results_for('sorbs', '127.0.0.5') describe X_SORBS_SMTP DNSBL: sender is a Confirmed Open Relay tflags X_SORBS_SMTP header X_SORBS_SPAM rbleval:check_rbl_results_for('sorbs', '127.0.0.6') describe X_SORBS_SPAM DNSBL: sender is a Confirmed spam Source tflags X_SORBS_SPAM header X_SORBS_WEB rbleval:check_rbl_results_for('sorbs', '127.0.0.7') describe X_SORBS_WEB DNSBL: sender is a Confirmed Spam Support Web Server tflags X_SORBS_WEB header X_SORBS_ZOMBIE rbleval:check_rbl_results_for('sorbs', '127.0.0.9') describe X_SORBS_ZOMBIE DNSBL: sender is a Zombie Domain tflags X_SORBS_ZOMBIE header X_SORBS_NOMAIL rbleval:check_rbl_results_for('sorbs', '127.0.0.12') describe X_SORBS_NOMAIL DNSBL: sender is a Confirmed No Mail Ever zone tflags X_SORBS_NOMAIL num_check_received 5
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
