RE: Testing Botnet

[Robert - elists]

> 
> Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct.
> Setting rules scores to 0 did *not* prevent these tests from being
> evaluated for SA 3.2.x before 3.2.3.
> 
> Fixed since 3.2.3.  Plugin eval rules with 0 scores are meant no not be
> evaluated, and of course to not show up in the report.
> 
>   karsten
> 

Karsten

Interesting, does this mean that we should be changing scores we care about
and want to see eval'd in the reports to .01 or something similar?

Any other implications in the bug and current or future fix methods?

 - rh

Re: Testing Botnet

[Karsten Bräckelmann]

On Sat, 2008-01-12 at 18:03 +, Arthur Dent wrote:
> Hello All,
> 
> I'm afraid that I might have wasted your time - Hence the change to the thread
> Subject. 
> 
> I guess that what triggered my original question was the fact that I was
> trying to check that everything was working following an OS upgrade. Looking
> back through my spam corpus it seemed that I would get "Botnet Serverwords" in
> the headers of probably about 2 out of three spam emails (it was however
> scored at 0).
> 
> These stopped abruptly in October when I upgraded SA.

Sounds like you've been hit by bug 5519 [1] before the upgrade in Oct.
Setting rules scores to 0 did *not* prevent these tests from being
evaluated for SA 3.2.x before 3.2.3.

Fixed since 3.2.3.  Plugin eval rules with 0 scores are meant no not be
evaluated, and of course to not show up in the report.

  karsten


[1] Zeroing a score does not disable plugin eval rules
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5519

-- 
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Re: Postfix Question with front end filtering [OT]

[mouss]

Gary V wrote:
>> From: marc
>>
>> postconf -n
>>
>> alias_database = hash:/etc/aliases
>> alias_maps = hash:/etc/aliases
>> broken_sasl_auth_clients = yes
>> command_directory = /usr/sbin
>> config_directory = /etc/postfix
>> content_filter = amavis:[$myhostname]:10024
>> daemon_directory = /usr/libexec/postfix
>> debug_peer_level = 2
>> home_mailbox = Maildir/
>> html_directory = no
>> inet_interfaces = $myhostname
>> mail_owner = postfix
>> mailq_path = /usr/bin/mailq.postfix
>> manpage_directory = /usr/share/man
>> max_use = 20
>> message_size_limit = 1536
>> mydestination = $myhostname, localhost.$mydomain, $transport_maps
>> mydomain = extremia.fi
>> myhostname = smtp.extremia.fi
>> myorigin = $mydomain
>> newaliases_path = /usr/bin/newaliases.postfix
>> queue_directory = /var/spool/postfix
>> readme_directory = /usr/share/doc/postfix-2.2.10/README_FILES
>> sample_directory = /usr/share/doc/postfix-2.2.10/samples
>> sendmail_path = /usr/sbin/sendmail.postfix
>> setgid_group = postdrop
>> smtpd_recipient_restrictions = permit_sasl_authenticated,
>> permit_mynetworks, reject_unauth_destination
>> smtpd_sasl_auth_enable = yes
>> smtpd_sasl_security_options = noanonymous
>> transport_maps = pgsql:/etc/postfix/transport_maps.cf
>> unknown_local_recipient_reject_code = 450
>> virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
>> virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
>> virtual_mailbox_base = /var/spool/postfix/virtual
>> virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
>>
>> virtual_uid_maps = pgsql:/etc/postfix/virtual_uid_maps.cf
>>
>> 
>
> Well, we would have to know where the mail is currently stored. 
>
> There is a virtual_mailbox_maps map without  a virtual_mailbox_domains  map, 
> so we don't know if virtual_mailbox_domains used to be there, but was 
> removed. Or, the domains were removed from the transport map which means that 
> they are no longer in $mydestination. It's not a good idea to use 
> $transport_maps as a $mydestination setting anyway. If this is the case, they 
> should be added to $mydestination. It's also possible there used to be a 
> $relay_domains setting that was removed. Where is the mail store?
>   

or it is using the compatibility setting relay_domains = $mydestination.
new installations are advised to set relay_domains explicitely. if not
needed, use
relay_domains =

Re: Postfix Question with front end filtering [OT]

[mouss]

Ralf Hildebrandt wrote:
> * mouss <[EMAIL PROTECTED]>:
>   
>> This really belongs to the postfix list, but ...
>>
>> Marc Perkel wrote:
>> 
>>> [snip]
>>> mydestination = $myhostname, localhost.$mydomain, $transport_maps
>>>   
>> remove $transport_maps. reusing unrelated maps is horrible. if a
>> transport entry is added for say hotmail.com, postfix will accept and
>> mis-deliver (or bounce) hotmail mail.
>> 
>>> mydomain = extremia.fi
>>> myhostname = smtp.extremia.fi
>>> [snip]
>>> unknown_local_recipient_reject_code = 450
>>>   
>> once everything works correctly, change this to 550.
>>
>> 
>>> virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
>>> virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
>>> virtual_mailbox_base = /var/spool/postfix/virtual
>>> virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
>>>
>>>   
>> ahem. there is no virtual_mailbox_domains, do virtual_mailbox_* is useless.
>> 
>
> UNLESS whoever set this crap up used transport maps :)
>   

which would be insane!

Ah. I didn't mention virtual_mailbox_base inside postfix queue
directory... There must be a business to sell directory names to people
so that they avoid putting everything in the same place ;-p

RE: BOTNET 0.8 + SA 3.2.3

[Robert - elists]

> 
> Well here is what I have...
> 
> [EMAIL PROTECTED] ~]# ls -la /etc/mail/spamassassin/
> total 148
> drwxr-xr-x 3 root root  4096 2008-01-11 22:54 .
> drwxr-xr-x 3 root root  4096 2007-12-29 19:48 ..
> -r--r--r-- 1 root root  4706 2008-01-11 22:54 Botnet.cf
> -r--r--r-- 1 root root 28616 2008-01-11 22:54 Botnet.pm
> -rw-r--r-- 1 root root  2522 2006-08-13 09:07 GPG.KEY
> -rw-r--r-- 1 root root  1299 2007-08-21 15:15 init.pre
> -rw-r--r-- 1 root root   558 2008-01-02 00:50 local.cf
> -rwxr--r-- 1 root root   776 2007-12-30 17:52 sare-sa-update-channels.txt
> drwx-- 2 root root  4096 2008-01-08 02:00 sa-update-keys
> -rw-r--r-- 1 root root62 2007-08-21 15:15 spamassassin-default.rc
> -rwxr-xr-x 1 root root35 2007-08-21 15:15 spamassassin-helper.sh
> -rw-r--r-- 1 root root55 2007-08-21 15:15 spamassassin-spamc.rc
> -rw-r--r-- 1 root root  2603 2007-08-21 15:15 v310.pre
> -rw-r--r-- 1 root root  1195 2007-08-21 15:15 v312.pre
> -rw-r--r-- 1 root root  2416 2007-08-21 15:15 v320.pre
> [EMAIL PROTECTED] ~]#
> 
> Seems OK to me But is it?...
> 
> The thing that really mystifies me is that spammassassin --lint -D seems
> to
> show that Botnet is installed correctly. It just doesn't hit anything?...
> 
> Thanks for your help so far...
> 
> AD
> 

AD,

What is your platform OS etc?

I went to jrudd dload site and pulled down botnet v8 tar to tmp dir and
untar

I put the two files in /etc/mail/spamassassin

I su'd to spamd user

spamassassin --lint

all ok.

Restarted spamassassin and it just works

This is on an approx over 2 year old centos 4 install currently at centos4.6

We roll our own spamassassin rpms with

rpmbuild -tb spamassassin-x.xx.tar.gz

have you ever tailed your spamassassin logs to see if you get botnet hits as
opposed to that test email you keep referring too?

The other thing you might do is do a search on your machine for any other
copies of the Botnet.* files to make sure there is no duplication

 - rh

RE: Postfix Question with front end filtering [OT]

[Gary V]

> From: marc
>
> postconf -n
>
> alias_database = hash:/etc/aliases
> alias_maps = hash:/etc/aliases
> broken_sasl_auth_clients = yes
> command_directory = /usr/sbin
> config_directory = /etc/postfix
> content_filter = amavis:[$myhostname]:10024
> daemon_directory = /usr/libexec/postfix
> debug_peer_level = 2
> home_mailbox = Maildir/
> html_directory = no
> inet_interfaces = $myhostname
> mail_owner = postfix
> mailq_path = /usr/bin/mailq.postfix
> manpage_directory = /usr/share/man
> max_use = 20
> message_size_limit = 1536
> mydestination = $myhostname, localhost.$mydomain, $transport_maps
> mydomain = extremia.fi
> myhostname = smtp.extremia.fi
> myorigin = $mydomain
> newaliases_path = /usr/bin/newaliases.postfix
> queue_directory = /var/spool/postfix
> readme_directory = /usr/share/doc/postfix-2.2.10/README_FILES
> sample_directory = /usr/share/doc/postfix-2.2.10/samples
> sendmail_path = /usr/sbin/sendmail.postfix
> setgid_group = postdrop
> smtpd_recipient_restrictions = permit_sasl_authenticated,
> permit_mynetworks, reject_unauth_destination
> smtpd_sasl_auth_enable = yes
> smtpd_sasl_security_options = noanonymous
> transport_maps = pgsql:/etc/postfix/transport_maps.cf
> unknown_local_recipient_reject_code = 450
> virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
> virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
> virtual_mailbox_base = /var/spool/postfix/virtual
> virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
>
> virtual_uid_maps = pgsql:/etc/postfix/virtual_uid_maps.cf
>

Well, we would have to know where the mail is currently stored. 

There is a virtual_mailbox_maps map without  a virtual_mailbox_domains  map, so 
we don't know if virtual_mailbox_domains used to be there, but was removed. Or, 
the domains were removed from the transport map which means that they are no 
longer in $mydestination. It's not a good idea to use $transport_maps as a 
$mydestination setting anyway. If this is the case, they should be added to 
$mydestination. It's also possible there used to be a $relay_domains setting 
that was removed. Where is the mail store?

Gary V

_
Watch “Cause Effect,” a show about real people making a real difference.
http://im.live.com/Messenger/IM/MTV/?source=text_watchcause

Re: Postfix Question with front end filtering [OT]

[Ralf Hildebrandt]

* mouss <[EMAIL PROTECTED]>:
> This really belongs to the postfix list, but ...
> 
> Marc Perkel wrote:
> > [snip]
> > mydestination = $myhostname, localhost.$mydomain, $transport_maps
> remove $transport_maps. reusing unrelated maps is horrible. if a
> transport entry is added for say hotmail.com, postfix will accept and
> mis-deliver (or bounce) hotmail mail.
> > mydomain = extremia.fi
> > myhostname = smtp.extremia.fi
> > [snip]
> > unknown_local_recipient_reject_code = 450
> once everything works correctly, change this to 550.
> 
> > virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
> > virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
> > virtual_mailbox_base = /var/spool/postfix/virtual
> > virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
> >
> 
> ahem. there is no virtual_mailbox_domains, do virtual_mailbox_* is useless.

UNLESS whoever set this crap up used transport maps :)
 
> > virtual_uid_maps = pgsql:/etc/postfix/virtual_uid_maps.cf
> >
> 
> if mail for $mydomain is to be delivered to unix accounts, simply add
> $mydomain to mydestination. if it is to be delivered to vortual
> mailboxes, add it to virtual_mailbox_domains. make sure
> virtual_mailbox_maps is correctly set.

-- 
Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED]
Charite - Universitätsmedizin BerlinTel.  +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-BerlinFax.  +49 (0)30-450 570-962
IT-Zentrum Standort CBFsend no mail to [EMAIL PROTECTED]

RE: Problem with handle_user

[Matthew Goodman]

I know that it didn't happen under 3.2.3 because A) no config files changed,
and B) very clearly my per-user settings are not being processed.

Vpopmail should be the user spamd runs as because the per-user settings are
in a directory that is owned by vpopmail:vpopmail.

Per-user files are in /var/vpopmail/domains/%d/%u/.spamassassin as stated in
the command line that runs spamd.



-Original Message-
From: Matt Kettler [mailto:[EMAIL PROTECTED] 
Sent: Saturday, January 12, 2008 3:04 AM
To: Matthew Goodman
Cc: users@spamassassin.apache.org
Subject: Re: Problem with handle_user

Matthew Goodman wrote:
> I am also having this error in my spamd.log file.
>
> Spamd is being run with:
>
> SPAMD_OPTS="-c -d -v -m 40 -s local4 -q -u vpopmail 
> --virtual-config-dir=/var/vpopmail/domains/%d/%l/.spamassassin/ -H
> /var/vpopmail"
>
> And spamc is being called by qmail-scanner-2.01 with /usr/bin/spamc -t 30
>
> NONE of my per-user files are being read, and every single e-mail that
comes
> in I get the user unknown problem.
>
> This didn't happen when I was using SpamAssassin 3.2.3


It should have. by passing -u vpopmail to spamd, you're telling it to 
*ALWAYS* scan mail as vpopmail, and ignore that which comes from spamc 
on a per-message basis.

Re: Postfix Question with front end filtering [OT]

[mouss]

This really belongs to the postfix list, but ...

Marc Perkel wrote:
> [snip]
> mydestination = $myhostname, localhost.$mydomain, $transport_maps
remove $transport_maps. reusing unrelated maps is horrible. if a
transport entry is added for say hotmail.com, postfix will accept and
mis-deliver (or bounce) hotmail mail.
> mydomain = extremia.fi
> myhostname = smtp.extremia.fi
> [snip]
> unknown_local_recipient_reject_code = 450
once everything works correctly, change this to 550.

> virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
> virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
> virtual_mailbox_base = /var/spool/postfix/virtual
> virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf
>

ahem. there is no virtual_mailbox_domains, do virtual_mailbox_* is useless.

> virtual_uid_maps = pgsql:/etc/postfix/virtual_uid_maps.cf
>

if mail for $mydomain is to be delivered to unix accounts, simply add
$mydomain to mydestination. if it is to be delivered to vortual
mailboxes, add it to virtual_mailbox_domains. make sure
virtual_mailbox_maps is correctly set.

Testing Botnet

[Arthur Dent]

Hello All,

I'm afraid that I might have wasted your time - Hence the change to the thread
Subject. 

I guess that what triggered my original question was the fact that I was
trying to check that everything was working following an OS upgrade. Looking
back through my spam corpus it seemed that I would get "Botnet Serverwords" in
the headers of probably about 2 out of three spam emails (it was however
scored at 0).

These stopped abruptly in October when I upgraded SA.

Only very rarely would I get a "BOTNET Relay might be a spambot or virusbot"
hit (and in fact I have only one remaining in my corpus).

Trying to test Botnet I have tied myself up in knots and only just now thought
of piping that mail trough with the -D switch set. When I do that it certainly
seems that Botnet is loading and running on the message (output below if
you're interested) but it doesn't hit.

Leaving aside the issue of why it hit before but doesn't now, is there any
recognised test (like GTube) for Botnet?

Is it possible that SA 3.2.3 no longer reports the zero scoring "ServerWords"
and that I simply haven't had a "Relay might be a spambot or virusbot"
event since the upgrade?

Forgive my ignorance, I really don't fully understand how Botnet works, but:

Might it be that my test email *was* a spambot when I originally received it,
but *no longer* is?

Any enlightenment gratefully received...

AD

[EMAIL PROTECTED] tmp]$ spamassassin -D < testspam 2>&1 | grep -i botnet
[17484] dbg: config: read file /etc/mail/spamassassin/Botnet.cf
[17484] dbg: config: fixed relative path: /etc/mail/spamassassin/Botnet.pm
[17484] dbg: plugin: loading Mail::SpamAssassin::Plugin::Botnet from
/etc/mail/spamassassin/Botnet.pm
[17484] dbg: Botnet: version 0.8
[17484] dbg: plugin: Mail::SpamAssassin::Plugin::Botnet=HASH(0x97a0684)
implements 'parse_config', priority 0
[17484] dbg: Botnet: setting botnet_pass_auth to 0
[17484] dbg: Botnet: setting botnet_pass_trusted to public
[17484] dbg: Botnet: adding ^127\.0\.0\.1$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^10\..*$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^172\.1[6789]\..*$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^172\.2[0-9]\..*$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^172\.3[01]\..*$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^192\.168\..*$ to botnet_skip_ip
[17484] dbg: Botnet: adding ^128\.223\.98\.16$ to botnet_pass_ip
[17484] dbg: Botnet: adding (\.|\A)amazon\.com$ to botnet_pass_domains
[17484] dbg: Botnet: adding (\.|\A)apple\.com$ to botnet_pass_domains
[17484] dbg: Botnet: adding (\.|\A)ebay\.com$ to botnet_pass_domains
[17484] dbg: Botnet: adding (\b|\d).*dsl.*(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)cable(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)catv(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)ddns(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)dhcp(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)dial(-?up)?(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)dip(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)docsis(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)dyn(amic)?(ip)?(\b|\d) to
botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)modem(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)ppp(oe)?(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)res(net|ident(ial)?)?(\b|\d) to
botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)bredband(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)client(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)fixed(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)ip(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)pool(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)static(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)user(\b|\d) to botnet_clientwords
[17484] dbg: Botnet: adding (\b|\d)e?mail(out)?(\b|\d) to botnet_serverwords
[17484] dbg: Botnet: adding (\b|\d)mta(\b|\d) to botnet_serverwords
[17484] dbg: Botnet: adding (\b|\d)mx(pool)?(\b|\d) to botnet_serverwords
[17484] dbg: Botnet: adding (\b|\d)relay(\b|\d) to botnet_serverwords
[17484] dbg: Botnet: adding (\b|\d)smtp(\b|\d) to botnet_serverwords
[17484] dbg: Botnet: adding (\b|\d)exch(ange)?(\b|\d) to botnet_serverwords
[17484] dbg: rules: ran header rule __BOTNET_NOTRUST ==> got hit:
"negative match"
[17484] dbg: Botnet: starting
[17484] dbg: Botnet: no trusted relays
[17484] dbg: Botnet: get_relay didn't find RDNS
[17484] dbg: Botnet: IP is '194.217.242.223'
[17484] dbg: Botnet: RDNS is 'lon1-hub-3.mail.demon.net'
[17484] dbg: Botnet: HELO is ''
[17484] dbg: Botnet: sender '[EMAIL PROTECTED]'
[17484] dbg: Botnet: miss (none)
[17484] dbg: check:
subtests=__AUTO_GEN_AS,__BOTNET_NOTRUST,__BOUNCE_AUTO_GENERATED,__BOUNCE_CTYPE,__BOUNCE_RPATH_MD,__CT,__CTYPE_HAS_BOUNDARY,__DOS_BODY_SUN,__DOS_HAS_ANY_URI,

Re: Postfix Question with front end filtering [OT]

[Marc Perkel]

postconf -n 


alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = amavis:[$myhostname]:10024
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
home_mailbox = Maildir/
html_directory = no
inet_interfaces = $myhostname
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
max_use = 20
message_size_limit = 1536
mydestination = $myhostname, localhost.$mydomain, $transport_maps
mydomain = extremia.fi
myhostname = smtp.extremia.fi
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.2.10/README_FILES
sample_directory = /usr/share/doc/postfix-2.2.10/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_recipient_restrictions = permit_sasl_authenticated,
permit_mynetworks,  reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
transport_maps = pgsql:/etc/postfix/transport_maps.cf
unknown_local_recipient_reject_code = 450
virtual_alias_maps = pgsql:/etc/postfix/virtual_alias_maps.cf
virtual_gid_maps = pgsql:/etc/postfix/virtual_gid_maps.cf
virtual_mailbox_base = /var/spool/postfix/virtual
virtual_mailbox_maps = pgsql:/etc/postfix/virtual_mailbox_maps.cf

virtual_uid_maps = pgsql:/etc/postfix/virtual_uid_maps.cf

RE: Postfix Question with front end filtering [OT]

[Gary V]

>  Gary V:> > > I think Postfix may know it's the final destination for the 
> domains in> > question,> > No, it could also be a relay domain. In that case 
> the mail would loop,> since it goes back to the MX (the other machine) and 
> comes backe etc.> etc.> > -- > Ralf Hildebrandt
 
Right, I actually meant "I think Postfix may know what domains it is 
responsible for". Which does not appear to be the case at any rate.
 
Gary V
_
Put your friends on the big screen with Windows Vista® + Windows Live™.
http://www.microsoft.com/windows/shop/specialoffers.mspx?ocid=TXT_TAGLM_CPC_MediaCtr_bigscreen_012008

RE: Postfix Question with front end filtering [OT]

[Gary V]

> It's not required to point the MX to the Postfix server! The problem is
> the Postfix server does not accept mail addressed to it. If you were
> to set the MX back to pointing to the Postfix server, the server would
> continue to reject mail addressed to it because it is not configured to
> accept mail addressed to it. It's not that you changed the MX record,
> it's that the server was reconfigured. We are still shooting in the dark
> however, we would need output from 'postcnf -n' and relevent logs to
> get any further.
>
> This is the default relay control mechanism:
>

Stupid hotmail client, this looks better:

http://www200.pair.com/mecham/spam/relay_control.txt

Gary V

_
Share life as it happens with the new Windows Live.
http://www.windowslive.com/share.html?ocid=TXT_TAGHM_Wave2_sharelife_012008

RE: Postfix Question with front end filtering [OT]

[Gary V]

> I think Postfix may know it's the final destination for the domains
> in question, otherwise ALL mail would be rejected.
> 
> 
> Actually that's what is happening. When they moved the MX to point to 
> our spam filter servers their server started rejecting ALL their email
> that we are forwarding. The thing that changed on their server is that
> the domains they host are no longer the primary MX. What I'm trying to
> find out is how to overrider the requirement that the primary MX has to
> point to the Postfix server.
> 
> Internet ---> junkemailfilter.com ---> postfix server

It's not required to point the MX to the Postfix server! The problem is
the Postfix server does not accept mail addressed to it. If you were
to set the MX back to pointing to the Postfix server, the server would
continue to reject mail addressed to it because it is not configured to
accept mail addressed to it. It's not that you changed the MX record,
it's that the server was reconfigured. We are still shooting in the dark
however, we would need output from 'postcnf -n' and relevent logs to
get any further.

This is the default relay control mechanism: 

smtpd_recipient_restrictions = 
   permit_mynetworks 
   reject_unauth_destination 

And hopefully this generally describes how it works: 

   SMTP session 
 | 
 V 
(smtpd_client_restrictions) 
 V 
(smtpd_helo_restrictions) 
 V 
(smtpd_sender_restrictions) 
 V 
smtpd_recipient_restrictions- 

  permit_mynetworks 
   |   \ 
   |DUNNO 
   | \ 
   |  V 
   |   reject_unauth_destination--REJECT-> 
   |   \ 
PERMIT  DUNNO 
   | \ 
   V  V 
(smtpd_data_restrictions)

This says: (permit_mynetworks) if the client is in $mynetworks, skip any
remaining tests in this restriction stage (smtpd_recipient_restrictions)
and go  on to the next restriction stage (smtpd_data_restrictions). 

If the client is not in $mynetworks, let the next test 
(reject_unauth_destination) decide what to do with this 
communication session (in other words: pretend nothing 
happened and continue on). 

So, provided the client is not in $mynetworks, proceed to 
reject_unauth_destination, which says: 
If the message IS addressed to one of the domains I am responsible 
for (domains listed in their proper address class), 
then let the next test in this restriction stage decide what to do 
with the session. As shown, there is no next test in this stage, so 
processing continues on to the next stage (smtpd_data_restrictions). 

If the message IS NOT addressed to one of my domains, then reject it. 
The client will see 'relay access denied'. 

Hopefully this is at least a conceptually accurate decription of the 
relay control mechanism. 

Notice how 
permit_* evalulates to PERMIT (OK) or DUNNO 
and 
reject_* evalulates to REJECT or DUNNO 

Gary V



_
Make distant family not so distant with Windows Vista® + Windows Live™.
http://www.microsoft.com/windows/digitallife/keepintouch.mspx?ocid=TXT_TAGLM_CPC_VideoChat_distantfamily_012008

Re: Postfix Question with front end filtering [OT]

[Ralf Hildebrandt]

* Gary V <[EMAIL PROTECTED]>:

> I think Postfix may know it's the final destination for the domains in
> question,

No, it could also be a relay domain. In that case the mail would loop,
since it goes back to the MX (the other machine) and comes backe etc.
etc.

-- 
Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED]
Charite - Universitätsmedizin BerlinTel.  +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-BerlinFax.  +49 (0)30-450 570-962
IT-Zentrum Standort CBFsend no mail to [EMAIL PROTECTED]

Re: Postfix Question with front end filtering [OT]

[Marc Perkel]

Gary V wrote:

Sorry for the OT question but just need a quick answer from a postfix
expert.

Here's the problem. I run a front end spam filtering service. Email from
the world comes in, I clean it, and send the good email to the original
server. However sometimes because my service is now the primary MX when
I forward the good email the recipient server (running Postix) rejects
the email (relaying denied) because it no longer things it is hosting
the domain locally.

How do I tell postfix that it is the final destination of email for
domains where it is not the primary MX?

Thanks in advance.




I think Postfix may know it's the final destination for the domains in question, otherwise ALL mail would be rejected. 
  


Actually that's what is happening. When they moved the MX to point to 
our spam filter servers their server started rejecting ALL their email 
that we are forwarding. The thing that changed on their server is that 
the domains they host are no longer the primary MX. What I'm trying to 
find out is how to overrider the requirement that the primary MX has to 
point to the Postfix server.


Internet ---> junkemailfilter.com ---> postfix server

RE: Postfix Question with front end filtering [OT]

[Gary V]

> Sorry for the OT question but just need a quick answer from a postfix
> expert.
>
> Here's the problem. I run a front end spam filtering service. Email from
> the world comes in, I clean it, and send the good email to the original
> server. However sometimes because my service is now the primary MX when
> I forward the good email the recipient server (running Postix) rejects
> the email (relaying denied) because it no longer things it is hosting
> the domain locally.
>
> How do I tell postfix that it is the final destination of email for
> domains where it is not the primary MX?
>
> Thanks in advance.
>

I think Postfix may know it's the final destination for the domains in 
question, otherwise ALL mail would be rejected. This sounds like their clients 
(and/or possibly their server too) are using your machine to send mail to 
foreign domains, you are accepting this mail, then relaying it to the Postfix 
machine (for some unknown reason). The Postfix machine is not responsible for 
these foreign domains, so it rejects the mail. Is this a possibility? Or is the 
mail in fact addressed to their domain?

If the Postfix server really does not think it's responsible for the domains, 
then the domains it is responsible for need to be added to whatever address 
class is in use. If mail is stored locally on the Postfix server and Unix 
accounts are used, then the domains would be added to $mydestination. If the 
server relays to another server, then the domains would go in  $relay_domains, 
if using virtual alias domains, then they would go in a virtual_alias_domains  
map, and if using virtual mailboxes, they would go in a virtual_mailbox_domains 
map. They can only go in one, and we don't know enough about the server in 
question to tell you which one. The thing is, the administrator should not have 
changed what domains the Postfix server  accepts mail for when the MX record 
was changed. In other words, maybe the admin should put it back the way it was 
in this respect. 

Gary V
_
Share life as it happens with the new Windows Live.
http://www.windowslive.com/share.html?ocid=TXT_TAGHM_Wave2_sharelife_012008

Re: Postfix Question with front end filtering [OT]

[Marc Perkel]

Bill Randle wrote:

On Sat, 2008-01-12 at 08:14 -0800, Marc Perkel wrote:
  
Ralf Hildebrandt wrote: 


* Marc Perkel <[EMAIL PROTECTED]>:
  
  
Sorry for the OT question but just need a quick answer from a postfix 
expert.


Here's the problem. I run a front end spam filtering service. Email from the 
world comes in, I clean it, and send the good email to the original server. 
However sometimes because my service is now the primary MX when I forward 
the good email the recipient server (running Postix) rejects the email 
(relaying denied) because it no longer things it is hosting the domain 
locally.



And how is that machine configured?

  
  
How do I tell postfix that it is the final destination of email for domains 
where it is not the primary MX?



That depends on the domain class the domain is in (local, relay,
virtual)

  
  

I'm asking for someone else and I don't yet have their configuration.
And I know very little about Postfix (I do Exim). I'm just hoping that
someone who knows postfix just says something like you have to set
something = true or you have to put the domains in some standard list
or something easy like that.



Make sure the final target domain is listed in 'mydestination' in
/etc/postfix/main.cf and that 'mydomain' is also set correctly. A
typical main.cf file might have something like this (among other
entries):
mydomain = mydomain.tld
myhostname = myhost.mydomain.tld
mydestination = $myhostname, $mydomain, localhost

Don't forget to do a 'postfix reload' after making any changes.

-Bill

  


Thanks Bill,

I was wondering if this might be a factor?

*permit_auth_destination*
   Permit the request when one of the following is true:

   * Postfix is mail forwarder: the resolved RCPT TO address
 matches $relay_domains
  or a
 subdomain thereof, and the address contains no
 sender-specified routing ([EMAIL PROTECTED]@domain),
   * Postfix is the final destination: the resolved RCPT TO address
 matches $mydestination
 ,
 $inet_interfaces
 ,
 $proxy_interfaces
 ,
 $virtual_alias_domains
 ,
 or $virtual_mailbox_domains
 ,
 and the address contains no sender-specified routing
 ([EMAIL PROTECTED]@domain).

**

Re: Postfix Question with front end filtering [OT]

[mouss]

Marc Perkel wrote:
>
>
> Ralf Hildebrandt wrote:
>> * Marc Perkel <[EMAIL PROTECTED]>:
>>  
>>> Sorry for the OT question but just need a quick answer from a
>>> postfix expert.
>>>
>>> Here's the problem. I run a front end spam filtering service. Email
>>> from the world comes in, I clean it, and send the good email to the
>>> original server. However sometimes because my service is now the
>>> primary MX when I forward the good email the recipient server
>>> (running Postix) rejects the email (relaying denied) because it no
>>> longer things it is hosting the domain locally.
>>> 
>>
>> And how is that machine configured?
>>
>>  
>>> How do I tell postfix that it is the final destination of email for
>>> domains where it is not the primary MX?
>>> 
>>
>> That depends on the domain class the domain is in (local, relay,
>> virtual)
>>
>>   
>
> I'm asking for someone else and I don't yet have their configuration.
> And I know very little about Postfix (I do Exim). I'm just hoping that
> someone who knows postfix just says something like you have to set
> something = true or you have to put the domains in some standard list
> or something easy like that.
>

without the actual error from postfix logs, it's hard to help. postfix
will accept mail to any domain it is configured to handle
(mydestination, relay_domains, virtual_mailbox_domains,
virtual_alias_domains). so I suspect the problem is elsewhere (such as
postfix is supposed to relay the message, and this creates a loop, or
the filter helo's with name of the postfix server so postfix thinks it's
a loop, ... etc).

Recommended reading:
http://www.postfix.org/ADDRESS_CLASS_README.html
http://www.postfix.org/postconf.5.html#proxy_interfaces

The following must be read and understood:
http://www.postfix.org/BASIC_CONFIGURATION_README.html
http://www.postfix.org/STANDARD_CONFIGURATION_README.html

If virtual delivery is needed:
http://www.postfix.org/VIRTUAL_README.html

more documents on
http://www.postfix.org/documentation.html


PS. The filter should validate recipients to avoid backscatter:
http://www.postfix.org/BACKSCATTER_README.html

Re: Postfix Question with front end filtering [OT]

[Bill Randle]

On Sat, 2008-01-12 at 08:14 -0800, Marc Perkel wrote:
> 
> 
> Ralf Hildebrandt wrote: 
> > * Marc Perkel <[EMAIL PROTECTED]>:
> >   
> > > Sorry for the OT question but just need a quick answer from a postfix 
> > > expert.
> > > 
> > > Here's the problem. I run a front end spam filtering service. Email from 
> > > the 
> > > world comes in, I clean it, and send the good email to the original 
> > > server. 
> > > However sometimes because my service is now the primary MX when I forward 
> > > the good email the recipient server (running Postix) rejects the email 
> > > (relaying denied) because it no longer things it is hosting the domain 
> > > locally.
> > > 
> > 
> > And how is that machine configured?
> > 
> >   
> > > How do I tell postfix that it is the final destination of email for 
> > > domains 
> > > where it is not the primary MX?
> > > 
> > 
> > That depends on the domain class the domain is in (local, relay,
> > virtual)
> > 
> >   
> 
> I'm asking for someone else and I don't yet have their configuration.
> And I know very little about Postfix (I do Exim). I'm just hoping that
> someone who knows postfix just says something like you have to set
> something = true or you have to put the domains in some standard list
> or something easy like that.

Make sure the final target domain is listed in 'mydestination' in
/etc/postfix/main.cf and that 'mydomain' is also set correctly. A
typical main.cf file might have something like this (among other
entries):
mydomain = mydomain.tld
myhostname = myhost.mydomain.tld
mydestination = $myhostname, $mydomain, localhost

Don't forget to do a 'postfix reload' after making any changes.

-Bill

Re: Postfix Question with front end filtering [OT]

[Marc Perkel]

Ralf Hildebrandt wrote:

* Marc Perkel <[EMAIL PROTECTED]>:
  
Sorry for the OT question but just need a quick answer from a postfix 
expert.


Here's the problem. I run a front end spam filtering service. Email from the 
world comes in, I clean it, and send the good email to the original server. 
However sometimes because my service is now the primary MX when I forward 
the good email the recipient server (running Postix) rejects the email 
(relaying denied) because it no longer things it is hosting the domain 
locally.



And how is that machine configured?

  
How do I tell postfix that it is the final destination of email for domains 
where it is not the primary MX?



That depends on the domain class the domain is in (local, relay,
virtual)

  


I'm asking for someone else and I don't yet have their configuration. 
And I know very little about Postfix (I do Exim). I'm just hoping that 
someone who knows postfix just says something like you have to set 
something = true or you have to put the domains in some standard list or 
something easy like that.

Re: Postfix Question with front end filtering [OT]

[Ralf Hildebrandt]

* Marc Perkel <[EMAIL PROTECTED]>:
> Sorry for the OT question but just need a quick answer from a postfix 
> expert.
>
> Here's the problem. I run a front end spam filtering service. Email from the 
> world comes in, I clean it, and send the good email to the original server. 
> However sometimes because my service is now the primary MX when I forward 
> the good email the recipient server (running Postix) rejects the email 
> (relaying denied) because it no longer things it is hosting the domain 
> locally.

And how is that machine configured?

> How do I tell postfix that it is the final destination of email for domains 
> where it is not the primary MX?

That depends on the domain class the domain is in (local, relay,
virtual)


-- 
Ralf Hildebrandt (i.A. des IT-Zentrums) [EMAIL PROTECTED]
Charite - Universitätsmedizin BerlinTel.  +49 (0)30-450 570-155
Gemeinsame Einrichtung von FU- und HU-BerlinFax.  +49 (0)30-450 570-962
IT-Zentrum Standort CBFsend no mail to [EMAIL PROTECTED]

Postfix Question with front end filtering [OT]

[Marc Perkel]

Sorry for the OT question but just need a quick answer from a postfix 
expert.


Here's the problem. I run a front end spam filtering service. Email from 
the world comes in, I clean it, and send the good email to the original 
server. However sometimes because my service is now the primary MX when 
I forward the good email the recipient server (running Postix) rejects 
the email (relaying denied) because it no longer things it is hosting 
the domain locally.


How do I tell postfix that it is the final destination of email for 
domains where it is not the primary MX?


Thanks in advance.

Re: BOTNET 0.8 + SA 3.2.3

[Arthur Dent]

On Fri, Jan 11, 2008 at 07:20:59PM -0500, Dave Koontz wrote:
>
> Arthur Dent wrote:
>> Nope sorry..
>>   
> Please confirm... that your botnet.pm file is where your other plugin PM 
> modules reside.  And that the botnet.cf file is where your custom rules 
> live (may be a different path depending on configuration).  Make sure the 
> botnet.cf is in the same directory as your local.cf file and see if that 
> works.

Well here is what I have...

[EMAIL PROTECTED] ~]# ls -la /etc/mail/spamassassin/
total 148
drwxr-xr-x 3 root root  4096 2008-01-11 22:54 .
drwxr-xr-x 3 root root  4096 2007-12-29 19:48 ..
-r--r--r-- 1 root root  4706 2008-01-11 22:54 Botnet.cf
-r--r--r-- 1 root root 28616 2008-01-11 22:54 Botnet.pm
-rw-r--r-- 1 root root  2522 2006-08-13 09:07 GPG.KEY
-rw-r--r-- 1 root root  1299 2007-08-21 15:15 init.pre
-rw-r--r-- 1 root root   558 2008-01-02 00:50 local.cf
-rwxr--r-- 1 root root   776 2007-12-30 17:52 sare-sa-update-channels.txt
drwx-- 2 root root  4096 2008-01-08 02:00 sa-update-keys
-rw-r--r-- 1 root root62 2007-08-21 15:15 spamassassin-default.rc
-rwxr-xr-x 1 root root35 2007-08-21 15:15 spamassassin-helper.sh
-rw-r--r-- 1 root root55 2007-08-21 15:15 spamassassin-spamc.rc
-rw-r--r-- 1 root root  2603 2007-08-21 15:15 v310.pre
-rw-r--r-- 1 root root  1195 2007-08-21 15:15 v312.pre
-rw-r--r-- 1 root root  2416 2007-08-21 15:15 v320.pre
[EMAIL PROTECTED] ~]# 

Seems OK to me But is it?...

The thing that really mystifies me is that spammassassin --lint -D seems to
show that Botnet is installed correctly. It just doesn't hit anything?...

Thanks for your help so far...

AD






pgpDw0Hsr2cTY.pgp
Description: PGP signature

Re: Apache SpamAssassin 3.2.4

[Luis Hernán Otegui]

Hi

2008/1/11, Bret Miller <[EMAIL PROTECTED]>:
> > New upgrade is running GREAT here :)
>
> Running fine here on Windows Server 2003 with CommuniGate Pro. :)
>
>
Well, scan times went DOWN a LOT!!! According to Amavis-Logwatch:

===
 Timing Percentiles % Time   Total (s)0%5%
  25%   50%   75%   95%  100%
 
---
 SA check   92.66%   10750.540 0.040 0.068
3.009 4.130 5.934 9.61032.828
 SMTP DATA   1.74% 202.074 0.003 0.037
0.038 0.077 0.078 0.082 1.171
 fwd-end-chkpnt  1.41% 163.290 0.006 0.009
0.012 0.020 0.052 0.168 6.594
 ...
 
===
 Scan Time: Actual 100.00%   11601.872 0.142 0.207
0.387 3.776 5.606 9.21933.014
 Scan Time: Hypothetical   100.00%   11602.398 0.390 0.470
3.446 4.689 6.64410.72852.716

Timing for 75% used to be around 11-15 seconds. So it was a major
improvement what the Devel Team has done.

Thanks a lot!


Luis
-- 
-
GNU-GPL: "May The Source Be With You...
Linux Registered User #448382.
When I grow up, I wanna be like Theo...
-

Re: gpg keys?

[Jonas Eckerman]

(Please keep it on the list...)

Gene Heskett wrote:


PS. I'm very sceptical to the idea of --allowplugins.



Oh, openprotect seems to want it..


I know. I just think you should decide for yourself what plugins 
to load, rather than trust a third party. YMMV of course.
(Also, if the OpenProtect site gets hacked, allowing an automatic 
update to load plugins could get ugly.)


So, while I do use OpenProtect's channel, I don't specify the 
--allowplugins when updating.


Regards
/Jonas

--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/

Re: sa-update fails

[Jonas Eckerman]

>> (Please keep it on the list...)

Gene Heskett wrote:


Have you checked in the key ring to see that it's really there?



The command is cat, but what file?


I don't know from memory, but my guess is that reading the man 
pages would give an answer to this.


gone, but it also isn't updating anything either unless is both silent and 
damned fast.


It is silent unless there was a problem. To check wether it 
updated anything check the exit code (0 means there was an 
update). You can also check the contents of the update dir to see 
how new the stuff in there is.


Regards
/Jonas
--
Jonas Eckerman, FSDB & Fruktträdet
http://whatever.frukt.org/
http://www.fsdb.org/
http://www.frukt.org/

Re: Problem with handle_user

[Matt Kettler]

Matthew Goodman wrote:

I am also having this error in my spamd.log file.

Spamd is being run with:

SPAMD_OPTS="-c -d -v -m 40 -s local4 -q -u vpopmail 
--virtual-config-dir=/var/vpopmail/domains/%d/%l/.spamassassin/ -H

/var/vpopmail"

And spamc is being called by qmail-scanner-2.01 with /usr/bin/spamc -t 30

NONE of my per-user files are being read, and every single e-mail that comes
in I get the user unknown problem.

This didn't happen when I was using SpamAssassin 3.2.3



It should have. by passing -u vpopmail to spamd, you're telling it to 
*ALWAYS* scan mail as vpopmail, and ignore that which comes from spamc 
on a per-message basis.

Re: gpg keys?

[Gene Heskett]

On Saturday 12 January 2008, Arthur Dent wrote:
>On Fri, Jan 11, 2008 at 09:46:30PM -0500, Gene Heskett wrote:
>> That's possible I suppose.  In watching what pup wants to update, I've had
>> bigger fish than gpg to monitor.  Is there a history file I can consult to
>> find out?
>
>If you use a Red Hat based system try:
># cat /var/log/yum.log
>(as root).
>
>hth
>
Thanks Arther.
>AD



-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Stock's Observation:
You no sooner get your head above water but what someone pulls
your flippers off.

Re: gpg keys?

[Gene Heskett]

On Saturday 12 January 2008, Arthur Dent wrote:
>On Fri, Jan 11, 2008 at 09:46:30PM -0500, Gene Heskett wrote:
>> That's possible I suppose.  In watching what pup wants to update, I've had
>> bigger fish than gpg to monitor.  Is there a history file I can consult to
>> find out?
>
>If you use a Red Hat based system try:
># cat /var/log/yum.log
>(as root).
>
>hth
>
>AD

[EMAIL PROTECTED] ~]# grep gpg /var/log/yum.log
Jan 05 05:41:36 Installed: gpgme - 1.1.5-4.fc8.i386

So that was the guilty party..

-- 
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Stock's Observation:
You no sooner get your head above water but what someone pulls
your flippers off.

Re: gpg keys?

[Arthur Dent]

On Fri, Jan 11, 2008 at 09:46:30PM -0500, Gene Heskett wrote:
> 
> That's possible I suppose.  In watching what pup wants to update, I've had 
> bigger fish than gpg to monitor.  Is there a history file I can consult to 
> find out?

If you use a Red Hat based system try:
# cat /var/log/yum.log
(as root).

hth

AD



pgpbiQCMGqxd5.pgp
Description: PGP signature

Re: spamassassin 3.2.4, DKIM and DomainKeys

[Pascal Maes]

Le 11-janv.-08 à 18:00, Mark Martinec a écrit :


Pascal,


it seems that since my upgrade to spamassassin 3.2.4, the DKIM an
DomainKeys verifiers are no more used.

All I see in the debug test are the following line :

# spamassassin -D < testmail.txt |& grep -i dkim
[4163] dbg: plugin: loading Mail::SpamAssassin::Plugin::DKIM from  
@INC
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=uclouvain.be;  
h=from:to:

subject;


Are the baseline rules there, and normally accessible to the program?
Are there any failures reported in the debug log loading the rules?
Are you using sa-update, and if yes, did you run it after an upgrade?
The .cf files which activate Plugin::DKIM are in 25_dkim.cf and
60_whitelist_dkim.cf (and possibly elsewhere).

 Mark




Sorry, the From address was in a whitelist and as I'm also using  
shortcirucit, the dkim test was bypassed.


[31714] dbg: check: tests=USER_IN_WHITELIST


--
Pascal

Re: Anybody else frustrated by the iphone Mail application?

[Jari Fredriksson]

> If I'm not mistaken it doesn't show non standard headers
> and also doesn't appear to allow the viewing of mime
> attachments. So it's quite difficult to see exactly what
> the spam assassin headers/report look like from an
> iphone's native mail client. 

iPhone sucks. Nokia has models running Debian based linux, so you can have 
SpamAssassin online!