subject:"USER_IN_WHITELIST"

Re: USER_IN_WHITELIST shortcircuits VBOUNCE, please help...

2017-10-07 Thread RW

On Sat, 7 Oct 2017 07:27:00 -0700 (MST)
djkraz wrote:

> I have a user that is getting thousands of backscatter a minute for a
> couple days now.  I've tried everything I can find on the web to get
> vbounce working with no luck as the user is obviously in the
> whitelist since they exist on the server.  

USER_IN_WHITELIST is based on the sender address, and for backscatter
that's going to be on a series of random third-party domains. It seems
very unlikely that this is affecting backscatter - unless you've
whitelisted everything.  

SpamAssassin doesn't short-circuit by default, so if  VBOUNCE is
short-circuited by anything then it must be down to you own settings.

Re: USER_IN_WHITELIST shortcircuits VBOUNCE, please help...

2017-10-07 Thread John Hardin


On Sat, 7 Oct 2017, Antony Stone wrote:


On Saturday 07 October 2017 at 16:27:00, djkraz wrote:


I have a user that is getting thousands of backscatter a minute for a
couple days now.  I've tried everything I can find on the web to get
vbounce working with no luck as the user is obviously in the whitelist
since they exist on the server.  I've tried setting the priority of
vbounce higher but it doesn't seem to make any difference.  Does anyone
have any experience in resolving this?  FYI, I'm running Exchange 2013 on
Win2kR2 with Exchange Server Toolbox.  Thanks in advance!


Put an example (full headers as minimum, body not really important for this I
think) on pastebin or similar, post the link here and also show us your
vbounce settings so we can have an opinion.


The body of a bounce can be critical, if it has things like a SMTP status 
message or trace. Please provide a complete backscatter message.


Also: where and how exactly is vbounce hooked into Exchange? Or does 
"Exchange Server Toolkbox" answer that question? (Pardon my ignorance 
here.)


--
 John Hardin KA7OHZhttp://www.impsec.org/~jhardin/
 jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
---
  Ignorance is no excuse for a law.
---
 191 days since the first commercial re-flight of an orbital booster (SpaceX)

Re: USER_IN_WHITELIST shortcircuits VBOUNCE, please help...

2017-10-07 Thread Antony Stone

On Saturday 07 October 2017 at 16:27:00, djkraz wrote:

> I have a user that is getting thousands of backscatter a minute for a
> couple days now.  I've tried everything I can find on the web to get
> vbounce working with no luck as the user is obviously in the whitelist
> since they exist on the server.  I've tried setting the priority of
> vbounce higher but it doesn't seem to make any difference.  Does anyone
> have any experience in resolving this?  FYI, I'm running Exchange 2013 on
> Win2kR2 with Exchange Server Toolbox.  Thanks in advance!

Put an example (full headers as minimum, body not really important for this I 
think) on pastebin or similar, post the link here and also show us your 
vbounce settings so we can have an opinion.


Antony.

-- 
I wasn't sure about having a beard at first, but then it grew on me.

   Please reply to the list;
 please *don't* CC me.

USER_IN_WHITELIST shortcircuits VBOUNCE, please help...

2017-10-07 Thread djkraz

I have a user that is getting thousands of backscatter a minute for a couple
days now.  I've tried everything I can find on the web to get vbounce
working with no luck as the user is obviously in the whitelist since they
exist on the server.  I've tried setting the priority of vbounce higher but
it doesn't seem to make any difference.  Does anyone have any experience in
resolving this?  FYI, I'm running Exchange 2013 on Win2kR2 with Exchange
Server Toolbox.  Thanks in advance!



--
Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html

Re: USER_IN_WHITELIST

2016-07-07 Thread Sidney Markowitz

Lorenzo Thurman wrote on 8/07/16 9:26 AM:
> Thanks for the info. Does anyone know how I can use whitelistfrom_rcvd? I 
> can't find any clear answers via Google. 
> 

Excuse my typo for the correct spelling whitelist_from_rcvd.

To use it, look at the legitimate emails that you want to whitelist and check
the Received header that shows where your receiving mail server received the
email from the sending mail server. Typically for a corporate address like
microsoft.com the mail will have come from a host with a name like
smtp.microsoft.com or maila.microsoft.com. If the Received header does show
that the mail came from some ip address and also shows a host name for it in
the microsoft.com (for example) then you can use whitelist_from_recvd to
whitelist such mails. You can only put one address on a line, so you would
need two entries to get the two that you want:

whitelist_from_rcvd *@microsoft.com microsoft.com
whitelist_from_rcvd *.microsoft.com microsoft.com

But do check your emails to see if you get the proper Received headers to be
able to do this. Some mail servers do not do the reverse domain name lookup to
add the host name to the ip address in Received headers. Some email addresses
you may want to whitelist are not set up to reliably send from the same few
mail servers.

If somebody sends mail from a non-Microsoft mail server but with a
microsoft.com From address, it will not get whitelisted by this. That's
exactly what you want to not whitelist spammers who forge a microsoft.com
address.

 Sidney

Re: USER_IN_WHITELIST

2016-07-07 Thread Reindl Harald




Am 07.07.2016 um 23:26 schrieb Lorenzo Thurman:

Thanks for the info. Does anyone know how I can use whitelistfrom_rcvd? I can't 
find any clear answers via Google.


besides the typo the same way as the other whitelist options

the only difference is the second param with is the DNS-PTR of the 
sending host


whitelist_from_rcvd *@example.net example.com

look at the difference between .net / .com

when the PTR of the sending host ends with "example.com" sender 
"example.net" is fine

_

for subdomains

*@example.net
*@*.example.net
_

.example.net is imprtant because it dont match "somefucker-example.net"



signature.asc
Description: OpenPGP digital signature

Re: USER_IN_WHITELIST

2016-07-07 Thread Lorenzo Thurman



"My Break-Dancing days are over, but there's always the Funky Chicken" -- The 
Full Monty

> On Jul 7, 2016, at 3:57 PM, Sidney Markowitz  wrote:
> 
> Lorenzo Thurman wrote on 8/07/16 3:03 AM:
>>> On Jul 7, 2016, at 8:14 AM, Antony Stone 
>>>  wrote:
>>> \.microsoft\.com$ will match anything ending in ".microsoft.com"
> 
> RW already pointed this out, but to make sure nobody reading this thread
> misses it, the above is wrong because whitelist does not use regexps.
> 
> See
> https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html#whitelist_and_blacklist_options
> 
> where it says
> 
> "Whitelist and blacklist addresses are now file-glob-style patterns, so
> fri...@somewhere.com, *@isp.com, or *.domain.net will all work. Specifically,
> * and ? are allowed, but all other metacharacters are not. Regular expressions
> are not used for security reasons. Matching is case-insensitive.
> 
> Multiple addresses per line, separated by spaces, is OK. Multiple
> whitelist_from lines are also OK."
> 
> Notice the last example there. Spamassassin is parsing out the email addresses
> and matching them with the patterns so you don't have to do tricky stuff like
> *@*.microsoft.com. Specifically, you can use
> 
> whitelist_from *@microsoft.com *.microsoft.com
> 
> which will match what you want but will not match anyth...@onmicrosoft.com and
> will not match foo.microsoft@example.com
> 
> As the page also points out if you can figure out how to use
> whitelistfrom_rcvd instead of whitelist_from it will protect against spammers
> spoofing the From address. Whether you can do that depends on whether the
> domain you are whitelisting has restrictions on what servers can send mail 
> for it.
> 
> Sidney
> 
> 

Thanks for the info. Does anyone know how I can use whitelistfrom_rcvd? I can't 
find any clear answers via Google.

Re: USER_IN_WHITELIST

2016-07-07 Thread Sidney Markowitz

Lorenzo Thurman wrote on 8/07/16 3:03 AM:
>> On Jul 7, 2016, at 8:14 AM, Antony Stone
>> wrote:
>> \.microsoft\.com$ will match anything ending in ".microsoft.com"

RW already pointed this out, but to make sure nobody reading this thread
misses it, the above is wrong because whitelist does not use regexps.

See
https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html#whitelist_and_blacklist_options

where it says

"Whitelist and blacklist addresses are now file-glob-style patterns, so
fri...@somewhere.com, *@isp.com, or *.domain.net will all work. Specifically,
* and ? are allowed, but all other metacharacters are not. Regular expressions
are not used for security reasons. Matching is case-insensitive.

Multiple addresses per line, separated by spaces, is OK. Multiple
whitelist_from lines are also OK."

Notice the last example there. Spamassassin is parsing out the email addresses
and matching them with the patterns so you don't have to do tricky stuff like
*@*.microsoft.com. Specifically, you can use

whitelist_from *@microsoft.com *.microsoft.com

which will match what you want but will not match anyth...@onmicrosoft.com and
will not match foo.microsoft@example.com

As the page also points out if you can figure out how to use
whitelistfrom_rcvd instead of whitelist_from it will protect against spammers
spoofing the From address. Whether you can do that depends on whether the
domain you are whitelisting has restrictions on what servers can send mail for
it.

Sidney

Re: USER_IN_WHITELIST

2016-07-07 Thread RW

On Thu, 7 Jul 2016 10:03:37 -0500
Lorenzo Thurman wrote:

y
> 
> > On Jul 7, 2016, at 8:14 AM, Antony Stone
> >  wrote:

> > There's a big difference between subdomains, and domains with
> > letters in front of "microsoft".
> > 
> > \.microsoft\.com$ will match anything ending in ".microsoft.com"
> > 
> > That means it will match www.microsoft.com and cdn.microsoft.com
> > for example, but it will not match
> > kajsdhfkjasghdskghlaskfhmicrosoft.com or onmicrosoft.com
> > 
> > The dot in front of "microsoft" in the regex is important :)

> 
> Great, thanks. 

You can't use a regex in a whitelisting entry.

Re: USER_IN_WHITELIST

2016-07-07 Thread Lorenzo Thurman



"My Break-Dancing days are over, but there's always the Funky Chicken" -- The 
Full Monty

> On Jul 7, 2016, at 8:14 AM, Antony Stone 
>  wrote:
> 
> On Thursday 07 July 2016 at 15:08:44, Lorenzo Thurman wrote:
> 
>>> On Jul 7, 2016, at 7:15 AM, Reindl Harald  wrote:
 Am 07.07.2016 um 14:12 schrieb Joe Quinn:
 In addition to the above, it's easy for a spammer to register something
 like kajsdhfkjasghdskghlaskfhmicrosoft.com which would also be
 whitelisted for you. I would recommend against using wildcard whitelist
 patterns like that
>>> 
>>> should at least look similar to that:
>>> ^.*\.microsoft\.com$
>>> 
>>> well the ^ followed by .* is also pointless
>> 
>> I see. Thanks for the tip, I'll make changes. The reason I did wild cards
>> was so that I could also capture us domains. Is there a rule that allows
>> me to get subdomains w/o opening myself like I have?
> 
> There's a big difference between subdomains, and domains with letters in 
> front 
> of "microsoft".
> 
> \.microsoft\.com$ will match anything ending in ".microsoft.com"
> 
> That means it will match www.microsoft.com and cdn.microsoft.com for example, 
> but it will not match kajsdhfkjasghdskghlaskfhmicrosoft.com or onmicrosoft.com
> 
> The dot in front of "microsoft" in the regex is important :)
> 
> 
> Antony.
> 
> -- 
> Tax inspectors are just accountants who work for the evil dictators of 
> democracy.
> 
>   Please reply to the list;
> please *don't* CC me.

Great, thanks.

Re: USER_IN_WHITELIST

2016-07-07 Thread RW

On Thu, 7 Jul 2016 08:08:44 -0500
Lorenzo Thurman wrote:

> > 
> > well the ^ followed by .* is also pointless  
> 
> 
> I see. Thanks for the tip, 

It wasn't really a tip. The globs (wildcards) get converted into
regularly expressions that aren't quite as mimimalist as the could be
- but that's not under your control. 

> I'll make changes. The reason I did wild
> cards was so that I could also capture us domains. Is there a rule
> that allows me to get subdomains w/o opening myself like I have?

You need a separate entry, something like *.microsoft.com.

Re: USER_IN_WHITELIST

2016-07-07 Thread Antony Stone

On Thursday 07 July 2016 at 15:08:44, Lorenzo Thurman wrote:

> > On Jul 7, 2016, at 7:15 AM, Reindl Harald  wrote:
> >> Am 07.07.2016 um 14:12 schrieb Joe Quinn:
> >> In addition to the above, it's easy for a spammer to register something
> >> like kajsdhfkjasghdskghlaskfhmicrosoft.com which would also be
> >> whitelisted for you. I would recommend against using wildcard whitelist
> >> patterns like that
> > 
> > should at least look similar to that:
> > ^.*\.microsoft\.com$
> > 
> > well the ^ followed by .* is also pointless
> 
> I see. Thanks for the tip, I'll make changes. The reason I did wild cards
> was so that I could also capture us domains. Is there a rule that allows
> me to get subdomains w/o opening myself like I have?

There's a big difference between subdomains, and domains with letters in front 
of "microsoft".

\.microsoft\.com$ will match anything ending in ".microsoft.com"

That means it will match www.microsoft.com and cdn.microsoft.com for example, 
but it will not match kajsdhfkjasghdskghlaskfhmicrosoft.com or onmicrosoft.com

The dot in front of "microsoft" in the regex is important :)


Antony.

-- 
Tax inspectors are just accountants who work for the evil dictators of 
democracy.

   Please reply to the list;
 please *don't* CC me.

Re: USER_IN_WHITELIST

2016-07-07 Thread RW

On Thu, 7 Jul 2016 14:15:18 +0200
Reindl Harald wrote:


> should at least look similar to that:
> ^.*\.microsoft\.com$
> 
> well the ^ followed by .* is also pointless

It's generated from a glob in the configuration.

Re: USER_IN_WHITELIST

2016-07-07 Thread Lorenzo Thurman



"My Break-Dancing days are over, but there's always the Funky Chicken" -- The 
Full Monty

> On Jul 7, 2016, at 7:15 AM, Reindl Harald  wrote:
> 
> 
> 
>> Am 07.07.2016 um 14:12 schrieb Joe Quinn:
>>> On 7/6/2016 11:42 PM, Bill Cole wrote:
>>> On 6 Jul 2016, at 23:10, lorenzo wrote:
>>> 
>>> [...]
 The output from spamassassin -t -D < In-whitelist.txt gives the
 answer, I believe:
 
 address hefg...@hkjhkjhk.onmicrosoft.com matches whitelist or
 blacklist regexp: ^.*microsoft\.com$
 
 Very sneaky. I think I can handle this one from here.
 Thanks again.
>>> 
>>> Happy to be of help.
>>> 
>>> For what it's worth: *.onmicrosoft.com domains are part of free trials
>>> of Office365 and generate almost entirely spam. I suppose one could be
>>> a regular paying O365 customer and keep that free domain, but no one
>>> who does that can care much about their email. Spammers have been
>>> using those domains for years and MS really seems not to care about
>>> the fact that they've become a de facto indication of spam.
>> In addition to the above, it's easy for a spammer to register something
>> like kajsdhfkjasghdskghlaskfhmicrosoft.com which would also be
>> whitelisted for you. I would recommend against using wildcard whitelist
>> patterns like that
> 
> should at least look similar to that:
> ^.*\.microsoft\.com$
> 
> well the ^ followed by .* is also pointless


I see. Thanks for the tip, I'll make changes. The reason I did wild cards was 
so that I could also capture us domains. Is there a rule that allows me to get 
subdomains w/o opening myself like I have?
>

Re: USER_IN_WHITELIST

2016-07-07 Thread Reindl Harald




Am 07.07.2016 um 14:12 schrieb Joe Quinn:

On 7/6/2016 11:42 PM, Bill Cole wrote:

On 6 Jul 2016, at 23:10, lorenzo wrote:

[...]

The output from spamassassin -t -D < In-whitelist.txt gives the
answer, I believe:

address hefg...@hkjhkjhk.onmicrosoft.com matches whitelist or
blacklist regexp: ^.*microsoft\.com$

Very sneaky. I think I can handle this one from here.
Thanks again.


Happy to be of help.

For what it's worth: *.onmicrosoft.com domains are part of free trials
of Office365 and generate almost entirely spam. I suppose one could be
a regular paying O365 customer and keep that free domain, but no one
who does that can care much about their email. Spammers have been
using those domains for years and MS really seems not to care about
the fact that they've become a de facto indication of spam.

In addition to the above, it's easy for a spammer to register something
like kajsdhfkjasghdskghlaskfhmicrosoft.com which would also be
whitelisted for you. I would recommend against using wildcard whitelist
patterns like that


should at least look similar to that:
^.*\.microsoft\.com$

well the ^ followed by .* is also pointless



signature.asc
Description: OpenPGP digital signature

Re: USER_IN_WHITELIST

2016-07-07 Thread Joe Quinn


On 7/6/2016 11:42 PM, Bill Cole wrote:

On 6 Jul 2016, at 23:10, lorenzo wrote:

[...]
The output from spamassassin -t -D < In-whitelist.txt gives the 
answer, I believe:


address hefg...@hkjhkjhk.onmicrosoft.com matches whitelist or 
blacklist regexp: ^.*microsoft\.com$


Very sneaky. I think I can handle this one from here.
Thanks again.


Happy to be of help.

For what it's worth: *.onmicrosoft.com domains are part of free trials 
of Office365 and generate almost entirely spam. I suppose one could be 
a regular paying O365 customer and keep that free domain, but no one 
who does that can care much about their email. Spammers have been 
using those domains for years and MS really seems not to care about 
the fact that they've become a de facto indication of spam.
In addition to the above, it's easy for a spammer to register something 
like kajsdhfkjasghdskghlaskfhmicrosoft.com which would also be 
whitelisted for you. I would recommend against using wildcard whitelist 
patterns like that.

Re: USER_IN_WHITELIST

2016-07-06 Thread Bill Cole


On 6 Jul 2016, at 23:10, lorenzo wrote:

[...]
The output from spamassassin -t -D < In-whitelist.txt gives the 
answer, I believe:


address hefg...@hkjhkjhk.onmicrosoft.com matches whitelist or 
blacklist regexp: ^.*microsoft\.com$


Very sneaky. I think I can handle this one from here.
Thanks again.


Happy to be of help.

For what it's worth: *.onmicrosoft.com domains are part of free trials 
of Office365 and generate almost entirely spam. I suppose one could be a 
regular paying O365 customer and keep that free domain, but no one who 
does that can care much about their email. Spammers have been using 
those domains for years and MS really seems not to care about the fact 
that they've become a de facto indication of spam.

Re: USER_IN_WHITELIST

2016-07-06 Thread lorenzo


> On Jul 6, 2016, at 8:50 PM, Bill Cole 
> <sausers-20150...@billmail.scconsult.com> wrote:
> 
> On 6 Jul 2016, at 21:13, Lorenzo Thurman wrote:
> 
>> I’ve been receiving some spam where spamassassin identifies the sender with 
>> USER_IN_WHITELIST. These senders (or domains) are most definitely not in my 
>> whitelist. How can I get around this problem?
> 
> There are so many relevant variables unspecified that no one here has any 
> hope of solving your problem.
> 
> To make it easier for us, please provide more information:
> 
> 1. How are you using SpamAssassin? Specifically, if you have it hooked into 
> an MTA like Postfix or Sendmail, tell us which one AND what mechanism you are 
> using to integrate SA and the MTA.
> 
> 2. If your system involved the use of spamd, what are its arguments and what 
> user is it running as?
> 
> 3. If you scan a message with this problem manually by piping it into 
> 'spamassassin -t -D' what does the resulting flood of debugging information 
> say about what address it is finding as being in the whitelist?
> 

Ah, ok. Here’s some info:
spamassassin v3.4.0 - Postfix 2.11.0  Ubuntu 14.04
/usr/sbin/spamd --create-prefs --max-children 5 --helper-home-dir -d 
--pidfile=/var/run/spamd.pid

In /etc/postfix/master.cf
smtp  inet  n   -   -   -   -   smtpd -vvv -o 
content_filter=spamassassin
spamassassin unix - n   n   -   -   pipe flags=Rq 
user=nobody argv=/usr/bin/spamfilter.sh -oi -f ${sender} ${recipient}

The output from spamassassin -t -D < In-whitelist.txt gives the answer, I 
believe:

address hefg...@hkjhkjhk.onmicrosoft.com matches whitelist or blacklist regexp: 
^.*microsoft\.com$

Very sneaky. I think I can handle this one from here.
Thanks again.

Re: USER_IN_WHITELIST

2016-07-06 Thread Bill Cole

On 6 Jul 2016, at 21:58, David B Funk wrote:

> On Wed, 6 Jul 2016, Lorenzo Thurman wrote:
>
>> I’ve been receiving some spam where spamassassin identifies the sender with 
>> USER_IN_WHITELIST. These senders (or domains) are
>> most definitely not in my whitelist. How can I get around this problem?Thanks
>>
>
> SpamAssassin comes with some built-in whitelists (which should be pretty safe 
> to
> use). Look in your SA rules kit for things like: 60_whitelist.cf 
> 60_whitelist_dkim.cf and 60_whitelist_spf.cf

Those should not cause USER_IN_WHITELIST matches but rather 
USER_IN_DEF_WHITELIST and similarly labeled forms of the SPF and DKIM 
variations.


signature.asc
Description: OpenPGP digital signature

Re: USER_IN_WHITELIST

2016-07-06 Thread David B Funk


On Wed, 6 Jul 2016, Lorenzo Thurman wrote:


I’ve been receiving some spam where spamassassin identifies the sender with 
USER_IN_WHITELIST. These senders (or domains) are
most definitely not in my whitelist. How can I get around this problem?Thanks



SpamAssassin comes with some built-in whitelists (which should be pretty safe to
use). Look in your SA rules kit for things like: 60_whitelist.cf 
60_whitelist_dkim.cf and 60_whitelist_spf.cf

You might also have some 3'rd party rules files that contain whitelists.

You can explicitly negate the effect of an entry from one of these files by
using the appropriate "unwhitelist_from" type configuration statements in your
local.cf config files.

Theoretically you could edit the system config files but those edits could be
lost with the next system rules update, so using the unwhitelist_from technique
is the way to go.

--
Dave Funk  University of Iowa
College of Engineering
319/335-5751   FAX: 319/384-0549   1256 Seamans Center
Sys_admin/Postmaster/cell_adminIowa City, IA 52242-1527
#include 
Better is not better, 'standard' is better. B{

smime.p7s
Description: S/MIME Cryptographic Signature

Re: USER_IN_WHITELIST

2016-07-06 Thread Bill Cole


On 6 Jul 2016, at 21:13, Lorenzo Thurman wrote:

I’ve been receiving some spam where spamassassin identifies the 
sender with USER_IN_WHITELIST. These senders (or domains) are most 
definitely not in my whitelist. How can I get around this problem?


There are so many relevant variables unspecified that no one here has 
any hope of solving your problem.


To make it easier for us, please provide more information:

1. How are you using SpamAssassin? Specifically, if you have it hooked 
into an MTA like Postfix or Sendmail, tell us which one AND what 
mechanism you are using to integrate SA and the MTA.


2. If your system involved the use of spamd, what are its arguments and 
what user is it running as?


3. If you scan a message with this problem manually by piping it into 
'spamassassin -t -D' what does the resulting flood of debugging 
information say about what address it is finding as being in the 
whitelist?

USER_IN_WHITELIST

2016-07-06 Thread Lorenzo Thurman

I’ve been receiving some spam where spamassassin identifies the sender with 
USER_IN_WHITELIST. These senders (or domains) are most definitely not in my 
whitelist. How can I get around this problem?
Thanks

1 2 >

1 - 100 of 129 matches

Mail list logo