Anti-Spam SMTP Proxy Server

ASSP development mailing list <assp-test@...>
schreibt:
>The very latest.
>
>our $VERSION = "2.7.5.6";
>our $modversion = '(1.0.00)';

There are some cosmetic changes in the very latest 2.7.5.7 (reporting
start and end to assp-log), but sorry, I am unable to reproduce the
reported behaviour.

I don't think it was a problem with rebuildspamdb.pl, but rather
something in assp.pl (when making the call to rebuildspamdb.pl).

Kind Regards,
Brett

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Thursday, July 29, 2010 11:03 AM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] ASSP 1.7.5.8 Rebuildspamdb
>
> There are some cosmetic changes in the very latest 2.7.5.7 (reporting
> start and end to assp-log), but sorry, I am unable to reproduce the
> reported behaviour.

ASSP development mailing list <assp-test@...>
schreibt:
>I don't think it was a problem with rebuildspamdb.pl, but rather
>something in assp.pl (when making the call to rebuildspamdb.pl).


I know, therefore my question for the version. Older versions of
rebuildspamdb.pl do not fork, by that blocking the process for assp.
That would cause the main-loop timeout.
Does the scheduling of rebuildspamdb work besides the starting with
"run now"?

Hi Fritz,

Sorry for the confusion in the subject of the email, I'm using ASSP
1.7.5.8(0.0.01) with, now, rebuildspamdb.pl version 2.7.5.7(1.0.00).
In ASSP, when I schedule rebuildspamdb to run at say 7.5|12.5, it does
not run and I did not see any errors in the regular log.  I have not
tried running it at 7|12, for example.

Kind Regards,
Brett

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Thursday, July 29, 2010 1:33 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] ASSP 1.7.5.8 Rebuildspamdb
>
> I know, therefore my question for the version. Older versions of
> rebuildspamdb.pl do not fork, by that blocking the process for assp.
> That would cause the main-loop timeout.
> Does the scheduling of rebuildspamdb work besides the starting with
> "run now"?

ASSP development mailing list <assp-test@...>
schreibt:
rebuildspamdb to run at say 7.5|12.5


I thought the description is clear: ASSP uses scheduled hours to run
RebuildSpamdb.pl. For example '6|18' will run rebuildspamdb.pl at 6.00
and 18.00.


I do not plan to allow 7.5

No harm in asking I suppose, though it would be nice!  I've always run
mine at those times because it gives me a little while to get into the
office and work through emails before it runs.  I guess I'll just go
back to the Windows scheduler.  

Thanks!
Brett

> -----Original Message-----
> From: Fritz Borgstedt [mailto:fb@...]
> Sent: Thursday, July 29, 2010 3:37 PM
> To: ASSP development mailing list
> Subject: Re: [Assp-test] ASSP 1.7.5.8 Rebuildspamdb
> 
> I thought the description is clear: ASSP uses scheduled hours to run
> RebuildSpamdb.pl. For example '6|18' will run rebuildspamdb.pl at 6.00
> and 18.00.
> 
> 
> I do not plan to allow 7.5

ASSP development mailing list <assp-test@...>
schreibt:
>No harm in asking I suppose, though it would be nice!  I've always run
>mine at those times because it gives me a little while to get into the
>office and work through emails before it runs.  I guess I'll just go
>back to the Windows scheduler.  


I do not understand. You cannot run it at 8 ?

What version of rebuildspamdb.pl do you run?

Hi

Over the past week that is exactly what I have been seeing.

The spammers have properly configured mail servers so spf is passing, gl is 
no problem and their ip is no problem

I believe it's called snowshoeing because after I made a list of all the 
ip's of those spam emails that made it to my inbox, later in the day, those 
same ip's where then found in various rbl's

Dale


----- Original Message ----- 
From: "Grayhat" <grayhat@...>
To: "ASSP development mailing list" <assp-test@...>
Sent: Saturday, July 24, 2010 1:46 AM
Subject: Re: [Assp-test] A better way to skip delaying...


>
>> Any properly configured mailserver would have NO problems with the GL
>> since such a server will just retry as needed, so in those cases the GL
>> will be of NO help and will just delay email delivery or cause issues in
>> case the sender uses a pool of IPs, the GL is *only* useful with spambots
>> and "fire & forget" senders and does NOT have any effect of whatever
>> regular SMTP server
>
> The only significant effect in case spammers would start using "well
> configured MTAs" would be slightly delaying the sending but in such
> a case the sending MTA would just retry and, since in many cases
> spammers use "abused machines" they won't have so much issues
> with that... w/o considering that a "well configured" box should then
> have a static IP, correct HELO and PTR, an SPF record and an MX
> one and at that point if it will start spamming it would end up into
> some blacklists in a matter of hours (at max) and the spammers
> would need to set up everything again; so, when it comes to any
> regular SMTP the GL is almost useless; on the other hand it may
> (and does) cause issues due to "sender pools", that's why ASSP
> has a "nodelay" option to enter hosts/senders which won't like the
> GL; the approach is ok, but mantaining such a list is a royal PITA
> instead, using the approach I'm suggesting it will be "automagic"
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
> ---
> Filter service subscribers can train this email as spam or not-spam here: 
> http://my.email-as.net/spamham/cgi-bin/learn.pl?messageid=119AA900970011DFB946834193ED0201

> I believe it's called snowshoeing because 

spamhaus and some others BLs are already blocking those
and btw ASSP should just be able to reject that junk w/o any
problems, as long as you use the bayes filter and configured
all the other stuff as needed, otherwise... you get what you
deserve (sorry but I had to say it); see, the dnsbl, uribl and
all the other checks are there just to avoid wasting CPU
cycles so that only messages passing the other checks
will reach the bayes filter which is the one which should
make the difference... assuming it's enabled and it has
properly been trained

>> I believe it's called snowshoeing because 
 
> spamhaus and some others BLs are already blocking those
> and btw ASSP should just be able to reject that junk w/o any

just in case http://www.spamhaus.org/news.lasso?article=646
and this includes spamhaus ZEN and DBL

Hi

When I did a manual check, the ip and domains were not listed until later in 
the day.

ASSP didn't block them but most likely it's what I was talking about 
yesterday with the image spam as these were all image spam

Thanks, I appreciate any and all suggestions and feedback

Dale



----- Original Message ----- 
From: "Grayhat" <grayhat@...>
To: "ASSP development mailing list" <assp-test@...>
Sent: Saturday, July 24, 2010 7:49 AM
Subject: Re: [Assp-test] A better way to skip delaying...


>
>>> I believe it's called snowshoeing because
>
>> spamhaus and some others BLs are already blocking those
>> and btw ASSP should just be able to reject that junk w/o any
>
> just in case http://www.spamhaus.org/news.lasso?article=646
> and this includes spamhaus ZEN and DBL
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test
>
>
> ---
> Filter service subscribers can train this email as spam or not-spam here: 
> http://my.email-as.net/spamham/cgi-bin/learn.pl?messageid=B7471140973211DFBC79C92D93ED0201

Is there a way to turn this off ?

On Sun, 2010-07-25 at 09:32 +0200, Thomas Eckardt wrote:
> V2 is doing this for SPF - for SenderBase I'll implement this. But
> the 
> complete SPF-Cache is somehow not working as expected - this will be 
> improved.
> 
> Thomas
> 
> 
>

>Is there a way to turn this off ?

First - even legit MTA's have to pass delaying only one time per ip+domain 
(the delaywhite tuplet). If such tuplet is known by assp, delaying is 
switched off for all mails that matches 'ip+domain'.
Only if 'DelayExpireOnSpam' is set to on, those tuplets will be deleted, 
if a MTA sends a mail (for 'ip+domain') that is considered as spam.

The delay behavior in 2.0.2_1.1.20 will be changed for the following 
cases:

Delaying for 'SPF-Cache-OK' (1) and 'White-SenderBase-Cache-OK' (2) will 
be skipped, if 'DelayWL' is switched off. 
The SPF-Cache is changed from 'IP only' to a 'IP+domain' base (which was 
an issue all the time for the complete SPF-Cache management).
If the senders domain differs from the one in the 
'White-SenderBase-Cache-OK' entry, the senders domain will be set to a 
temporary equal state to the orig 'White-SenderBase-Cache-OK' entry. This 
entry (state) will be lost after each assp restart or if the SB-Cache 
entry is deleted by the cache cleanup routine.

(1) - skip if: 'DelayWL' is switched off    -and-    the cached SPF result 
is 'pass'    -and-     the used HELO is equal to the SPF-cached HELO -and- 
   the IP is not in PBBlack (has no historical score)

(2) - skip if: 'DoOrgWhiting' is set to 'whiting'  -and-   'DelayWL' is 
switched off   -and-   the domain is in the whiteSenderBase-Cache  -and-  
the IP is not in PBBlack (has no historical score)

Thomas










Von:    Paul Schutte <paul@...>
An:     ASSP development mailing list <assp-test@...>
Datum:  25.07.2010 13:33
Betreff:        Re: [Assp-test] A better way to skip delaying...




Is there a way to turn this off ?

On Sun, 2010-07-25 at 09:32 +0200, Thomas Eckardt wrote:
> V2 is doing this for SPF - for SenderBase I'll implement this. But
> the 
> complete SPF-Cache is somehow not working as expected - this will be 
> improved.
> 
> Thomas
> 
> 
> 


------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
_______________________________________________
Assp-test mailing list
Assp-test@...
https://lists.sourceforge.net/lists/listinfo/assp-test




DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally 
privileged and protected in law and are intended solely for the use of the 

individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no 
known virus in this email!
*******************************************************

> Spammers know by now that SPF does help them to get their
> spam delivered. (No graylisting,get bonus points etc)

Fine, but to use GL they need to use a fixed IP/MX/netblock
and this in turn means that DNSBLs may *easily* cut out their
business in a matter of hours (not kidding)

> I see spam coming through with legitimate SPF records.

If emails pass your filtering just since the SPF record is ok then
you probably have some config issues elsewhere, SPF isn't
(and NEVER was) meant as a way to filter spam, just as a way
to let "the world" know which IPs are allowed to send emails
on the behalf of a given domain... and btw the same may be
told about graylisting (delaying if you prefer), sure, a bunch of
wannabe "admins" and hairdresser just adopted it since there
was no effort in doing so, but they never really understood why
it works and what it is for

> Maybe you are right and this will accomplish very little, but maybe it
> does deter some spam.

The "maybe" belongs elsewhere, if you've been enough on
computing and you're still using "maybe" then either you don't
have all your ducks in a row when it comes to take some decision
or you didn't really grab the way things work

> Is there a way to turn this off ?

Paul... sounds like you're willing to delay legit MTAs
I wonder why you're willing to do that even knowing
it will NOT give you ANY benefit and will just delay
routing for legit emails.

It seems like you didn't get the idea that the delaying
has NO effect on regular MTAs; also, keep in mind
that skipping the delay for those won't mean letting
spam through

Spammers know by now that SPF does help them to get their spam
delivered. (No graylisting,get bonus points etc)

I see spam coming through with legitimate SPF records.

I know that I can all day long keep watching the log and block each
domain manually. 

I want to help those domains in strictSPFRe and blockstrictSPFRe and
block SPF fail (and maybe softfail) and pretty much ignore SPF for the
rest (including those that pass).

I know it is debatable whether a spammer will have a valid SPF record
and not a server that retries on soft errors.

Maybe you are right and this will accomplish very little, but maybe it
does deter some spam.


On Mon, 2010-07-26 at 09:37 +0200, GrayHat wrote:
> > Is there a way to turn this off ?
> 
> Paul... sounds like you're willing to delay legit MTAs
> I wonder why you're willing to do that even knowing
> it will NOT give you ANY benefit and will just delay
> routing for legit emails.
> 
> It seems like you didn't get the idea that the delaying
> has NO effect on regular MTAs; also, keep in mind
> that skipping the delay for those won't mean letting
> spam through
> 
> 
> 
> ------------------------------------------------------------------------------
> The Palm PDK Hot Apps Program offers developers who use the
> Plug-In Development Kit to bring their C/C++ apps to Palm for a share 
> of $1 Million in cash or HP Products. Visit us here for more details:
> http://ad.doubleclick.net/clk;226879339;13503038;l?
> http://clk.atdmt.com/CRS/go/247765532/direct/01/
> _______________________________________________
> Assp-test mailing list
> Assp-test@...
> https://lists.sourceforge.net/lists/listinfo/assp-test