Re: SPAM Filtering from lists/digest

George R.Kasica <[email protected]>
Newsgroups gmane.mail.majordomo.general
Organization Netwrx Consulting Inc.
Message-ID <[email protected]> 
Just a follow up to the below issue I've been seeing.

I have put together a small shell program that runs via cron every 5
minutes and scans the Digests directory contents for anything flagged
as spam and deletes it. This seems like it will prevent it from
getting included on the digests. I'm curious if this one line test
could somehow get included into the main majordomo process to look at
the items before its ever written to the directory or possibly in the
digest creation process to stop it there. I'm just thinking it would
be possible though unlikely that a spam could get into the directory
and kick off a digest in that 5 minute period between runs.

Here is what I run to test....any thoughts on how or where this could
get included??

grep 'X-Spam-Status: YES' /home/majordom/Digests/skunk-works-digest/*
| awk -F: '{ print $1 }' | /usr/local/bin/xargs rm 

Thanks,
George

>On Thu, 31 Mar 2005 20:57:14 -0600, you wrote:

>>On Wed, 30 Mar 2005 13:01:17 -0800 (PST), you wrote:
>
>>On Wed, 30 Mar 2005, George R.Kasica wrote:
>>
>>> Date: Wed, 30 Mar 2005 12:37:55 -0600
>>> From: George R.Kasica <[email protected]>
>>> To: [email protected]
>>> Subject: SPAM Filtering from lists/digest
>>> 
>>> Just curious, how can I filter to prevent spam from getting on my
>>> various lists and or digests? I'm running SpamAssassin 3.0.2 and
>>> getting things tagged as SPAM **** and the spam tag set to yes, and
>>> then using the taboo header setting to block it. 
>>> 
>>> It seems to catch most things, but I still seem to end up with spam in
>>> digests (clearly tagged as spam) as if its eiter missing the taboo
>>> header check sometimes or someone is sending directly to the digests
>>> rather than posting to the list. I have the digest postings restricted
>>> to just list members.
>>> 
>>> Any suggestions? If someone needs headers or examples I can provide
>>> that.
>>
>>Have you used the taboo header setting in listname-digest.config also,
>>or just in listname.config?
>
>Here are the settings for the "regular" list:
>
>        # taboo_headers        [regexp_array] (undef) <resend>
>        # If any of the headers matches one of these regexps, then the
>        # message will be bounced for review.
>taboo_headers       <<  END
>/^X-Spam-Status: Yes/i
>/^X-Spam-Flag: YES/i
>/^X-Spam-Level: \*\*\*\*\*\*/i
>END
>
>
>and the corresponding digest:
>
>        # taboo_headers        [regexp_array] (undef) <resend>
>        # If any of the headers matches one of these regexps, then the
>        # message will be bounced for review.
>taboo_headers       <<  END
>/^X-Spam-Status: Yes/i
>/^X-Spam-Flag: YES/i
>/^X-Spam-Level: \*\*\*\*\*\*/
>-
> 
>END
>
>I see a difference here and have edited that to match all the other
>digests and lists which are like the first one. Could that be the
>cause of the spam getting in? If not, what other steps can I take to
>filter this out short of moderating the lists. I'm also currently
>preventing MIME on the lists, but it seems as if the spammers can get
>the stuff through somehow. I tested posting a MIME attach to each list
>and it was stripped. Is is possible they are sending to one of the
>majordomo or list-owner or outgoing addresses and somehow bypassing
>the scans, etc?
>
>
>Here is a header from one list message that is clearly marked as spam
>yet ended up in my digest directory...it seems like they are sending
>to the digestify address directly.....this seems to be the "methodf
>used for all the spam that gets through...HELP!
>
>[root@eagle acg-l-digest]# more 001
>>From [email protected] Fri Mar 11 07:37:50 2005
>Received: from mail by eagle.netwrx1.com with spam-scanned (Exim 3.36
>#1)
>        id 1D9kKj-00049Y-00; Fri, 11 Mar 2005 07:37:45 -0600
>Received: from [61.177.119.253] (helo=68.248.203.41)
>        by eagle.netwrx1.com with smtp (Exim 3.36 #1)
>        id 1D9kKS-00049P-00; Fri, 11 Mar 2005 07:37:27 -0600
>X-Message-Info: 09ZUSUvrbtu59725CHLJHlbbzjMZEMXRDcf+3548
>Received: from [email protected] ([101.80.150.24]) by
>uit5631-bmf.
>61.177.119.253 with Microsoft SMTPSVC(5.0.2195.6824);
>         Fri, 11 Mar 2005 16:34:14 +0300
>Message-ID: [email protected]
>Conversion-With-Loss: Yes
>Sensitivity: 3
>Expiry-Date: Never
>Xref: wwgdlcfubvnyopgjzxrn
>Reply-To: "Rosa Joseph" <[email protected]>
>From: "Rosa Joseph" <[email protected]>
>To: [email protected], [email protected]
>Subject: ***** SPAM ***** market you healthcare products to all
>hospitals.7,000 
>Senior Hospitals,, 172,000 Senior Hospital Administrators and doctors.
>Date: Fri, 11 Mar 2005 19:28:14 +0600
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>[root@eagle acg-l-digest]# more 001
>>From [email protected] Fri Mar 11 07:37:50 2005
>Received: from mail by eagle.netwrx1.com with spam-scanned (Exim 3.36
>#1)
>        id 1D9kKj-00049Y-00; Fri, 11 Mar 2005 07:37:45 -0600
>Received: from [61.177.119.253] (helo=68.248.203.41)
>        by eagle.netwrx1.com with smtp (Exim 3.36 #1)
>        id 1D9kKS-00049P-00; Fri, 11 Mar 2005 07:37:27 -0600
>X-Message-Info: 09ZUSUvrbtu59725CHLJHlbbzjMZEMXRDcf+3548
>Received: from [email protected] ([101.80.150.24]) by
>uit5631-bmf.
>61.177.119.253 with Microsoft SMTPSVC(5.0.2195.6824);
>         Fri, 11 Mar 2005 16:34:14 +0300
>Message-ID: [email protected]
>Conversion-With-Loss: Yes
>Sensitivity: 3
>Expiry-Date: Never
>Xref: wwgdlcfubvnyopgjzxrn
>Reply-To: "Rosa Joseph" <[email protected]>
>From: "Rosa Joseph" <[email protected]>
>To: [email protected], [email protected]
>Subject: ***** SPAM ***** market you healthcare products to all
>hospitals.7,000 
>Senior Hospitals,, 172,000 Senior Hospital Administrators and doctors.
>Date: Fri, 11 Mar 2005 19:28:14 +0600
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>        boundary="--35091972050672979"
>X-Scanner: exiscan *1D9kKS-00049P-00*zgNVjVp6L5M* (Netwrx Consulting
>Inc., Jacks
>on, WI USA) 
>X-Spam-Prev-Subject: market you healthcare products to all
>hospitals.7,000 Senio
>r Hospitals,, 172,000 Senior Hospital Administrators and doctors.
>X-Spam-Flag: YES
>X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
>eagle.netwrx1.com
>X-Spam-Level: ******************************
>X-Spam-Status: Yes, score=30.4 required=5.0 tests=BAYES_50,DCC_CHECK,
>        DIGEST_MULTIPLE,FORGED_HOTMAIL_RCVD,INVALID_MSGID,
>        MIME_BOUND_DD_DIGITS,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,
>        RCVD_HELO_IP_MISMATCH,RCVD_IN_DSBL,RCVD_IN_NJABL_DUL,
>
>RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RCVD_IN_XBL,RCVD_NUMERIC_HELO,
>
>SARE_HEAD_HDR_CONVWLS,SARE_HEAD_HDR_EXPRYDT,SARE_HEAD_HDR_XREF,
>        X_MESSAGE_INFO autolearn=spam version=3.0.2
>X-Spam-Report: 
>        *  1.1 SARE_HEAD_HDR_CONVWLS Message headers used which
>identify spam
>        *  0.5 SARE_HEAD_HDR_XREF Message headers used which identify
>spam
>        *  4.2 X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info)
>found
>        *  4.1 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
>        *  0.5 SARE_HEAD_HDR_EXPRYDT Message headers used which
>identify spam
>        *  2.5 FORGED_HOTMAIL_RCVD Forged hotmail.com 'Received:'
>header found
>        *  2.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not
>match, but sho
>uld
>        *  1.2 RCVD_NUMERIC_HELO Received: contains an IP address used
>for HELO
>        *  0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
>        *      [score: 0.5002]
>        *  0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence
>level above 
>50%
>        *      [cf: 100]
>        *  1.5 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
>        *  2.2 DCC_CHECK Listed in DCC
>(http://rhyolite.com/anti-spam/dcc/)
>        *  2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from
>dynamic IP addre
>ss
>        *      [61.177.119.253 listed in dnsbl.sorbs.net]
>        *  3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
>        *      [<http://dsbl.org/listing?61.177.119.253>]
>        *  3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
>        *      [61.177.119.253 listed in sbl-xbl.spamhaus.org]
>        *  0.0 RCVD_IN_SORBS_WEB RBL: SORBS: sender is a abuseable web
>server
>        *      [61.177.119.253 listed in dnsbl.sorbs.net]
>        *  0.1 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did
>non-local SMTP
>        *      [61.177.119.253 listed in combined.njabl.org]
>        *  0.1 DIGEST_MULTIPLE Message hits more than one network
>digest check
>        *  1.1 INVALID_MSGID Message-Id is not valid, according to RFC
>2822
> 
>and another header:
>
>To: [email protected]
>Cc: [email protected], [email protected],
>[email protected],
>[email protected],[email protected],
>[email protected], [email protected],
>[email protected], [email protected]
>
>
>George
>
>===[George R. Kasica]===        +1 262 677 0766
>President                       +1 206 374 6482 FAX 
>Netwrx Consulting Inc.          Jackson, WI USA 
>http://www.netwrx1.com
>[email protected]
>ICQ #12862186

===[George R. Kasica]===        +1 262 677 0766
President                       +1 206 374 6482 FAX 
Netwrx Consulting Inc.          Jackson, WI USA 
http://www.netwrx1.com
[email protected]
ICQ #12862186
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.