SA with a new Spamhaus plugin

Use this forum for discussions about SpamAssassin and anti-spam in general.
Post Reply
User avatar
katip
Senior user
Senior user
Posts: 686
Joined: 2006-12-22 07:58
Location: Istanbul

SA with a new Spamhaus plugin

Post by katip » 2019-07-03 14:44

just received following message from Spamhaus guys via SA mailing list:
Hello everyone,

I'm sure that many of you are aware that our datasets are already in use
with SpamAssassin's default config, but I wanted to reach out and let
you know that we have developed a SpamAssassin plugin that helps you get
more out of our DNSBLs.

The plugin works with our Data Query Service (DQS). The DQS provides you
with additional feeds: Zero Reputation Domain & AuthBL, and it also
receives updates in 'realtime.' This last point is key, because, as you
can see in the latest Virus Bulletin report
(https://www.virusbulletin.com/testing/r ... l-security),
DQS catches 42% more spam than our RSYNC service or public mirrors.

Last but not least, the usage terms for the DQS are the same as for our
public mirrors, meaning that if you already use our public mirrors, you
can register for a personal DQS key free of charge.

You can find all the needed files here:
https://github.com/spamhaus/spamassassin-dqs

Have fun with our data, and if there are difficulties in installing the
plugin, or if you have suggestions, you can drop us a line at
datafeed-support@spamteq.com or post here. I'll try to keep the list
monitored to deliver as much help as I can.

--
Best regards,
Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/
in short : https://github.com/spamhaus/spamassassin-dqs
looks promising. jfyi..
Katip
--
HMS 5.7.0-B2428-LTS-64-bit, MySQL 5.7.24, SA 3.4.2, ClamAV 0.101.2 + SaneS

palinka
Senior user
Senior user
Posts: 1118
Joined: 2017-09-12 17:57

Re: SA with a new Spamhaus plugin

Post by palinka » 2019-07-03 19:11

I don't understand the key. Is it free or not? I haven't tried to register yet.

User avatar
katip
Senior user
Senior user
Posts: 686
Joined: 2006-12-22 07:58
Location: Istanbul

Re: SA with a new Spamhaus plugin

Post by katip » 2019-07-04 07:58

they say:
Last but not least, the usage terms for the DQS are the same as for our
public mirrors, meaning that if you already use our public mirrors, you
can register for a personal DQS key free of charge.
i haven't registered yet too.
i'll play with it this weekend. on my ubuntu SA setup at home i'll probably be fine with just following the manual. then i see if and what can be done on my other Win/JAM setup.
Katip
--
HMS 5.7.0-B2428-LTS-64-bit, MySQL 5.7.24, SA 3.4.2, ClamAV 0.101.2 + SaneS

User avatar
jimimaseye
Moderator
Moderator
Posts: 8132
Joined: 2011-09-08 17:48

Re: SA with a new Spamhaus plugin

Post by jimimaseye » 2019-07-04 08:50

katip wrote:
2019-07-04 07:58
they say:
Last but not least, the usage terms for the DQS are the same as for our
public mirrors, meaning that if you already use our public mirrors, you
can register for a personal DQS key free of charge.
i haven't registered yet too.
i'll play with it this weekend. on my ubuntu SA setup at home i'll probably be fine with just following the manual. then i see if and what can be done on my other Win/JAM setup.
Good man. The instructions from the github involve compiling etc so was unsure about doing it on windows (although i didn't read it to carefully).

I look forward to your report back.

[Entered by mobile. Excuse my spelling.]
HMS 5.6.6 B2383 on Win Server 2008 R2 Foundation, + 5.6.7-B2415 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 1118
Joined: 2017-09-12 17:57

Re: SA with a new Spamhaus plugin

Post by palinka » 2019-07-04 14:06

jimimaseye wrote:
2019-07-04 08:50
Good man. The instructions from the github involve compiling etc so was unsure about doing it on windows (although i didn't read it to carefully).

I look forward to your report back.

[Entered by mobile. Excuse my spelling.]
I *think* all you need to do is drop the files in place and in sh.cf change "your_DQS_key" in about 50 places to the actual key number. It appears from a google search that "sed" simply replaces text: match/replace-match-with.

Code: Select all

sed -i "" -e 's/your_DQS_key/aip7yig6sahg6ehsohn5shco3z/g' sh.cf
Then edit sh.cf:

Code: Select all

loadplugin       Mail::SpamAssassin::Plugin::SH "C:\Program Files\JAM Software\SpamAssassin for Windows\runtime\lib\Mail\SpamAssassin"
Not sure how to handle the spaces in the path. The quotes are mine - not part of the instructions on github.

Then drop the files into C:\Program Files\JAM Software\SpamAssassin for Windows\runtime\lib\Mail\SpamAssassin.

Not sure if you place sh.cf in C:\Program Files\JAM Software\SpamAssassin for Windows\etc\spamassassin which is where my local.cf is located.

Now what, if anything, goes in local.cf to activate it? Maybe I'll give it whirl later today.

I also saw a note about changing required_score to 4 because of the way it weights scoring.

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-04 22:54

Mmm, interesting....
Have been looking around in it but i can not find if we need to disable the *old* spamassassin spamhaus rules for this to work, or do these replace the *old* ones automatically?

Seems free for now... but al i read is account/purchase and so for.... dount it will be *free* forever, if you sign up oyu get a 1 year subscription it seems


FYI, is simply dropped the pm and cf files for this in C:\Program Files\JAM Software\SpamAssassin for Windows\etc\spamassassin
Then in ch.cf change the first uncommented line to:
loadplugin Mail::SpamAssassin::Plugin::SH SH.pm and replace all instances of 'your_DQS_key' with your real DQS key
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
mattg
Moderator
Moderator
Posts: 20146
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: SA with a new Spamhaus plugin

Post by mattg » 2019-07-05 01:30

I installed last night, it just added new rules to my Linux SpamAssassin setup

They triggered only three times I think, and all three messages flagged were already scoring well over a 100 in SpamAssassin, which on my system means that multiple of the SaneSecurity signatures were also flagged

And yes, I agree that the one year 'subscription' is likely to end in a request for payment.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-05 10:58

Hi,

the licensing words are a little blurry, let me explain how it works.

We have a blended model. Service is free up to a certain volume of queries. This volume of queries should be high enough for small office / home office users.

For 20 years we’ve offered free public mirrors. The vast majority of users (and we’re talking tens of thousands on a daily basis) use the service as intended. However, we have a notable number of users who blatantly abuse the service. Millions, even tens of millions of queries every day.

Free users of the DQS service will be treated as we would users of the public mirrors. The notable differences being that we know who you are (we have an email address for you) and in exchange we offer a better service — faster updates, marginally lower false positives and access to zones not available via the public mirrors.

By knowing who you are, we hope to avoid the abuse we see on the mirrors and, should things look like they’re getting out of control, we can contact you. Perhaps to modify your approach or to start paying for the service.

WRT “modify your approach”, we do find instances of bizarre configurations causing needless queries.

> Will the account auto-renew annually, and will it remain free "forever?"

You will need to renew on an annual basis. A simple email usually suffices — although now you mention it, we should have an auto-renew button on the user portal. I’ll raise that with the web team.

“Forever” is a long time! Intention is that if usage remains within the criteria specified for the free public mirrors, usage is free “forever”. See <https://www.spamhaus.org/organization/dnsblusage/>.

User avatar
SorenR
Senior user
Senior user
Posts: 3194
Joined: 2006-08-21 15:38
Location: Denmark

Re: SA with a new Spamhaus plugin

Post by SorenR » 2019-07-05 11:41

ralfieri wrote:
2019-07-05 10:58
Hi,

the licensing words are a little blurry, let me explain how it works.

We have a blended model. Service is free up to a certain volume of queries. This volume of queries should be high enough for small office / home office users.

...
By your use of "me" and "we" I assume you are:

Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/
SørenR.

“With age comes wisdom, but sometimes age comes alone.”
- Oscar Wilde

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-05 11:48

SorenR wrote:
2019-07-05 11:41
By your use of "me" and "we" I assume you are:

Riccardo Alfieri

Spamhaus Technology
https://www.spamhaustech.com/
Your assumption is right

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-05 11:58

mattg wrote:
2019-07-05 01:30
I installed last night, it just added new rules to my Linux SpamAssassin setup

They triggered only three times I think, and all three messages flagged were already scoring well over a 100 in SpamAssassin, which on my system means that multiple of the SaneSecurity signatures were also flagged

And yes, I agree that the one year 'subscription' is likely to end in a request for payment.
Did you comment out the *old* Spamhaus entries in 20_dnsbl_tests.cf or did you leave them in place?
Wouldn't this double the amount of lookup otherwise? eg: Once to zen.spamhaus.org and once to zen.spamhaus.net?
Documentation is lacking on that matter
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-05 12:01

You don't need to comment anything, just drop the files in the configuration directory

If you open sh.cf you'll see the redefinitions of the original tests

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-05 12:03

OK, clear... thx!

Running spamassassin -D --lint gives me a few undefined dependency errors, eg:

Jul 5 12:00:15.202 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_HEADERS has undefined dependency 'SH_ZRD_HEADERS'
Jul 5 12:00:15.216 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_REVERSE has undefined dependency 'SH_REVERSE_ZRD'
Jul 5 12:00:15.222 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_HELO has undefined dependency 'SH_HELO_ZRD'
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-05 12:14

RvdH wrote:
2019-07-05 12:03
OK, clear... thx!

Running spamassassin -D --lint gives me a few undefined dependency errors, eg:

Jul 5 12:00:15.202 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_HEADERS has undefined dependency 'SH_ZRD_HEADERS'
Jul 5 12:00:15.216 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_REVERSE has undefined dependency 'SH_REVERSE_ZRD'
Jul 5 12:00:15.222 [5444] dbg: rules: meta test SH_DBL_OR_ZRD_HELO has undefined dependency 'SH_HELO_ZRD'
Nice catch, those rules were meant to be removed.

It's not a stopping bug, you can still consider your setup working, but I committed the fix to github so you can download the updated ruleset if you want

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-05 12:19

I noticed you committed the changes just now, nice work :wink:
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
mattg
Moderator
Moderator
Posts: 20146
Joined: 2007-06-14 05:12
Location: 'The Outback' Australia

Re: SA with a new Spamhaus plugin

Post by mattg » 2019-07-06 03:33

I didn't get those errors
Presumably the errors only existed temporarily, or I also have the required dependencies set.
RvdH wrote:
2019-07-05 11:58
Did you comment out the *old* Spamhaus entries in 20_dnsbl_tests.cf or did you leave them in place?
Wouldn't this double the amount of lookup otherwise? eg: Once to zen.spamhaus.org and once to zen.spamhaus.net?
Certainly in my testing phase I haven't un-commented anything.

I also haven't set custom scoring for these tests, and haven't a message yet with a low enough score to keep to inspect the headers to see the scoring - all when I checked last were picked off by other rules in my SpamAssassin system.
Just 'cause I link to a page and say little else doesn't mean I am not being nice.
https://www.hmailserver.com/documentation

palinka
Senior user
Senior user
Posts: 1118
Joined: 2017-09-12 17:57

Re: SA with a new Spamhaus plugin

Post by palinka » 2019-07-06 13:24

RvdH wrote:
2019-07-04 22:54

FYI, is simply dropped the pm and cf files for this in C:\Program Files\JAM Software\SpamAssassin for Windows\etc\spamassassin
Then in ch.cf change the first uncommented line to:
loadplugin Mail::SpamAssassin::Plugin::SH SH.pm and replace all instances of 'your_DQS_key' with your real DQS key
Thanks! I wasn't sure of the location.

User avatar
katip
Senior user
Senior user
Posts: 686
Joined: 2006-12-22 07:58
Location: Istanbul

Re: SA with a new Spamhaus plugin

Post by katip » 2019-07-07 12:13

as OP sorry for being late to join the party :lol:

installation was simple both on Ubuntu and Win/JAM, just put 3 files in right place, find/replace 43 key occurences in sh.cf + show correct path on top of it. reload/restart service, that's all. next minute first dating site invitation trapped (also) by SH_BODYURI_REVERSE_SBL & XBL. so, that means it works.

problem:
it adds a SHORTCIRCUIT=100 score if spam trapped by RCVD_IN_ZEN_LASTEXTERNAL. overriding it with zero in user_prefs doesn't help as it enters in short circuit. this makes my score based local classification on client useless. worse than this, it somehow bypasses ClamAV check, i think again because of short circuit (IIRC there is something like "priority" setting in clamav.cf but i don't remember it now, may be irrelevant though).
workaround: comment out line 17 in sh.cf (shortcircuit RCVD_IN_ZEN_LASTEXTERNAL spam).
we'll see...
Katip
--
HMS 5.7.0-B2428-LTS-64-bit, MySQL 5.7.24, SA 3.4.2, ClamAV 0.101.2 + SaneS

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-07 12:30

katip wrote:
2019-07-07 12:13
workaround: comment out line 17 in sh.cf (shortcircuit RCVD_IN_ZEN_LASTEXTERNAL spam).
If a message is clearly spam why do you still want to check it with ClamAV?
ZEN has a accuracy of 90.29%
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

User avatar
katip
Senior user
Senior user
Posts: 686
Joined: 2006-12-22 07:58
Location: Istanbul

Re: SA with a new Spamhaus plugin

Post by katip » 2019-07-07 13:10

RvdH wrote:
2019-07-07 12:30
katip wrote:
2019-07-07 12:13
workaround: comment out line 17 in sh.cf (shortcircuit RCVD_IN_ZEN_LASTEXTERNAL spam).
If a message is clearly spam why do you still want to check it with ClamAV?
ZEN has a accuracy of 90.29%
yes, basically it looks redundant. but as i mentioned, my concern is to keep all crap classified. an extravagant +100 score will mix up all.
and i'd like to see what was malware + ClamAV header with full description too.
YMMV of course.
Katip
--
HMS 5.7.0-B2428-LTS-64-bit, MySQL 5.7.24, SA 3.4.2, ClamAV 0.101.2 + SaneS

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-07 15:14

katip wrote:
2019-07-07 13:10

yes, basically it looks redundant. but as i mentioned, my concern is to keep all crap classified. an extravagant +100 score will mix up all.
and i'd like to see what was malware + ClamAV header with full description too.
YMMV of course.
Hi

shortcircuiting is there for RCVD_IN_ZEN_LASTEXTERNAL because if an ip listed there is trying to connect to your mailserver doing a direct to mx transaction is practically guaranteed to be a spambot. Moreover, shortcircuiting leaves precious CPU cycles free because, once hit,spamassassin just classify the message as spam and becomes free to process another email.

In production enviroments with more than 100.000 emails/day , it has been observed that shortcircuiting halves the overall processing time for emails. If you happen to process more than 100k emails/day then we even suggest to drop connections at SMTP transaction level if an IP listed in ZEN connects to your server.

User avatar
katip
Senior user
Senior user
Posts: 686
Joined: 2006-12-22 07:58
Location: Istanbul

Re: SA with a new Spamhaus plugin

Post by katip » 2019-07-07 16:24

ralfieri wrote:
2019-07-07 15:14
In production enviroments with more than 100.000 emails/day , it has been observed that shortcircuiting halves the overall processing time for emails. If you happen to process more than 100k emails/day then we even suggest to drop connections at SMTP transaction level if an IP listed in ZEN connects to your server.
thank you for clear explanation.
my volume is far far below 100K level. i think i can skip this shortcircuit and hope that's fine for a public subscription :wink: :D
Katip
--
HMS 5.7.0-B2428-LTS-64-bit, MySQL 5.7.24, SA 3.4.2, ClamAV 0.101.2 + SaneS

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-08 07:39

@ralfieri

Examining my logs this morning i see a few of below listed warnings, but eventually the message is blocked/scored correctly

Code: Select all

Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 172.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 173.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 174.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 196.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 197.
Sun Jul  7 08:27:37 2019 [-5604] warn: dns: new_dns_packet (domain=.my_DQS_key.zrd.dq.spamhaus.net. type=A class=IN) failed: a domain name contains a null label
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 172.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 173.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 174.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 196.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 197.
Sun Jul  7 08:27:37 2019 [-5604] warn: dns: new_dns_packet (domain=.my_DQS_key.dbl.dq.spamhaus.net. type=A class=IN) failed: a domain name contains a null label
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 172.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 173.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 174.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 196.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 197.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 172.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 173.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 174.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in hash element at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 196.
Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 197.
Sun Jul  7 08:27:37 2019 [-5604] info: spamd: identified spam (166.2/4.0) for (unknown):0 in 0.6 seconds, 9197 bytes.
Sun Jul  7 08:27:37 2019 [-5604] info: spamd: result: Y 166 - BAYES_99,RCVD_IN_ANONMAILS,RCVD_IN_AUTHBL,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT,RCVD_IN_DNSBL_BLOCKLIST_DE,RCVD_IN_DRONEBL,RCVD_IN_GBUDB,RCVD_IN_HOSTKARMA_BL,RCVD_IN_MEGARBL,RCVD_IN_NERDS_GN,RCVD_IN_NERDS_VN,RCVD_IN_NIX_SPAM,RCVD_IN_PBL,RCVD_IN_RP_RNBL,RCVD_IN_SEMBLACK,RCVD_IN_SPAMRATS_SPAM,RCVD_IN_UCEPROTECT1,RCVD_IN_UNSUBSCORE,RCVD_IN_WPBL,RCVD_IN_XBL,RCVD_IN_ZEN_LASTEXTERNAL,SEM_URI,SEM_URIRED,SHORTCIRCUIT,SH_BODYURI_REVERSE_SBL,SH_BODYURI_REVERSE_XBL,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_DBL_SPAM scantime=0.6,size=9197,user=(unknown),uid=0,required_score=4.0,rhost=MYSERVER,raddr=127.0.0.1,rport=50822,mid=<2B40B8BE.333E964C@lmmotors.it>,bayes=1.000000,autolearn=disabled,shortcircuit=spam

CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

ralfieri
New user
New user
Posts: 6
Joined: 2019-07-05 10:54

Re: SA with a new Spamhaus plugin

Post by ralfieri » 2019-07-08 08:37

RvdH wrote:
2019-07-08 07:39
@ralfieri

Examining my logs this morning i see a few of below listed warnings, but eventually the message is blocked/scored correctly

Code: Select all

Sun Jul  7 08:27:37 2019 [-5604] warn: Use of uninitialized value $this_domain in concatenation (.) or string at C:\Program Files (x86)\JAM Software\SpamAssassin for Windows\etc\spamassassin\SH.pm line 172.
This is very likely the same as https://github.com/spamhaus/spamassassin-dqs/issues/10

I pushed a fix, let me know if it works

User avatar
RvdH
Senior user
Senior user
Posts: 798
Joined: 2008-06-27 14:42
Location: Netherlands

Re: SA with a new Spamhaus plugin

Post by RvdH » 2019-07-08 11:25

ralfieri wrote:
2019-07-08 08:37
I pushed a fix, let me know if it works
Will do
CIDR to RegEx: d-fault.nl/CIDRtoRegEx
DNS Lookup: d-fault.nl/DNSTools
DNSBL Lookup: d-fault.nl/DNSBLLookup
GEOIP Lookup: d-fault.nl/GeoipLookup

Post Reply