More on Spamassassin on SCO 5.0.7 with MP5 - SCO

This is a discussion on More on Spamassassin on SCO 5.0.7 with MP5 - SCO ; Well it looks like I have Spamassassin 3.1.4 working on 5.0.7 But, not being familiar with Spamassassin, I'd like to hear from anyone that can explain the lines marked below in the test spam message provided with Spamassassin: From root ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: More on Spamassassin on SCO 5.0.7 with MP5

  1. More on Spamassassin on SCO 5.0.7 with MP5

    Well it looks like I have Spamassassin 3.1.4 working on 5.0.7

    But, not being familiar with Spamassassin, I'd like to hear from anyone that
    can explain the lines marked below in the test spam message provided with
    Spamassassin:

    From root Wed Aug 23 21:24:00 2006
    Received: from localhost by unix.smfabac.com
    with SpamAssassin (version 3.1.4);
    Wed, 23 Aug 2006 21:24:21 +0000
    From: root@unix.smfabac.com (Superuser)
    To: smf
    Date: Wed, 23 Aug 2006 16:23:59 -0500 (CDT)
    Message-Id: <200608232123.k7NLNxn11128@unix.smfabac.com>
    > X-Spam-Flag: YES
    > X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on unix.smfabac.com
    > X-Spam-Level: **************************************************
    > X-Spam-Status: Yes, score=1000.7 required=5.0 tests=AWL,GTUBE,MISSING_SUBJECT,

    UNPARSEABLE_RELAY autolearn=no version=3.1.4
    MIME-Version: 1.0
    Content-Type: multipart/mixed; boundary="----------=_44ECC785.0F5E5CCA"

    This is a multi-part message in MIME format.

    ------------=_44ECC785.0F5E5CCA
    Content-Type: text/plain


    Specifically: What does the "UNPARSEABLE_RELAY and "autolearn=no" mean?


    This was tested by typing
    # mail -f sample-spam.txt then executing "f smf" to forward the message to
    user smf.
    --

    Steve Fabac
    S.M. Fabac & Associates
    816/765-1670

  2. Re: More on Spamassassin on SCO 5.0.7 with MP5

    Steve Fabac wrote:

    > Well it looks like I have Spamassassin 3.1.4 working on 5.0.7
    >
    > But, not being familiar with Spamassassin, I'd like to hear from anyone that
    > can explain the lines marked below in the test spam message provided with
    > Spamassassin:
    >
    > From root Wed Aug 23 21:24:00 2006
    > Received: from localhost by unix.smfabac.com
    > with SpamAssassin (version 3.1.4);
    > Wed, 23 Aug 2006 21:24:21 +0000
    > From: root@unix.smfabac.com (Superuser)
    > To: smf
    > Date: Wed, 23 Aug 2006 16:23:59 -0500 (CDT)
    > Message-Id: <200608232123.k7NLNxn11128@unix.smfabac.com>
    > > X-Spam-Flag: YES
    > > X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on unix.smfabac.com
    > > X-Spam-Level: **************************************************
    > > X-Spam-Status: Yes, score=1000.7 required=5.0 tests=AWL,GTUBE,MISSING_SUBJECT,

    > UNPARSEABLE_RELAY autolearn=no version=3.1.4
    > MIME-Version: 1.0
    > Content-Type: multipart/mixed; boundary="----------=_44ECC785.0F5E5CCA"
    >
    > This is a multi-part message in MIME format.
    >
    > ------------=_44ECC785.0F5E5CCA
    > Content-Type: text/plain
    >
    >
    > Specifically: What does the "UNPARSEABLE_RELAY and "autolearn=no" mean?


    "autolearn=no" means SA didn't choose to automatically add this message
    to its local corpus of spam messages (for future reference of its
    Bayesian elements). You need to read a lot of SA doc to get this.

    "UNPARSEABLE_RELAY": look at /usr/share/spamassassin/* (or wherever you
    compiled those files to live), there will be a definition of that rule.
    http://spamassassin.apache.org/full/..._head_tests.cf
    shows:

    header UNPARSEABLE_RELAY eval:check_relays_unparseable()
    tflags UNPARSEABLE_RELAY userconf
    describe UNPARSEABLE_RELAY Informational: message has unparseable relay lines

    which means it's in the perl. The implementation of that is in
    lib/Mail/SpamAssassin/Message/Metadata/Received.pm; look for
    "unparseable:" in that file.

    Bottom line, it didn't like one of the Received: lines in the message.
    The only one showing in your display of the message above claims to have
    been created by SA itself, so that's a bit odd...

    > This was tested by typing
    > # mail -f sample-spam.txt then executing "f smf" to forward the message to
    > user smf.


    >Bela<


  3. Re: More on Spamassassin on SCO 5.0.7 with MP5

    Bela Lubkin wrote:
    >
    > Steve Fabac wrote:
    >
    > > Well it looks like I have Spamassassin 3.1.4 working on 5.0.7
    > >
    > > But, not being familiar with Spamassassin, I'd like to hear from anyone that
    > > can explain the lines marked below in the test spam message provided with
    > > Spamassassin:
    > >
    > > From root Wed Aug 23 21:24:00 2006
    > > Received: from localhost by unix.smfabac.com
    > > with SpamAssassin (version 3.1.4);
    > > Wed, 23 Aug 2006 21:24:21 +0000
    > > From: root@unix.smfabac.com (Superuser)
    > > To: smf
    > > Date: Wed, 23 Aug 2006 16:23:59 -0500 (CDT)
    > > Message-Id: <200608232123.k7NLNxn11128@unix.smfabac.com>
    > > > X-Spam-Flag: YES
    > > > X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on unix.smfabac.com
    > > > X-Spam-Level: **************************************************
    > > > X-Spam-Status: Yes, score=1000.7 required=5.0 tests=AWL,GTUBE,MISSING_SUBJECT,

    > > UNPARSEABLE_RELAY autolearn=no version=3.1.4
    > > MIME-Version: 1.0
    > > Content-Type: multipart/mixed; boundary="----------=_44ECC785.0F5E5CCA"
    > >
    > > This is a multi-part message in MIME format.
    > >
    > > ------------=_44ECC785.0F5E5CCA
    > > Content-Type: text/plain
    > >
    > >
    > > Specifically: What does the "UNPARSEABLE_RELAY and "autolearn=no" mean?

    >
    > "autolearn=no" means SA didn't choose to automatically add this message
    > to its local corpus of spam messages (for future reference of its
    > Bayesian elements). You need to read a lot of SA doc to get this.
    >
    > "UNPARSEABLE_RELAY": look at /usr/share/spamassassin/* (or wherever you
    > compiled those files to live), there will be a definition of that rule.
    > http://spamassassin.apache.org/full/..._head_tests.cf
    > shows:
    >
    > header UNPARSEABLE_RELAY eval:check_relays_unparseable()
    > tflags UNPARSEABLE_RELAY userconf
    > describe UNPARSEABLE_RELAY Informational: message has unparseable relay lines
    >
    > which means it's in the perl. The implementation of that is in
    > lib/Mail/SpamAssassin/Message/Metadata/Received.pm; look for
    > "unparseable:" in that file.


    Bela,

    It's good to hear from you. I found the following in:

    /usr/lib/perl5/site_perl/5.8/Mail/SpamAssassinEvalTests.pm

    sub check_relays_unparseable {
    my ($self) = @_;
    return $self->{num_relays_unparseable};
    }

    But not being a Perl programmer, I can't read and understand the code.

    >
    > Bottom line, it didn't like one of the Received: lines in the message.
    > The only one showing in your display of the message above claims to have
    > been created by SA itself, so that's a bit odd...


    Not odd, the message is the GTUBE test message distributed with spamassassin
    the following is from the body of the message delivered to the spam folder:

    Content analysis details: (1000.7 points, 5.0 required)

    pts rule name description
    ---- ---------------------- --------------------------------------------------
    0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
    1000 GTUBE BODY: Generic Test for Unsolicited Bulk Email
    1.3 MISSING_SUBJECT Missing Subject: header
    -0.7 AWL AWL: From: address is in the auto white-list

    From the above, I deduct that UNPARSEABLE_RELAY with a value of 0.0 must be
    the default value of 0.001 specified in: /usr/share/spamassassin/50_scores.cf:
    50_scores.cf:score UNPARSEABLE_RELAY 0.001

    Must not be heavily weighted if a single occurrence of UNPARSEABLE_RELAY is valued
    at only 0.001.

    The following is from real mail:

    ---- start
    Date: Wed, 23 Aug 2006 21:52:44 -0500 (CDT)
    Message-Id: <200608240252.k7O2qiX12969@unix.smfabac.com>
    X-Spam-Flag: YES
    X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on unix.smfabac.com
    X-Spam-Level: ******
    X-Spam-Status: Yes, score=6.3 required=5.0 tests=AWL,DRUGS_ERECTILE,
    SUBJ_YOUR_OWN,UNPARSEABLE_RELAY,URIBL_AB_SURBL,URI BL_JP_SURBL,
    URIBL_OB_SURBL,URIBL_SBL,URIBL_WS_SURBL autolearn=no version=3.1.4
    MIME-Version: 1.0
    Content-Type: multipart/mixed; boundary="----------=_44ED1493.76569ABB"
    Status: RO

    and in the body:


    Content analysis details: (6.3 points, 5.0 required)

    pts rule name description
    ---- ---------------------- --------------------------------------------------
    0.1 SUBJ_YOUR_OWN Subject contains "Your Own"
    0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
    1.1 URIBL_SBL Contains an URL listed in the SBL blocklist
    [URIs: raingive.com]
    3.3 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
    [URIs: raingive.com]
    3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
    [URIs: raingive.com]
    1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
    [URIs: raingive.com]
    2.6 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
    [URIs: raingive.com]
    0.1 DRUGS_ERECTILE Refers to an erectile drug
    -5.8 AWL AWL: From: address is in the auto white-list

    The original message was not completely plain text, and may be unsafe to
    open with some email clients; in particular, it may contain a virus,

    --- end

    Thanks for the answers. It looks like I have successfully installed Spamassassin on
    5.0.7 with MP5 and a modified procmail-3.1.5 (From Skunkware, modified by removing
    the comment (/*) at the beginning of the code that sets the mail delimiter to ^A^A^A^A).


    >
    > > This was tested by typing
    > > # mail -f sample-spam.txt then executing "f smf" to forward the message to
    > > user smf.

    >
    > >Bela<



    --

    Steve Fabac
    S.M. Fabac & Associates
    816/765-1670

  4. Re: More on Spamassassin on SCO 5.0.7 with MP5

    On Sat, 26 Aug 2006, Steve M. Fabac, Jr. wrote:
    > Thanks for the answers. It looks like I have successfully installed
    > Spamassassin on 5.0.7 with MP5 and a modified procmail-3.1.5 (From
    > Skunkware, modified by removing the comment (/*) at the beginning of the
    > code that sets the mail delimiter to ^A^A^A^A).


    I remove the delimiter from all my email with the mmdftailor file patch.
    That is why I did not have to have the procmail patch you used. I move my
    email from all my various OS's so I can not have the ^A^A^A^A in any of my
    email. That is why I said you had to make sure you did not have any email
    in /usr/spool/mail. Also you may have needed to reload sendmail to have
    the delimiter changed.

    I am glad it is working. Good Luck,


    --
    Boyd Gerber
    ZENEZ 1042 East Fort Union #135, Midvale Utah 84047

  5. Re: More on Spamassassin on SCO 5.0.7 with MP5

    In article <44EFE3F1.5B495707@att.net> "Steve M. Fabac, Jr." writes:
    $From the above, I deduct that UNPARSEABLE_RELAY with a value of 0.0 must be
    $the default value of 0.001 specified in: /usr/share/spamassassin/50_scores.cf:
    $50_scores.cf:score UNPARSEABLE_RELAY 0.001
    $
    $Must not be heavily weighted if a single occurrence of UNPARSEABLE_RELAY is valued
    $at only 0.001.

    The tag says it's informational; it's not there so much as an
    indication that the message is spam as it is a warning to you that
    SpamAssassin couldn't parse something. If you fish through the scores,
    I think you'll find it's not the only rule marked at 0.001, and since
    the scores shown in the headers are rounded to one decimal place, that
    shows up as 0.0.

    They don't simply mark it as 0 because that's how you disable
    a rule. So they call it 0.001, which leaves it enabled but makes
    no material difference to the final spam score.
    --
    Stephen M. Dunn
    >>>----------------> http://www.stevedunn.ca/ <----------------<<<

    ------------------------------------------------------------------
    Say hi to my cat -- http://www.stevedunn.ca/photos/toby/

+ Reply to Thread