Pantek Library
Hosting Provided By
CybrHost
High Speed Hosting
Mailing Lists: spamassassin.apache.org > users > 07 > 083451.html (Request Expert spamassassin.apache.org Support)

RE: white_list is not working.....HELP!

From: Tony Guadagno <tonyg(at)guadagno.org>
Date: Wed Aug 29 2007 - 11:03:37 EDT


Bowie,
  thanks for your response. Here is the test message

MAIL FROM:<xx@xx.com> SIZE=3803
RCPT TO:<txx@gxxo.org>
Received: from smtpgw02.fujifilmesys.net ([65.249.152.151])

        by mail.guadagno.org with ESMTP; Tue, 28 Aug 2007 21:13:23 -0400 X-IronPort-AV: E=Sophos;i="4.19,319,1183348800";

   d="scan'208,217";a="42037106"
Received: from unknown (HELO exchange01.fujiesystems.com) ([172.18.1.7])   by Ironport2.fujifilmesys.com with ESMTP; 28 Aug 2007 21:13:26 -0400 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0
Content-Type: multipart/alternative;

        boundary="----_=_NextPart_001_01C7E9D9.CE51D79A" Subject: FW: OffZHook pushes needed today Date: Tue, 28 Aug 2007 21:13:22 -0400
Message-ID: <24177BAABBBEA3499F56E08E16484AACDB45F3@exchange01.fujiesystems.com> X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: OffZHook pushes needed today thread-index: AcfpzX9sYZtuwDNJRcim8H0+6Lyt/wADEuq5 References: <24177BAABBBEA3499F56E08E16484AACDB45E5@exchange01.fujiesystems.com><e68c592c0708281449l2ff487f2g1c077eb70bf7d3eb@mail.gmail.com><e68c592c0708281456g620f5021uce60dfe3020f6f2a@mail.gmail.com><e68c592c0708281501m218bad2bha9211e60a4288042@mail.gmail.com><24177BAABBBEA3499F56E08E16484AACDB45EB@exchange01.fujiesystems.com><e68c592c0708281518m38c4055fta9b448be1007cdef@mail.gmail.com><e68c592c0708281527y4c317967sa35e842f08319078@mail.gmail.com><24177BAABBBEA3499F56E08E16484AACDB45EC@exchange01.fujiesystems.com><e68c592c0708281627j79c7af0etb207209c31bc190c@mail.gmail.com><24177BAABBBEA3499F56E08E16484AACDB45EF@exchange01.fujiesystems.com> <e68c592c0708281645k111d135fl5b822e057b3cadfa@mail.gmail.com> From: "Tony Guadagno" <tguadagno@fujifilmesys.com> To: <tonyg@guadagno.org>

This is a multi-part message in MIME format.

------_=_NextPart_001_01C7E9D9.CE51D79A
Content-Type: text/plain;

        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Do you need help?X

=20
=20 

***********************************************=20
Tony Guadagno=20
FujiFilmESys=20
tguadagno@fujifilmesys.com=20
Office: 585.340.4255=20
Cell: 585.703.6700=20 
***********************************************=20

________________________________

From: Gershom B [mailto:gershomb@gmail.com] Sent: Tue 8/28/2007 7:45 PM
To: Tony Guadagno; Ed McElvain
Subject: Re: OffZHook pushes needed today

and another push with a few minor tweaks. this really should be it.

thanks,
--gershom

------_=_NextPart_001_01C7E9D9.CE51D79A
Content-Type: text/html;

        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML dir=3Dltr><HEAD>=0A=
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dunicode">=0A=
<META content=3D"MSHTML 6.00.6000.16525" name=3DGENERATOR></HEAD>=0A=
<BODY>=0A=
<DIV id=3DidOWAReplyText45424 dir=3Dltr>=0A=
<DIV dir=3Dltr><FONT face=3DArial color=3D#000000 =
size=3D2></FONT>&nbsp;</DIV>=0A=
<DIV dir=3Dltr><FONT face=3DArial color=3D#000000 =
size=3D2></FONT>&nbsp;</DIV></DIV>=0A=
<DIV id=3DidSignature21611 dir=3Dltr>=0A=
<DIV><FONT face=3DArial color=3D#000000>=0A=
<DIV><FONT size=3D2><FONT =

face=3DTahoma>*********************************************** =

<BR><FONT face=3DTahoma>Tony Guadagno</FONT> <BR><FONT =
face=3DTahoma>FujiFilmESys</FONT> <BR><U><FONT face=3DTahoma = color=3D#0000ff>tguadagno@fujifilmesys.com</FONT></U> <BR><FONT = face=3DTahoma>Office:&nbsp; 585.340.4255</FONT> <BR><FONT = face=3DTahoma>Cell:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 585.703.6700</FONT> =
<BR><FONT =
face=3DTahoma>*********************************************** =

</FONT></DIV></FONT></DIV></DIV>=0A=
<DIV dir=3Dltr><BR>=0A=
<HR tabIndex=3D-1>=0A=
<FONT face=3DTahoma size=3D2><B>From:</B> Gershom B =
[mailto:gershomb@gmail.com]<BR><B>Sent:</B> Tue 8/28/2007 7:45 = PM<BR><B>To:</B> Tony Guadagno; Ed McElvain<BR><B>Subject:</B> Re: = OffZHook pushes needed today<BR></FONT><BR></DIV>=0A=
<DIV>and another push with a few minor tweaks. this really should be =
it.<BR><BR>thanks,<BR>--gershom<BR></DIV></BODY></HTML> ------_=_NextPart_001_01C7E9D9.CE51D79A--

Tony Guadagno
Guadagno Consulting
tonyg@guadagno.org
585.703.6700

>>> Bowie Bailey <Bowie_Bailey@BUC.com> 8/29/2007 10:55 AM >>> Tony Guadagno wrote: 

> Ok,
>   I am a little frustrated.  I am missing something and I don't see
> it. 
> 
> All I am trying to do is
> 
> whitelist_from *@sans.org 
> whitelist_from *@mercury.com 
> whitelist_from *@raymourflanigan.com 
> etc
> 
> but it seems that there are no whitelist test running ....why?
> 
> Content analysis details:   (7.6 points, 5.6 required)
> 
>  pts rule name              description
> ---- ----------------------
> -------------------------------------------------- 
>  0.0 MISSING_MID            Missing Message-Id: header
>  0.0 MISSING_DATE           Missing Date: header
> -0.0 NO_RELAYS              Informational: message was not relayed
> via SMTP 
>  2.5 MISSING_HB_SEP         Missing blank line between message header
> and body 
>  1.3 MISSING_HEADERS        Missing To: header
>  2.0 BAYES_80               BODY: Bayesian spam probability is 80 to
>                             95% [score: 0.8387]
>  1.8 MISSING_SUBJECT        Missing Subject: header
> -0.0 NO_RECEIVED            Informational: message has no Received
> headers 
>  0.0 NO_HEADERS_MESSAGE     Message appears to be missing most
> RFC-822 headers 
> 
> I am using sa 3.2.2 and for now, just testing using spamassassing.bat
> I have --lint and everything seems ok. 
> 
> 
> why is it not whitelisting!!!
Do you need more help?X

The scores you posted seem to indicate that the message you sent to spamassassin has no headers. What does your test message look like and how did you do the test?

Also, "whitelist_from" is a very bad idea in general. It can be fooled VERY easily. Once you fix the problem and get the whitelist_from working, you should change it to "whitelist_from_rcvd" or "whitelist_from_spf", which are much more resistant to spoofing. 

-- 
Bowie
Received on Wed Aug 29 11:05:44 2007

This archive was generated by hypermail 2.1.8 : Fri Oct 26 2007 - 03:16:54 EDT

Contact Us  Legal Notices  Order Services Online 
Pantek Home  Privacy Policy  IT news  Site Map  Pantek Library