Re: False Positive on Domain Name

2012-06-27 Thread Benny Pedersen
Den 2012-06-27 12:22, Ed Abbott skrev: nearly perfect, remove domain-name-servers in request Thanks Benny. I have removed domain-name-servers in the request. would be nice if debian/ubuntu maintainers read it if it can be some suggestion on spamassassin install notes, since the default was

Re: False Positive on Domain Name

2012-06-27 Thread Ed Abbott
. Ed -- View this message in context: http://spamassassin.1065346.n5.nabble.com/False-Positive-on-Domain-Name-tp67067p100618.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-22 Thread Benny Pedersen
Den 2012-06-22 16:20, Ed Abbott skrev: Now that I have access to block lists, life is so much easier. nearly perfect, remove domain-name-servers in request

Re: False Positive on Domain Name

2012-06-22 Thread Ed Abbott
I changed it: http://spamassassin.1065346.n5.nabble.com/file/n100578/dhclient.conf.before dhclient.conf.before Here's my dhclient.conf after I changed it: http://spamassassin.1065346.n5.nabble.com/file/n100578/dhclient.conf.after dhclient.conf.after Now that I have access to block lists, li

Locking down your resolver config (was Re: False Positive on Domain Name)

2012-06-14 Thread Kris Deugau
Reko Turja wrote: > I'm myself bit leery for making stuff immutable that update scripts etc. > usually assume having preset flags. Immutable in wrong place can make > stuff fail in pretty interesting ways. Well, my reason for *setting* the immutable bit was that by definition, any automated widget

Re: False Positive on Domain Name

2012-06-13 Thread Reko Turja
Ed Abbott wrote: Reko Turja wrote: Sorry for butting in a bit late... Dont know what flavor of dhclient linux is running, but in freebsd this kind of unpleasantness can be avoided by editing /etc/dhclient.conf as follows: interface "" { supersede domain-name "your.internal.tl

Re: False Positive on Domain Name

2012-06-13 Thread Benny Pedersen
Den 2012-06-13 14:24, Ed Abbott skrev: In other words, It would be nice to set my nameserver to localhost permanently. no one stops anyone from changing ones own dhcpd server to say nameserver is 127.0.0.1, or other ip in rfc1918 its more simple doing it right in the router then fight all c

Re: False Positive on Domain Name

2012-06-13 Thread Ed Abbott
erwriting as one person has suggested. However, I think your suggestion is more ideal. Ed Abbott http://old.nabble.com/file/p34005355/dhclient.conf dhclient.conf -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p34005355.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-12 Thread Reko Turja
Sorry for butting in a bit late... Ed Abbott wrote: Kris Deugau wrote: Just keep in mind that NetworkManager may meddle with your resolv.conf, so you can either keep a watch and manually fix it, or do as I've taken to doing and setting the immutable bit with "chattr +i" so it can't be changed

Re: False Positive on Domain Name

2012-06-09 Thread Benny Pedersen
Den 2012-06-09 12:53, Martin Gregorie skrev: I see little or no advantage in using DHCP. its nice to see when friends stop by to add there laptops to your lan :=) it just take a second what i have done is to set all my own lan computers with static lan, and all dynamic get dynamic ip, eg

Re: False Positive on Domain Name

2012-06-09 Thread Martin Gregorie
On Fri, 2012-06-08 at 15:21 -0700, Ed Abbott wrote: > > Looks like resolv.conf is overwritten each time I reboot. > I'll implement your "chattr +i" suggestion after I've convinced > myself that I have a stable solution that works each and every > time. > In the current Fedora releases (since F15

Version control config files (was Re: False Positive on Domain Name)

2012-06-08 Thread David F. Skoll
On Fri, 8 Jun 2012 18:30:25 -0700 (PDT) John Hardin wrote: > A piece of advice: take a look at the rcs/ci/co commands, and use > them to "version control" your configuration files. Or use etckeeper: http://joeyh.name/code/etckeeper/ On Debian and Ubuntu, it's just an apt-get away... Regards,

Re: False Positive on Domain Name

2012-06-08 Thread John Hardin
On Fri, 8 Jun 2012, Ed Abbott wrote: Kris Deugau wrote: Just keep in mind that NetworkManager may meddle with your resolv.conf, so you can either keep a watch and manually fix it, or do as I've taken to doing and setting the immutable bit with "chattr +i" so it can't be changed. Looks like r

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-09 00:21, Ed Abbott skrev: Looks like resolv.conf is overwritten each time I reboot. I'll implement your "chattr +i" suggestion after I've convinced myself that I have a stable solution that works each and every time. chattr is not a gui for dhcp servers For now, I'm using the "c

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
e resolve.conf each time I reboot. Ed -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33983805.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
m has address 127.0.0.2 Thanks for all the help. Ed -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33983803.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
Benny Pedersen wrote: > > Den 2012-06-08 19:30, Ed Abbott skrev: > >> Is it really this simple? > > can i hire you now ? :=) > I should hire you! Thanks for all your help! Ed -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
Benny Pedersen wrote: > > Den 2012-06-08 19:30, Ed Abbott skrev: > >> Is it really this simple? > > can i hire you now ? :=) > I should hire you! Thanks for all your help! Ed -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
Benny Pedersen wrote: > > Den 2012-06-08 19:30, Ed Abbott skrev: > >> Is it really this simple? > > can i hire you now ? :=) > Thanks for all your help! You are the one who should be hired. Ed -- View this message in context: http://old.nabble.com/False

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
Benny Pedersen wrote: > > Den 2012-06-08 19:30, Ed Abbott skrev: > >> Is it really this simple? > > can i hire you now ? :=) > Thanks for all your help! You are the one who should be hired. Ed -- View this message in context: http://old.nabble.com/False

Re: False Positive on Domain Name

2012-06-08 Thread John Hardin
On Fri, 8 Jun 2012, Ed Abbott wrote: Ed Abbott wrote: I've contacted Time-Warner via online chat. Technical support responded to my request to turn off DNS forwarding by saying "We don't offer DNS forwarding." In other words, they had no idea what I was talking about. Ed Abbott My error.

Re: False Positive on Domain Name

2012-06-08 Thread John Hardin
On Fri, 8 Jun 2012, Ed Abbott wrote: John Hardin wrote: Ed, you said you've already installed BIND, that covers the "local, caching" part. Now configure it to not forward requests. Thank you John! I think you may have given me the only answer that is going to work. I've tried to get my ISP

Re: False Positive on Domain Name

2012-06-08 Thread Dave Funk
On Fri, 8 Jun 2012, Benny Pedersen wrote: Den 2012-06-08 20:29, Kevin A. McGrail skrev: I think we can agree that local caching name server is the correct solution in 99.9% of the cases, yes? is 0.1% the geek people on spamassassin ? :=) i just tryin to find where forwards is usefull when d

Re: False Positive on Domain Name

2012-06-08 Thread Axb
On 06/08/2012 07:30 PM, Ed Abbott wrote: It works! The following test works! $ cat spam.mbox | spamassassin -dt>temp In other words, websiterepairguy.com is passing all the tests and is no longer generating false positives. The 'spam.mbox' email is the one that was causing false positives on

Re: False Positive on Domain Name

2012-06-08 Thread Bowie Bailey
On 6/8/2012 12:57 PM, Ed Abbott wrote: > > John Hardin wrote: >> >> Ed, you said you've already installed BIND, that covers the "local, >> caching" part. Now configure it to not forward requests. >> >> > Thank you John! > > I think you may have given me the only answer that is going to > work. I'

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 20:29, Kevin A. McGrail skrev: I think we can agree that local caching name server is the correct solution in 99.9% of the cases, yes? is 0.1% the geek people on spamassassin ? :=) i just tryin to find where forwards is usefull when dig +trace example.org is not using forwards

Re: False Positive on Domain Name

2012-06-08 Thread Kris Deugau
Ed Abbott wrote: > Here's my "new" resolv.conf: > > # Generated by NetworkManager > domain maine.rr.com > search maine.rr.com > # nameserver 209.18.47.61 > # nameserver 209.18.47.62 > nameserver 127.0.0.1 > > It works! The following test works! > > $ cat spam.mbox | spamassassin -dt >temp > >

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 19:30, Ed Abbott skrev: Is it really this simple? can i hire you now ? :=)

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 18:57, Ed Abbott skrev: I think you may have given me the only answer that is going to work. I've tried to get my ISP to allow me to opt out of DNS redirection. No luck. you can modify any files in your own host ?, where is the problem with your isp delivery you wodka ? :=)

Re: False Positive on Domain Name

2012-06-08 Thread Kevin A. McGrail
On 6/8/2012 2:12 PM, Benny Pedersen wrote: Den 2012-06-08 18:22, Kevin A. McGrail skrev: On 6/8/2012 12:17 PM, Ed Abbott wrote: Any foreseeable problem with using Google Public DNS instead? Yes. Google Public DNS can get blocked from RBLs because they end up with too many queries. Your best

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 18:23, Ed Abbott skrev: I'm sure I'm using the DNS servers for my ISP as I've never done anything to alter the servers I'm using. Here's my /etc/resolv.conf: [snip] this is what dynamic clients such as dhcp client will use, servers should have no problem running there own loc

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 18:22, Kevin A. McGrail skrev: On 6/8/2012 12:17 PM, Ed Abbott wrote: Any foreseeable problem with using Google Public DNS instead? Yes. Google Public DNS can get blocked from RBLs because they end up with too many queries. Your best bet with SA is to use your own local cach

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-08 18:17, Ed Abbott skrev: The also said they do not support spamassassin. That's understandable. However, I wasn't asking them to support spamassassin. I just wanted DNS to work properly. if thay dont want to provide dns for your softare, whats more do thay dont want to provid

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
domain 'websiterepairguy.com'. It is no longer doing so. Is it really this simple? Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33982947.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
127.0.0.1, I'm using localhost which is the bind9 I installed the other day. Is this what you are saying? -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33982867.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
Abbott > My error. I meant to say DNS redirection. I'm not sure which term I used when I talked to Time-Warner. I may have used the wrong term. Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33982836.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
an management and computer hardware resources? I'm a lone individual on a home computer. Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33982797.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-08 Thread Kris Deugau
Ed Abbott wrote: > domain maine.rr.com > search maine.rr.com > nameserver 209.18.47.61 > nameserver 209.18.47.62 > > rr stands for Road Runner and Road > Runner is my ISP, also known as > Time-Warner Cable. OK. The first two lines can stay as-is. Remove the current nameserver entries, and add "

Re: False Positive on Domain Name

2012-06-08 Thread Kris Deugau
Ed Abbott wrote: > I've contacted Time-Warner via online chat. Technical support responded > to my request to turn off DNS forwarding by saying "We don't offer DNS > forwarding." In other words, they had no idea what I was talking about. >From the blog link you posted, it sounds like there's an

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
e's my /etc/resolv.conf: # Generated by NetworkManager domain maine.rr.com search maine.rr.com nameserver 209.18.47.61 nameserver 209.18.47.62 rr stands for Road Runner and Road Runner is my ISP, also known as Time-Warner Cable. Ed Abbott -- View this message in context: http:

Re: False Positive on Domain Name

2012-06-08 Thread Kevin A. McGrail
On 6/8/2012 12:17 PM, Ed Abbott wrote: Any foreseeable problem with using Google Public DNS instead? Yes. Google Public DNS can get blocked from RBLs because they end up with too many queries. Your best bet with SA is to use your own local caching nameserver. Regards, KAM

Re: False Positive on Domain Name

2012-06-08 Thread Ed Abbott
ication with them. Any foreseeable problem with using Google Public DNS instead? Thanks for all your responses so far. I live in a rural area in Maine, USA. I'm in a town of about 20,000 people. Looks like I'm going to have to keep my ISP. Ed Abbott -- View this message

Re: DIrty lying cheating DNS replies (was Re: False Positive on Domain Name)

2012-06-08 Thread Benny Pedersen
Den 2012-06-07 21:03, David F. Skoll skrev: It makes ISPs money from search and ad referrals. That's a good [sic] enough reason to lie to your customers, apparently. counting how many ips is in spamhaus drop, where isp says thay stopped bgp routíng to such bastards and in the same time clai

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-07 20:04, Ed Abbott skrev: It looks like uribl.org is ignoring requests for both of these domains and letting them time out. Is this a correct assumption? are you using isp dns servers ? show /etc/resolv.conf if unsure uribl and dnsbl have startede to block dns querries from abbu

Re: False Positive on Domain Name

2012-06-08 Thread Benny Pedersen
Den 2012-06-07 19:35, John Hardin skrev: /etc/resolv.conf is where you'd start. If that says localhost (which it should to use a local nameserver), then look at the configuration of your local DNS server (likely BIND, likely /etc/bind/named.conf or /etc/named/named.conf). #/etc/resolv.conf name

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
thinking. Of course, you never get 100 percent. However, catching most spam is very very helpful. Ed Abbiott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33979059.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread Kris Deugau
Ed Abbott wrote: > You are helping clear up a lot of confusion. It seems > that Time-Warner regularly hijacks DNS. Here's a blog > post that details the experience of one user: > > http://blog.jonudell.net/2010/09/13/hijack-my-dns-and-i-will-be-annoyed-blame-me-and-i-will-go-ballistic/ > I assu

DIrty lying cheating DNS replies (was Re: False Positive on Domain Name)

2012-06-07 Thread David F. Skoll
On Thu, 07 Jun 2012 14:57:27 -0400 Kris Deugau wrote: > If that seems clean, it's possible that your ISP has gone to the > effort of silently redirecting all DNS requests to their own > servers. (I can't think of any good reasons to do this, but some > major ISPs seem to get bizarre directives f

Re: False Positive on Domain Name

2012-06-07 Thread Kris Deugau
Ed Abbott wrote: > $ host websiterepairguy.com.multi.surbl.org > websiterepairguy.com.multi.surbl.org has address 184.106.15.239 > websiterepairguy.com.multi.surbl.org has address 69.16.143.110 > Host websiterepairguy.com.multi.surbl.org not found: 3(NXDOMAIN) The first two responses here indicate

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
ound: 3(NXDOMAIN) It looks like google.com and websiterepairguy.com have something in common. It looks like uribl.org is ignoring requests for both of these domains and letting them time out. Is this a correct assumption? Ed Abbott -- View this message in context: http://old.nabble.c

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
the DNS queries may be getting modified somewhere along the way. I just don't know enough about DNS yet to come up with a way to research this. Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33977175.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread John Hardin
On Thu, 7 Jun 2012, Ed Abbott wrote: Axb wrote: Are you forwarding your queries to a third party DNS? Axb Not intentionally. Am I doing so out of ignorance? Maybe. I'm a lone individual working from a home computer and Time-Warner cable is my ISP. Do DNS queries normally go to Time-Wa

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
s what may have gotten me into trouble. Thanks for your reply! Much appreciated! Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33977081.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
ted rather than re-typed. That's my lesson. -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33977016.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
;ll try to figure out a way to look into this. -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33976986.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread John Hardin
On Thu, 7 Jun 2012, Kris Deugau wrote: Ed Abbott wrote: My domain name, websiterepairguy.com, is causing spamassassin to give a false positive. Checking from where I'm sitting, I don't see it listed. If you're still getting hits on these rules there's a good chance that the DNS cache you're

Re: False Positive on Domain Name

2012-06-07 Thread Kris Deugau
Ed Abbott wrote: > > My domain name, websiterepairguy.com, is causing > spamassassin to give a false positive. > > Here are the tests that all give a false positive for > websiterepairguy.com: > > 1.5 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) > 0.6 URIBL_PH_SURBL

Re: False Positive on Domain Name

2012-06-07 Thread Axb
On 06/07/2012 01:37 PM, Ralf Hildebrandt wrote: * Axb: in console check with: host websitereapirguy.com.multi.uribl.com websiterepairguy.com.multi.uribl.com (note the typo) Doh! - copy/paste previous author's error (rndc flushname websitereapirguy.com) anyway, still: Host websiterepair

Re: False Positive on Domain Name

2012-06-07 Thread Ralf Hildebrandt
> I've now refreshed the DNS cache and restarted spamassassin by > rebooting Linux. No change in result. Maybe YOUR server is querying an upstream DNS server which has the data cached. -- Ralf Hildebrandt Charite Universitätsmedizin Berlin ralf.hildebra...@charite.deCa

Re: False Positive on Domain Name

2012-06-07 Thread Ralf Hildebrandt
* Axb : > in console check with: > > host websitereapirguy.com.multi.uribl.com websiterepairguy.com.multi.uribl.com (note the typo) -- Ralf Hildebrandt Charite Universitätsmedizin Berlin ralf.hildebra...@charite.deCampus Benjamin Franklin http://www.charite.de

Re: False Positive on Domain Name

2012-06-07 Thread Axb
On 06/07/2012 01:19 PM, Ed Abbott wrote: Robert Schetterer wrote: perhaps try refreshing your dns caches and/or restart spamassassin afterwards I've flushed the cache with this command: rndc flushname websitereapirguy.com So far, no change. I'll restart spamassassin by rebooting my mac

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33975169.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: False Positive on Domain Name

2012-06-07 Thread Ed Abbott
xt. Not sure that I'm running a daemon for spamassassin as I'm on a single user system. I assume spamassassin only runs when I check email. That's my best guess. However, I'm going to reboot anyway. Ed Abbott -- View this message in context: http://old.nabble.com/False-Positi

Re: False Positive on Domain Name

2012-06-07 Thread Robert Schetterer
Am 07.06.2012 12:53, schrieb Ed Abbott: > I've checked here to see if my domain is blocked: > > https://admin.uribl.com/ > > When I lookup websiterepairguy,com, I get the > following reply: > > NOT Listed on URIBL perhaps try refreshing your dns caches and/or restart spamassassin afterwards --

False Positive on Domain Name

2012-06-07 Thread Ed Abbott
ply. My sincere apologies if this is a common problem that I've not discovered an answer to because of the clumsiness of my google searches. Ed Abbott -- View this message in context: http://old.nabble.com/False-Positive-on-Domain-Name-tp33975030p33975030.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.