mlcheckd and body checks

mlcheckd and body checks

[Jonathan Larmour]

[ let me try a second time as my own version of this got filtered! ]

Dudes,

I thought most of mlcheckd wasn't meant to do anything if the mail poster
was a list member. However one guy has told me they can't post and what I
see instead in /var/log/rbl-checks is:
Nov 10 17:51:19 sourceware spam: -!*blocked: rob@mobilia-os.com
209.139.225.3 -> ecos-discuss@sources.redhat.com (global body, SA:
score=-2.274 required=5 tests=AWL,BAYES_00)
Nov 10 17:51:21 sourceware spam: -!*blocked: rob@mobilia-os.com
209.139.225.3 -> ecos-discuss@ecos.sourceware.org (global body, SA:
score=-2.328 required=5 tests=AWL,BAYES_00)

The global body check probably fails because his mail has an anti-virus 
sig: (I've now added an xxx below to stop this message to overseers being 
filtered too!)
> -- 
> No vxxxirus found in this outgoing message.
> Checked by AVG Free Edition.
> Version: 7.1.362 / Virus Database: 267.12.8/163 - Release Date: 08/11/2005

which matches this in /qmail/lists/global/bad_keywords :
(?i:virus[ies\smymyhavsbeen-]*(?:alert|response|remove|mail|found|warn|notif|detect|coming)) 

    -QUIET,-NOSAVE,-FORCE

But even so, this shouldn't matter because rob@mobilia-os.com _is_
definitely on the subscriber list for ecos-discuss. I've told him to
subscribe to the global-allow list too, although I can't see that helping.

These sigs may be annoying, but surely not a banning offence, even for
subscribers! :)

Any clarity from anyone since I'm a bit short of the stuff?

Jifl
-- 
--["No sense being pessimistic, it wouldn't work anyway"]-- Opinions==mine

Re: mlcheckd and body checks

[Christopher Faylor]

On Thu, Nov 10, 2005 at 07:46:51PM +0000, Jonathan Larmour wrote:
>[ let me try a second time as my own version of this got filtered! ]
>
>Dudes,
>
>I thought most of mlcheckd wasn't meant to do anything if the mail poster
>was a list member.

Nope.  There are various checks which count as definite spam and which
therefore cause blocking regardless of whether someone is subscribed.

>However one guy has told me they can't post and what I see instead in
>/var/log/rbl-checks is:
>Nov 10 17:51:19 sourceware spam: -!*blocked: rob@mobilia-os.com
>209.139.225.3 -> ecos-discuss@sources.redhat.com (global body, SA:
>score=-2.274 required=5 tests=AWL,BAYES_00)
>Nov 10 17:51:21 sourceware spam: -!*blocked: rob@mobilia-os.com
>209.139.225.3 -> ecos-discuss@ecos.sourceware.org (global body, SA:
>score=-2.328 required=5 tests=AWL,BAYES_00)
>
>The global body check probably fails because his mail has an anti-virus 
>sig: (I've now added an xxx below to stop this message to overseers being 
>filtered too!)
>>-- 
>>No vxxxirus found in this outgoing message.
>>Checked by AVG Free Edition.
>>Version: 7.1.362 / Virus Database: 267.12.8/163 - Release Date: 08/11/2005

Yep.  That would probably do it.

>These sigs may be annoying, but surely not a banning offence, even for
>subscribers! :)

This is blocked blocked because we receive a fair amount of email which
has this kind of text embedded in it.  It would be vastly preferable to
have the sender not include this text in his message than to remove the
keywords and allow virus bounces to start hitting the list.

Since the text serves no useful purpose whatsoever, it doesn't seem like
it would be a huge hardship to remove it if possible.

cgf

Re: mlcheckd and body checks

[Jonathan Larmour]

Christopher Faylor wrote:
> On Thu, Nov 10, 2005 at 07:46:51PM +0000, Jonathan Larmour wrote:

> This is blocked blocked because we receive a fair amount of email which
> has this kind of text embedded in it.

Although it isn't one of the confidentiality sigs which we don't even ban 
yet, nor is it particularly long. Quite tame as these things go but 
hopefully never mind...

>  It would be vastly preferable to
> have the sender not include this text in his message than to remove the
> keywords and allow virus bounces to start hitting the list.
> 
> Since the text serves no useful purpose whatsoever, it doesn't seem like
> it would be a huge hardship to remove it if possible.

Hmm.... I thought I remembered that you couldn't avoid that signature 
being added by the AVG Free Edition virus checker (as opposed to having to 
pay for the full version). But I can't find anything in google to 
corroborate that, so I'll ask the guy with the problem if he can disable 
it. If so, no problem.

Jifl
-- 
--["No sense being pessimistic, it wouldn't work anyway"]-- Opinions==mine