September 2012 - Roundtable

SpamAssassin false positives on DATE_IN_FUTURE_96_Q?
by Gilbert E. Detillieux 23 Feb '16

23 Feb '16

I mentioned this problem at the last round-table session, but didn't get a solution, so I thought I'd post it here, just in case anyone has any suggestions to offer. I'm still seeing a whole bunch of false positives in SpamAssassin, since an update was installed in mid-September on a CentOS 5.7 system, for a rule called DATE_IN_FUTURE_96_Q, which is only supposed to be triggered when the "Date:" header has a date that is 4 days to 4 month ahead of the date in the "Received" header that has the _smallest_ difference in date. Here are the headers from the latest e-mail I've received with this false-positive. (I've stripped out irrelevant headers, for the sake of clarity and simplicity.) From topfivestories(a)messagent.itworldcanada.com Mon Nov 14 07:50:13 2011 Received: from mail.messagent.itworldcanada.com (mail.messagent.itworldcanada.com [207.112.10.80]) by palladium.cs.umanitoba.ca (8.13.8/8.13.8) with SMTP id pAEDoAxV028594 for <gedetil(a)cs.umanitoba.ca>; Mon, 14 Nov 2011 07:50:12 -0600 Date: Mon, 14 Nov 2011 08:50:13 -0500 X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,DATE_IN_FUTURE_96_Q, HTML_MESSAGE,RP_MATCHES_RCVD autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on palladium.cs.umanitoba.ca Note that I'm calling spamd via the spamass-milter on a system running sendmail. Note also, that in the above example, the only "Received" header was the one generated by my own server. (I've had other false positives, however, with multiple "Received" headers, all of which were within seconds of the time in the "Date" header.) Any ideas? -- Gilbert E. Detillieux E-mail: <gedetil(a)muug.mb.ca> Manitoba UNIX User Group Web: http://www.muug.mb.ca/ PO Box 130 St-Boniface Phone: (204)474-8161 Winnipeg MB CANADA R2H 3B4 Fax: (204)474-7609

6 11

Re: [RndTbl] Roundtable Digest, Vol 93, Issue 14
by Michael Doob 27 Sep '12

27 Sep '12

On 12-09-27 12:00 PM, roundtable-request(a)muug.mb.ca wrote: > Send Roundtable mailing list submissions to > roundtable(a)muug.mb.ca > > To subscribe or unsubscribe via the World Wide Web, visit > http://www.muug.mb.ca/mailman/listinfo/roundtable > or, via email, send a message with subject or body 'help' to > roundtable-request(a)muug.mb.ca > > You can reach the person managing the list at > roundtable-owner(a)muug.mb.ca > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Roundtable digest..." > > > Today's Topics: > > 1. Re: bash script for printing lines that don't match? > (Grigory Shamov) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Sep 2012 15:13:56 +0000 > From: Grigory Shamov <Grigory.Shamov(a)ad.umanitoba.ca> > To: Continuation of Round Table discussion <roundtable(a)muug.mb.ca> > Subject: Re: [RndTbl] bash script for printing lines that don't match? > Message-ID: <CC89D6B2.B1C4%Grigory.Shamov(a)ad.umanitoba.ca> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > Not in bash, but awk: will show what is in file1 but not in file2 > > awk 'FNR == NR {arr[$0];next} !($1 in arr) {print}' file1 file2 > > > I've used this to compare lists of rpms on our machines. > > Have you used diff, perhaps in conjunction with sort? If so, what didnt' work? -- ------------------------------------------------------------------ Michael Doob Telephone: (204) 474-9796 Department of Mathematics Fax: (204) 474-7606 University of Manitoba email: Michael_Doob(a)umanitoba.ca Winnipeg, MB, Canada R3T 2N2 ------------------------------------------------------------------

1 0

bash script for printing lines that don't match?
by John Lange 27 Sep '12

27 Sep '12

I think I've asked this in the past but try as I might I can't remember what the answer was or figure out how I solved it before. I have 2 files that are nearly identical and I need to know which lines in the two files do _not_ match. I can think of some relatively complex loops with grep etc. which would probably work (for every line in file A, grep in file B etc.) solve the problem but I'm hoping for something more elegant. I thought at first that perhaps "join" would do it but even though it will provide left and right joins, there is no way to prevent it from outputting the matching lines. Any ideas? John

7 7

Re: [RndTbl] boot and install from USB key
by Adam Thompson 24 Sep '12

24 Sep '12

Seconding that, doing anything - particularly configuration - at the command line in pfSense is discouraged. I did a presentation about it in April this year, the recording of which is online at the website. -Adam tim(a)fractaldragon.net wrote: >(trying again from a real keyboard) > >On Sun, Sep 23, 2012 at 11:21:56PM -0500, Dan Martin wrote: > >> pfSense looks good. Documentation a little less clear than IPCop, >> but good reviews. It will mean learning about pf, and abandoning my >> experience with iptables. > >Hi Dan, > >The web GUI is decent for many tasks, so you may find that you can get >by without digging into pf. > > Cheers, > Tim >_______________________________________________ >Roundtable mailing list >Roundtable(a)muug.mb.ca >http://www.muug.mb.ca/mailman/listinfo/roundtable

1 0

Re: [RndTbl] boot and install from USB key
by Adam Thompson 24 Sep '12

24 Sep '12

Time to either downgrade your expectations, downgrade your hardware, or upgrade your software. What do you want to use IPCOP for, anyway? Just a simple firewall? Dan Martin <ummar143(a)shaw.ca> wrote: > >On 2012-09-23, at 3:13 PM, Adam Thompson wrote: > >> Sounds like IPCOP isn't compatible with your hardware. Isn't it based on a fairly old kernel? If this is a brand-new machine, its SATA controller might not even be recognized by that kernel. >> Have you tried any other Linux distro or LiveCD on this hardware? >> -Adam >> >> _______________________________________________ >> Roundtable mailing list >> Roundtable(a)muug.mb.ca >> http://www.muug.mb.ca/mailman/listinfo/roundtable > > >I think you are right, Adam. > >I tried dd'ing directly to a SATA drive, put it in the machine, and it again booted but this time IPCop setup could not find hard drives. > >I googled the "No hard disk found" error and found >http://www.ipcops.com/phpbb3/viewtopic.php?p=82706 >> >> Post subject: Re: During installation error "No Hard Disk found"Posted: Sat Jan 14, 2012 9:55 pm >> VonSkippy wrote: >> @taustin - It WILL be part of the NOT YET RELEASED version 2.1.0 >> >> Which is vaporware, at least for now. > >IPCop v1.9.x is based on a 1.4 kernel. I don't know what kernel IPCop v2.0.3 uses, but I'm guessing it can't see my SATA drive, and I have no IDE drives in the machine. > >Yikes. I have an old pentium with an IDE drive with XP on it - but only 1 ethernet port. I'd hate to rob my new machine of it's PCI network cards to stick in the old clunker! > >Dan Martin >GP Hospital Practitioner >Computer Scientist >ummar143(a)shaw.ca >(204) 831-1746 >answering machine always on > > >_______________________________________________ >Roundtable mailing list >Roundtable(a)muug.mb.ca >http://www.muug.mb.ca/mailman/listinfo/roundtable

4 5

Re: [RndTbl] boot and install from USB key
by Adam Thompson 23 Sep '12

23 Sep '12

Sounds like IPCOP isn't compatible with your hardware. Isn't it based on a fairly old kernel? If this is a brand-new machine, its SATA controller might not even be recognized by that kernel. Have you tried any other Linux distro or LiveCD on this hardware? -Adam

2 1

Forward of moderated message
by muug-announce-bounces＠muug.mb.ca 23 Sep '12

23 Sep '12

3 3

How to Launch a 65Gbps DDoS, and How to Stop One - CloudFlare blog
by Bill Reid 19 Sep '12

19 Sep '12

Interesting that CodeProject Insider had an item about Open DNS DDOS a couple of days after our discussion. http://blog.cloudflare.com/65gbps-ddos-no-problem -- Bill

1 0

Re: [RndTbl] bash script for printing lines that don't match?
by Adam Thompson 18 Sep '12

18 Sep '12

( grep -F fileb -v filea ; grep -F filea -v fileb ) | sort | uniq You can simplify that quite a bit if you only need a one-way comparison. This will only work with text files, although it will work with NCS/locales if you have LANG et al. set correctly. -Adam John Lange <john(a)johnlange.ca> wrote: >I think I've asked this in the past but try as I might I can't >remember what the answer was or figure out how I solved it before. > >I have 2 files that are nearly identical and I need to know which >lines in the two files do _not_ match. > >I can think of some relatively complex loops with grep etc. which >would probably work (for every line in file A, grep in file B etc.) >solve the problem but I'm hoping for something more elegant. > >I thought at first that perhaps "join" would do it but even though it >will provide left and right joins, there is no way to prevent it from >outputting the matching lines. > >Any ideas? > >John >_______________________________________________ >Roundtable mailing list >Roundtable(a)muug.mb.ca >http://www.muug.mb.ca/mailman/listinfo/roundtable

1 0

Final Day! *Free to Choose* - Save 50% on ALL O'Reilly Ebooks + More
by Gilbert E. Detillieux 18 Sep '12

18 Sep '12

FYI... -------------------------------------- View in browser <http://post.oreilly.com/rd/9z1z6ie62anpt07vrrgm2u5ul4pgluucbrjnd3m6n88>. O'Reilly Media Free to Choose Final Day! Save 50% on ALL O'Reilly Ebooks + More Jumpstart Your Education with Books, Videos & Courses Fish <http://post.oreilly.com/rd/9z1z302b9aldrq5rlq2m4dql6ph4q722sc3d934hdpo> Get definitive information on technology for developers, designers, admins -- whatever you are or want to be. With our Back-to-School Special, *you choose what to learn* and we give you the tools to *make it happen*. Today is the final day to SAVE 50% on ebooks and videos, 40% on print books from O'Reilly, Microsoft Press, SitePoint, and No Starch, or 30% on courses from O'Reilly School of Technology. See what you'll learn <http://post.oreilly.com/rd/9z1zo3617mrvahve1nuk7s09jq83meapamnq62meeh8> Use discount code: B2S2 This deal expires September 18, 2012 at 11:59pm PT and cannot be combined with other offers or "Print & Ebook" bundle pricing. Spreading the knowledge of innovators. oreilly.com <http://post.oreilly.com/rd/9z1zr87718d99ce046dt7vho8bl9fghmn2ujq9q7ug8> You are receiving this message because you purchased directly from O'Reilly or registered titles. Keep up on all things O'Reilly by signing up for our *email alerts and newsletters* <http://post.oreilly.com/rd/9z1zr4o3nfs2dpsjdpourg777vnrpaot67gfei4pn7o>. To ensure delivery to your inbox (not bulk or junk folders), please add *oreilly(a)post.oreilly.com* <mailto:oreilly@post.oreilly.com> to your address book. To unsubscribe from all email announcements from O'Reilly, click here <http://post.oreilly.com/rd/9z1zddv0s1mus6elal2pljtuts9ogk4p1d776nemjd0>. O'Reilly Media, Inc. 1005 Gravenstein Highway North, Sebastopol, CA 95472 (707) 827-7000

1 0