Install and Debug Spamassassin Rules

Question

Install and Debug Spamassassin Rules

As a test, I installed the rule "70 sarehtml0.cf" (from http://www.rulesemporium.com) into /etc/mail/spamassassin of my server.

I then ran sudo su clamav -c "spamassassin -D --lint"

However, part of my results seem to indicate a problem with the new rule I installed (see results below). Any ideas as to what I am doing wrong?

[4378] dbg: rules: running meta tests; score so far=-0.15
[4378] info: rules: meta test SARE HTML_URIOBFU4 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URI2SLASH has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test DIGEST_MULTIPLE has undefined dependency 'DCC_CHECK'
[4378] info: rules: meta test SARE HTML_COLORB has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE PHISH_HTML01 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIMANYP2 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_MANYBR10 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_USLB7 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_FONTINVIS2 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIPARTID has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTMLBADOPEN has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_NOBODY has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_HTMLAFTER has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIHREF has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_FONTEBEF has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIFORMPHP has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_HEADAFFIL has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_COLORNWHT3 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTMLLEAKTHRU2 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_EHTMLOBFU has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_NOHTML1 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_ONELINE3 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_USLB9 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URINUMPHP3 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_BAD_FGCLR has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIHIDADD has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIRID has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIDEFASP has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_ALTWAIT2 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_GIFDIM has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTMLLEAKTHRU1 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_INVTAGA has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIOFF has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_HTMLDBL has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URILOGOGEN has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_IMGONLY has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIOBFU4a has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_PJUSTIFY has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTMLPOB1200 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_USLMULT has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_TITLESEX has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIBADQRY has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_JVSHREF has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_HTMLTBL has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_FSIZE1ALL has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIMANYP3 has undefined dependency ' _SARE_HEADFALSE'
[4378] info: rules: meta test SARE HTML_URIAXEL has undefined dependency ' _SARE_HEADFALSE'
[4378] dbg: rules: running header regexp tests; score so far=1.796

XServe G5, Mac OS X (10.4.7)

Posted on Aug 17, 2006 1:35 PM

Reply

Answer 1

UptimeJeff

Level 4

3,479 points

Aug 17, 2006 2:49 PM in response to Joel Mcintosh1

Without the rule you don't get these errors and with the rule you do?

Check permissions of the file and/or post output of:
ls -al /etc/mail/spamassassin

How did you install the rule? Was it copied/pasted with a GUI editor?

Jeff

Reply

Answer 2

Aug 17, 2006 3:20 PM in response to UptimeJeff

Hi Jeff,

Without the rule you don't get these errors and with the rule you do?

That is correct.

Check permissions of the file and/or post output of:
ls -al /etc/mail/spamassassin

drwxr-xr-x 8 root wheel 272 Aug 17 17:02 .
drwxr-xr-x 5 root wheel 170 Jul 22 21:20 ..
-rw-r--r-- 1 root wheel 28066 Aug 17 17:02 70 sarehtml0.cf
-rw-r--r-- 1 root wheel 935 Mar 20 2005 init.pre
-rwxr-xr-x 1 root wheel 1311 Mar 20 2005 learn junkmail
-rw-r--r-- 1 root wheel 672 Aug 8 17:33 local.cf
-rw-r--r-- 1 root wheel 2179 Aug 8 16:32 v310.pre
-rw-r--r-- 1 root wheel 806 Aug 8 16:32 v312.pre

How did you install the rule? Was it copied/pasted with a GUI editor?

I downloaded ("Save Linked File to the Desktop" in Safari). Then, I used Terminal (issued su previously) to "cp /Users/admin/Desktop/70 sarehtml0.cf /etc/mail/spamassassin/"

Reply

Answer 3

UptimeJeff

Level 4

3,479 points

Aug 17, 2006 3:53 PM in response to Joel Mcintosh1

perms look fine.
I don't have that rule loaded, so can't compare debug results to my installation.
no other suggestions.

Jeff

Reply

Answer 4

davidh

Level 4

1,896 points

Aug 18, 2006 6:18 AM in response to UptimeJeff

I have that rule as well and with no such problem.

run:

less /etc/mail/spamassassin/70 sarehtml0.cf

and check the start of the file, should read as:

# SARE HTML Ruleset for SpamAssassin - ruleset 0
# Version: 01.03.08
# Created: 2004-03-31
# Modified: 2005-10-05
# Usage instructions, documentation, and change history in 70 sarehtml0.cf

press the forward-slash key: /
and then type in:
URI_OBFU4
and press return.

Should see:

meta SARE HTML_URIOBFU4 0 # archived Feb 26 2005, 01.03.04
meta SARE HTML_URIOBFU4a 0 # archived Feb 26 2005, 01.03.04
meta SARE HTML_URIPARTID 0 # Moved 0 to 1, Feb 26 2005, 01.03.04
meta SARE HTML_URIRID 0 # archived Feb 26 2005, 01.03.04
meta SARE HTML_USLMULT 0 # archived Feb 26 2005, 01.03.04
meta SARE HTML_FONTEBEF 0 # Moved 0 to 1, Mar 12 2005, 01.03.05
meta SARE HTML_URIDEFASP 0 # Moved 0 to 1, Mar 12 2005, 01.03.05
meta SARE HTML_INVTAGA 0

Reply

Answer 5

Aug 18, 2006 7:41 AM in response to davidh

Hi David,

check the start of the file, should read ...

Mine looks a little different because I'm using a newer version, but otherwise it looks the same:

# SARE HTML Ruleset for SpamAssassin - ruleset 0
# Version: 01.03.10
# Created: 2004-03-31
# Modified: 2006-06-03
# Usage instructions, documentation, and change history in 70 sarehtml0.cf

press the forward-slash key: /
and then type in:
URI_OBFU4
and press return.

Should see ...

I get different results from the ones you posted. My results are listed below:

meta SARE HTML_URIOBFU4 _SARE_HEADFALSE
meta SARE HTML_URIOBFU4a _SARE_HEADFALSE
meta SARE HTML_URIPARTID _SARE_HEADFALSE
meta SARE HTML_URIRID _SARE_HEADFALSE
meta SARE HTML_USLMULT _SARE_HEADFALSE
meta SARE HTML_FONTEBEF _SARE_HEADFALSE
meta SARE HTML_URIDEFASP _SARE_HEADFALSE
meta SARE HTML_INVTAGA _SARE_HEADFALSE
meta SARE HTML_EHTMLOBFU _SARE_HEADFALSE
meta SARE HTML_HEADAFFIL _SARE_HEADFALSE
meta SARE HTMLLEAKTHRU1 _SARE_HEADFALSE
meta SARE HTMLLEAKTHRU2 _SARE_HEADFALSE
meta SARE HTML_ONELINE3 _SARE_HEADFALSE
meta SARE HTMLPOB1200 _SARE_HEADFALSE
meta SARE HTML_URIHIDADD _SARE_HEADFALSE
meta SARE HTML_URILOGOGEN _SARE_HEADFALSE
meta SARE HTML_URIOFF _SARE_HEADFALSE
meta SARE HTML_USLB7 _SARE_HEADFALSE
meta SARE HTML_USLB9 _SARE_HEADFALSE
meta SARE PHISH_HTML01 _SARE_HEADFALSE

######## ###################### ##################################################

rawbody _SARE_HTML_HASA eval:html tagexists('a')
rawbody _SARE_HTML_HASBR eval:html tagexists('br')
rawbody _SARE_HTML_HASDIV eval:html tagexists('div')
rawbody _SARE_HTML_HASFONT eval:html tagexists('font')
rawbody _SARE_HTML_HASIMG eval:html tagexists('img')
rawbody _SARE_HTML_HASP eval:html tagexists('p')
rawbody _SARE_HTML_HASPRE eval:html tagexists('pre')
rawbody _SARE_HTML_HASTITLE eval:html tagexists('title')

rawbody _SARE_HTMLHBODY m'<html><body>'i
rawbody _SARE_HTMLBEHTML m'<body></html>'i
rawbody _SARE_HTMLBEHTML2 m'^</?body></html>'i
rawbody _SARE_HTMLEFONT m'^'i
rawbody _SARE_HTMLEHEB m'^</html></body>'i
rawbody _SARE_HTML_CMTCNTR /<center><!--/

Reply

Answer 6

Aug 18, 2006 9:08 AM in response to Joel Mcintosh1

I think everything is fine. I found a discussion on the spamassassin developers forum ( http://www.mail-archive.com/dev@spamassassin.apache.org/msg15497.html) that addressed this issue.

Apparently, results from ...

sudo su clamav -c "spamassassin -D --lint"

... that begin with "info: rules:" do not indicate an error. They are just information (duh).

Reply