Spamassassin
Très facile à intégrer à exim4
Installation
apt-get install spamassassin sa-exim
Activer le démon spamassassin
Dans /etc/default/spamassassin mettre ENABLED à 1
sa-exim
Dans /etc/exim4/sa-exim.conf chercher SAEximRunCond et soit l'activer toujours (=1) ou seulement s'il n'y a pas déjà de headers sa-exim dans le message (commenter alors la ligne avec =0)
Tuning SAEximRunCond
In /etc/exim4/sa-exim.conf there is a variable SAEximRunCond which is expansed for every message travelling to know if it should be sent to Spamassassin or not.
You can tune it e.g. to avoid to scan mails coming from trusted computers or even IP ranges:
SAEximRunCond: ${if and {{def:sender_host_address} {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{1.2.3.4}} {!eq {${mask:${sender_host_address}/24}}{10.20.30.0/24}}} }
You can also rely on existing Exim ACLs:
SAEximRunCond: ${if and {{def:sender_host_address}{!eq{$acl_m0}{noscan}}}}
So mails from localhost, from hosts we accept to relay and from authenticated connections are not scanned anymore.
This requires $acl_m0 to be defined in the ACL rules, which was apparently the case in the past but not anymore in Debian config, so here is how to restore them again (you can download [{{#file: exim4-config-acl_m0.diff}} the patch here]):
--- /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt 2008-03-23 15:46:20.000000000 +0100
+++ /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt 2008-11-14 12:21:41.000000000 +0100
@@ -12,7 +12,7 @@
# testing for an empty sending host field.
accept
hosts = :
-
+ set acl_m0 = noscan
# The following section of the ACL is concerned with local parts that contain
# certain non-alphanumeric characters. Dots in unusual places are
@@ -146,7 +146,7 @@
accept
hosts = +relay_from_hosts
control = submission/sender_retain
-
+ set acl_m0 = noscan
# Accept if the message arrived over an authenticated connection, from
# any host. Again, these messages are usually from MUAs, so recipient
@@ -155,7 +155,7 @@
accept
authenticated = *
control = submission/sender_retain
-
+ set acl_m0 = noscan
# Insist that any other recipient address that we accept is either in one of
# our local domains, or is in a domain for which we explicitly allow
Option: Greylisting
/etc/spamassassmin/local.cf: recopier les 4 lignes mentionées dans /usr/share/doc/sa-exim/README.greylisting.gz à partir de loadplugin...
/etc/exim4/sa-exim.conf: mettre
SAtempreject: 9.0 (ou 3.0 pour un greylisting plus aggressif) SAgreylistraisetempreject: 3.0 (or 9.0)
Le total doit être <= SAPermreject!
Apparemment il faut mettre SAmaxrcptlistlength à 8000
Problème: mon fetchmail subit aussi le greylisting. Solution: rendre la valeur du threshold dépendante de l'IP d'origine, fetchmail tournant en local. Rem: la seconde IP est l'IP du vserveur mx
SAtempreject: ${if and { {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}
[UPDATE]
Apparemment fetchmail subit encore des refus, j'essaye maintenant avec:
SAtempreject: ${if and {{!eq {$sender_ident}{fetchmail}} {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}
On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne
J'ignore pourquoi mais j'avais des erreurs du style:
spamd[22130]: Reached greylisterror: creating /var/spool/sa-exim/tuplets/158/64/60/... / No such file or directory at /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm line 287.
J'ai résolu ce problème de permissions:
chown Debian-exim:Debian-exim /var/spool/sa-exim/tuplets
Mais maintenant le cron de nettoyage greylistclean se plaint... je l'exécute donc en tant que Debian-exim plutôt que nobody.
/etc/cron.d/greylistclean 33 * * * * Debian-exim [ -x /usr/sbin/greylistclean ] && /usr/sbin/greylistclean
Option: DNS Sender Policy Framework (SPF)
apt-get install libmail-spf-query-perl
À tester davantage...
Upside-down
If we want we can also add a SPF string in our TXT record to help others to identify forgeries with our domain name.
The wizard tells me to add the following:
teuwen.org. IN TXT "v=spf1 mx ~all" mx.yobi.be. IN TXT "v=spf1 a -all"
You can check your headers when sending a mail to an address handled by an external SMTP server, it looks like this.
- Exim server:
Received: from zeus.yobi.be ([85.234.207.98] helo=mx.yobi.be)
by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.60)
(envelope-from <xxxxxxxxx>)
id xxxxxxxxx
for xxxxxxxxx; Wed, 06 Dec:15:45 +0100
- Postfix server:
Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])
(using TLSv1 with cipher AES256-SHA (256/256 bits))
(No client certificate requested)
by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx
for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)
Here we can see a disruptance because I was masquerading the output traffic with the host IP (85.234.207.98), removing the masquerading solves the problem and the headers look like:
Received: from mx.yobi.be (mx.yobi.be [85.234.207.100])
Learning new spam
Here is a script to save in e.g. /usr/local/sbin/sa-learn-from-md
#! /bin/sh
[ -x /usr/bin/sa-learn ] || exit 0
# For every existing user who has his homedir under /home and has a Maildir
for i in $(cut -f6 -d: /etc/passwd|grep /home);
do
if [ -d $i/Maildir/.*SPAM.learn-spam/cur ];
then
# Get the mails to train spamassassin
for f in $i/Maildir/.*SPAM.learn-spam/cur/*; do
if [ -e $f ]; then
# Debian-exim does not have read access to the mails so we pipe them
cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --spam" |grep -v "Learned tokens from"
# Move files to the Spam dir
#mv $f $i/Maildir/.*SPAM/cur/
# Or just delete it
rm -f $f
fi
done
fi;
if [ -d $i/Maildir/.*SPAM.learn-ham/cur ];
then
# Get the mails to train spamassassin
for f in $i/Maildir/.*SPAM.learn-ham/cur/*; do
if [ -e $f ]; then
# Debian-exim does not have read access to the mails so we pipe them
cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --ham" |grep -v "Learned tokens from"
# Move files to the Inbox dir
mv $f $i/Maildir/cur/
# Or just delete it
#rm -f $f
fi
done
fi;
done
exit 0
And you can schedule cron to call it e.g. hourly:
mx:/etc/cron.hourly# ln -s /usr/local/sbin/sa-learn-from-md
So, what does it do?
To use it, create a "SPAM" directory with a "learn-spam" sub-dir in your Maildir via e.g. IMAP.
Drop the non-filtered spam you got into the SPAM/learn-spam.
Every hour the mails will be used to train the global spamassassin DB and then will be moved to the SPAM dir or just deleted, depending on what you've chosen.
If you want you can also create a "learn-ham" sub-dir and drop the false positives flagged as spam into the SPAM/learn-ham.
Converted with HTML::WikiConverter::MediaWiki from my old phpwiki site
To add a sender in the blacklist:
spamassassin --add-addr-to-blacklist <email spammeur>
To add a sender in the whitelist:
spamassassin --add-addr-to-whitelist <email ami fana de HTML ;-)>