Spamassassin - Revision history

PhilippeTeuwen: Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

2010-11-24T20:33:16Z

Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

Can't load revision 6803

at 00:27, 24 November 2010

2010-11-24T00:27:21Z

Can't load revision 6645

PhilippeTeuwen: /* sa-exim */

2008-11-25T21:19:24Z

sa-exim

@@ Line 7: / Line 7: @@
 ==sa-exim==
 Dans /etc/exim4/sa-exim.conf chercher SAEximRunCond et soit l'activer toujours (=1) ou seulement s'il n'y a pas déjà de headers sa-exim dans le message (commenter alors la ligne avec =0)
 ==Option: Greylisting==

PhilippeTeuwen: /* Learning new spam */

2008-03-28T16:36:46Z

Learning new spam

← Older revision		Revision as of 16:36, 28 March 2008
Line 68:		Line 68:
	==Learning new spam==		==Learning new spam==
	Here is a script to save in e.g. /usr/local/sbin/sa-learn-from-md		Here is a script to save in e.g. /usr/local/sbin/sa-learn-from-md
			<source lang=bash>
	<pre>
	#! /bin/sh		#! /bin/sh

Line 107:		Line 107:

	exit 0		exit 0
	</~~pre~~>		</source>
	And you can schedule cron to call it e.g. hourly:		And you can schedule cron to call it e.g. hourly:
	mx:/etc/cron.hourly# ln -s /usr/local/sbin/sa-learn-from-md		mx:/etc/cron.hourly# ln -s /usr/local/sbin/sa-learn-from-md

PhilippeTeuwen at 23:50, 25 February 2008

2008-02-25T23:50:17Z

← Older revision		Revision as of 23:50, 25 February 2008
Line 115:		Line 115:
	<br>Every hour the mails will be used to train the global spamassassin DB and then will be moved to the SPAM dir or just deleted, depending on what you've chosen.		<br>Every hour the mails will be used to train the global spamassassin DB and then will be moved to the SPAM dir or just deleted, depending on what you've chosen.
	<br>If you want you can also create a "learn-ham" sub-dir and drop the false positives flagged as spam into the SPAM/learn-ham.		<br>If you want you can also create a "learn-ham" sub-dir and drop the false positives flagged as spam into the SPAM/learn-ham.
			----
			''Converted with [[MediaWiki#HTML-WikiConverter\|HTML::WikiConverter::MediaWiki]] from my old phpwiki site''
			----

			To add a sender in the blacklist:

			spamassassin --add-addr-to-blacklist <email spammeur>

			To add a sender in the whitelist:

			spamassassin --add-addr-to-whitelist <email ami fana de HTML ;-)>

PhilippeTeuwen: /* Option: Greylisting */

2006-12-11T14:05:50Z

Option: Greylisting

← Older revision		Revision as of 14:05, 11 December 2006
Line 19:		Line 19:
	<br>['''UPDATE''']		<br>['''UPDATE''']
	<br>Apparemment fetchmail subit encore des refus, j'essaye maintenant avec:		<br>Apparemment fetchmail subit encore des refus, j'essaye maintenant avec:
	SAtempreject: ${if or { {eq{$sender_ident}{fetchmail}} ~~and {~~ {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}}}} {3.0}{10000.0}}		SAtempreject: ${if and {{!eq {$sender_ident}{fetchmail}} {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}

	On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne		On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne

PhilippeTeuwen: /* Option: Greylisting */

2006-12-11T00:32:34Z

Option: Greylisting

← Older revision		Revision as of 00:32, 11 December 2006
Line 17:		Line 17:
	<br>Problème: mon fetchmail subit aussi le greylisting. Solution: rendre la valeur du threshold dépendante de l'IP d'origine, fetchmail tournant en local. Rem: la seconde IP est l'IP du vserveur mx		<br>Problème: mon fetchmail subit aussi le greylisting. Solution: rendre la valeur du threshold dépendante de l'IP d'origine, fetchmail tournant en local. Rem: la seconde IP est l'IP du vserveur mx
	SAtempreject: ${if and { {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}		SAtempreject: ${if and { {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}
			<br>['''UPDATE''']
			<br>Apparemment fetchmail subit encore des refus, j'essaye maintenant avec:
			SAtempreject: ${if or { {eq{$sender_ident}{fetchmail}} and { {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}}}} {3.0}{10000.0}}
	On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne		On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne

PhilippeTeuwen: /* Upside-down */

2006-12-06T14:46:56Z

Upside-down

← Older revision		Revision as of 14:46, 6 December 2006
Line 41:		Line 41:
	teuwen.org. IN TXT "v=spf1 mx ~all"		teuwen.org. IN TXT "v=spf1 mx ~all"
	mx.yobi.be. IN TXT "v=spf1 a -all"		mx.yobi.be. IN TXT "v=spf1 a -all"
	~~But~~ I ~~checked~~ my headers when sending a mail ~~and~~ it looks like ~~(when from squirrelmail)~~		You can check your headers when sending a mail to an address handled by an external SMTP server, it looks like this.
		⚫	* Exim server:
	<pre>		<pre>
⚫	Exim server:

	Received: from zeus.yobi.be ([85.234.207.98] helo=mx.yobi.be)		Received: from zeus.yobi.be ([85.234.207.98] helo=mx.yobi.be)
	by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)		by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)
Line 50:		Line 49:
	(envelope-from <xxxxxxxxx>)		(envelope-from <xxxxxxxxx>)
	id xxxxxxxxx		id xxxxxxxxx
	for xxxxxxxxx; Wed, 06 Dec ~~2006 15~~:15:45 +0100		for xxxxxxxxx; Wed, 06 Dec:15:45 +0100
			</pre>

	Postfix server:		* Postfix server:
			<pre>

	Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])		Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])
	(using TLSv1 with cipher AES256-SHA (256/256 bits))		(using TLSv1 with cipher AES256-SHA (256/256 bits))
Line 59:		Line 58:
	by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx		by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx
	for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)		for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)

	Internal forwards:

	Received: from private.vlan4 ([192.168.4.19] helo=www.yobi.be)
	by mx.yobi.be with esmtp (Exim 4.63)
	(envelope-from <xxxxxxxxx>)
	id xxxxxxxxx
	for xxxxxxxxx; Wed, 06 Dec:15:54 +0100
	Received: from 57.67.161.6
	(SquirrelMail authenticated user phil)
	by www.yobi.be with HTTP;
	Wed, 6 Dec:15:53 +0100 (CET)
	</pre>		</pre>
			Here we can see a disruptance because I was masquerading the output traffic with the host IP (85.234.207.98), removing the masquerading solves the problem and the headers look like:
	So I'm not really sure about the helo sent by my SMTP server...
			Received: from mx.yobi.be (mx.yobi.be [85.234.207.100])
	<br>neither by the IP seen by the destination SMTP server...

	==Learning new spam==		==Learning new spam==

PhilippeTeuwen: /* Upside-down */

2006-12-06T14:34:05Z

Upside-down

← Older revision		Revision as of 14:34, 6 December 2006
Line 43:		Line 43:
	But I checked my headers when sending a mail and it looks like (when from squirrelmail)		But I checked my headers when sending a mail and it looks like (when from squirrelmail)
	<pre>		<pre>
			Exim server:

			Received: from zeus.yobi.be ([85.234.207.98] helo=mx.yobi.be)
			by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)
			(Exim 4.60)
			(envelope-from <xxxxxxxxx>)
			id xxxxxxxxx
			for xxxxxxxxx; Wed, 06 Dec 2006 15:15:45 +0100

			Postfix server:

	Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])		Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])
	(using TLSv1 with cipher AES256-SHA (256/256 bits))		(using TLSv1 with cipher AES256-SHA (256/256 bits))
	(No client certificate requested)		(No client certificate requested)
	by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx		by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx
	for <xxxxxxxxx>; Wed, 6 Dec ~~2006 15~~:21:24 +0100 (CET)		for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)

			Internal forwards:

	Received: from private.vlan4 ([192.168.4.19] helo=www.yobi.be)		Received: from private.vlan4 ([192.168.4.19] helo=www.yobi.be)
	by mx.yobi.be with esmtp (Exim 4.63)		by mx.yobi.be with esmtp (Exim 4.63)
	(envelope-from <~~phil@teuwen.org~~>)		(envelope-from <xxxxxxxxx>)
	id xxxxxxxxx		id xxxxxxxxx
	for xxxxxxxxx; Wed, 06 Dec ~~2006 15~~:15:54 +0100		for xxxxxxxxx; Wed, 06 Dec:15:54 +0100
	Received: from 57.67.161.6		Received: from 57.67.161.6
	(SquirrelMail authenticated user phil)		(SquirrelMail authenticated user phil)
	by www.yobi.be with HTTP;		by www.yobi.be with HTTP;
	Wed, 6 Dec ~~2006 15~~:15:53 +0100 (CET)		Wed, 6 Dec:15:53 +0100 (CET)
	</pre>		</pre>
	So I'm not really sure about the helo sent by my SMTP server...		So I'm not really sure about the helo sent by my SMTP server...

PhilippeTeuwen: /* Option: DNS Sender Policy Framework (SPF) */

2006-12-06T14:23:47Z

Option: DNS Sender Policy Framework (SPF)

@@ Line 31: / Line 31: @@
  apt-get install libmail-spf-query-perl
 À tester davantage...
 ==Learning new spam==