Spamassassin

Très facile à intégrer à exim4

Installation

apt-get install spamassassin sa-exim

Activer le démon spamassassin
Dans /etc/default/spamassassin mettre ENABLED à 1

sa-exim

Dans /etc/exim4/sa-exim.conf chercher SAEximRunCond et soit l'activer toujours (=1) ou seulement s'il n'y a pas déjà de headers sa-exim dans le message (commenter alors la ligne avec =0)

Option: Greylisting

/etc/spamassassmin/local.cf: recopier les 4 lignes mentionées dans /usr/share/doc/sa-exim/README.greylisting.gz à partir de loadplugin...
/etc/exim4/sa-exim.conf: mettre

SAtempreject: 9.0 (ou 3.0 pour un greylisting plus aggressif)
SAgreylistraisetempreject: 3.0 (or 9.0)

Le total doit être <= SAPermreject!
Apparemment il faut mettre SAmaxrcptlistlength à 8000
Problème: mon fetchmail subit aussi le greylisting. Solution: rendre la valeur du threshold dépendante de l'IP d'origine, fetchmail tournant en local. Rem: la seconde IP est l'IP du vserveur mx

SAtempreject: ${if and { {!eq {$sender_host_address}{127.0.0.1}} {!eq {$sender_host_address}{85.234.207.100}} } {3.0}{10000.0}}

On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne

J'ignore pourquoi mais j'avais des erreurs du style:

spamd[22130]: Reached greylisterror: creating /var/spool/sa-exim/tuplets/158/64/60/... / 
  No such file or directory at /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm line 287.

J'ai résolu ce problème de permissions:

chown Debian-exim:Debian-exim /var/spool/sa-exim/tuplets

Mais maintenant le cron de nettoyage greylistclean se plaint... je l'exécute donc en tant que Debian-exim plutôt que nobody.

/etc/cron.d/greylistclean
33 * * * * Debian-exim [ -x /usr/sbin/greylistclean ] && /usr/sbin/greylistclean

Option: DNS Sender Policy Framework (SPF)

apt-get install libmail-spf-query-perl

À tester davantage...

Upside-down

If we want we can also add a SPF string in our TXT record to help others to identify forgeries with our domain name.

• SPF Project
• SPF Record Syntax
• SPF Wizard
• Validator

The wizard tells me to add the following:

teuwen.org. IN TXT "v=spf1 mx ~all"
mx.yobi.be. IN TXT "v=spf1 a -all"

But I checked my headers when sending a mail and it looks like (when from squirrelmail)

Exim server:

Received: from zeus.yobi.be ([85.234.207.98] helo=mx.yobi.be)
     by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)
     (Exim 4.60)
     (envelope-from <xxxxxxxxx>)
     id xxxxxxxxx
     for xxxxxxxxx; Wed, 06 Dec 2006 15:15:45 +0100

Postfix server:

Received: from mx.yobi.be (zeus.yobi.be [85.234.207.98])
     (using TLSv1 with cipher AES256-SHA (256/256 bits))
     (No client certificate requested)
     by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx
     for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)

Internal forwards:

Received: from private.vlan4 ([192.168.4.19] helo=www.yobi.be)
     by mx.yobi.be with esmtp (Exim 4.63)
     (envelope-from <xxxxxxxxx>)
     id xxxxxxxxx
     for xxxxxxxxx; Wed, 06 Dec:15:54 +0100
Received: from 57.67.161.6
     (SquirrelMail authenticated user phil)
     by www.yobi.be with HTTP;
     Wed, 6 Dec:15:53 +0100 (CET)

So I'm not really sure about the helo sent by my SMTP server...
neither by the IP seen by the destination SMTP server...

Learning new spam

Here is a script to save in e.g. /usr/local/sbin/sa-learn-from-md

#! /bin/sh

[ -x /usr/bin/sa-learn ] || exit 0

# For every existing user who has his homedir under /home and has a Maildir
for i in $(cut -f6 -d: /etc/passwd|grep /home);
do 
    if [ -d $i/Maildir/.*SPAM.learn-spam/cur ];
    then 
        # Get the mails to train spamassassin
        for f in $i/Maildir/.*SPAM.learn-spam/cur/*; do
                if [ -e $f ]; then
                       # Debian-exim does not have read access to the mails so we pipe them
                        cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --spam" |grep -v "Learned tokens from"
                        # Move files to the Spam dir
                        #mv $f $i/Maildir/.*SPAM/cur/
                        # Or just delete it
                        rm -f $f
                fi
        done
    fi;
    if [ -d $i/Maildir/.*SPAM.learn-ham/cur ];
    then 
        # Get the mails to train spamassassin
        for f in $i/Maildir/.*SPAM.learn-ham/cur/*; do
                if [ -e $f ]; then
                       # Debian-exim does not have read access to the mails so we pipe them
                        cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --ham" |grep -v "Learned tokens from"
                        # Move files to the Inbox dir
                        mv $f $i/Maildir/cur/
                        # Or just delete it
                        #rm -f $f
                fi
        done
    fi;
done

exit 0

And you can schedule cron to call it e.g. hourly:

mx:/etc/cron.hourly# ln -s /usr/local/sbin/sa-learn-from-md

So, what does it do?
To use it, create a "SPAM" directory with a "learn-spam" sub-dir in your Maildir via e.g. IMAP.
Drop the non-filtered spam you got into the SPAM/learn-spam.
Every hour the mails will be used to train the global spamassassin DB and then will be moved to the SPAM dir or just deleted, depending on what you've chosen.
If you want you can also create a "learn-ham" sub-dir and drop the false positives flagged as spam into the SPAM/learn-ham.