From YobiWiki
Revision as of 01:50, 26 February 2008 by PhilippeTeuwen (talk | contribs)
Jump to navigation Jump to search

Très facile à intégrer à exim4


apt-get install spamassassin sa-exim

Activer le démon spamassassin
Dans /etc/default/spamassassin mettre ENABLED à 1


Dans /etc/exim4/sa-exim.conf chercher SAEximRunCond et soit l'activer toujours (=1) ou seulement s'il n'y a pas déjà de headers sa-exim dans le message (commenter alors la ligne avec =0)

Option: Greylisting

/etc/spamassassmin/ recopier les 4 lignes mentionées dans /usr/share/doc/sa-exim/README.greylisting.gz à partir de loadplugin...
/etc/exim4/sa-exim.conf: mettre

SAtempreject: 9.0 (ou 3.0 pour un greylisting plus aggressif)
SAgreylistraisetempreject: 3.0 (or 9.0)

Le total doit être <= SAPermreject!
Apparemment il faut mettre SAmaxrcptlistlength à 8000
Problème: mon fetchmail subit aussi le greylisting. Solution: rendre la valeur du threshold dépendante de l'IP d'origine, fetchmail tournant en local. Rem: la seconde IP est l'IP du vserveur mx

SAtempreject: ${if and { {!eq {$sender_host_address}{}} {!eq {$sender_host_address}{}} } {3.0}{10000.0}}

Apparemment fetchmail subit encore des refus, j'essaye maintenant avec:

SAtempreject: ${if and {{!eq {$sender_ident}{fetchmail}} {!eq {$sender_host_address}{}} {!eq {$sender_host_address}{}} } {3.0}{10000.0}}

On peut ajouter d'autres IPs mais il faut veiller à ce que tout tienne sur la même ligne

J'ignore pourquoi mais j'avais des erreurs du style:

spamd[22130]: Reached greylisterror: creating /var/spool/sa-exim/tuplets/158/64/60/... / 
  No such file or directory at /usr/share/perl5/Mail/SpamAssassin/Plugin/ line 287.

J'ai résolu ce problème de permissions:

chown Debian-exim:Debian-exim /var/spool/sa-exim/tuplets

Mais maintenant le cron de nettoyage greylistclean se plaint... je l'exécute donc en tant que Debian-exim plutôt que nobody.

33 * * * * Debian-exim [ -x /usr/sbin/greylistclean ] && /usr/sbin/greylistclean

Option: DNS Sender Policy Framework (SPF)

apt-get install libmail-spf-query-perl

À tester davantage...


If we want we can also add a SPF string in our TXT record to help others to identify forgeries with our domain name.

The wizard tells me to add the following: IN TXT "v=spf1 mx ~all" IN TXT "v=spf1 a -all"

You can check your headers when sending a mail to an address handled by an external SMTP server, it looks like this.

  • Exim server:
Received: from ([]
     by xxxxxxxxx with esmtps (TLSv1:AES256-SHA:256)
     (Exim 4.60)
     (envelope-from <xxxxxxxxx>)
     id xxxxxxxxx
     for xxxxxxxxx; Wed, 06 Dec:15:45 +0100
  • Postfix server:
Received: from ( [])
     (using TLSv1 with cipher AES256-SHA (256/256 bits))
     (No client certificate requested)
     by xxxxxxxxx (Postfix) with ESMTP id xxxxxxxxx
     for <xxxxxxxxx>; Wed, 6 Dec:21:24 +0100 (CET)

Here we can see a disruptance because I was masquerading the output traffic with the host IP (, removing the masquerading solves the problem and the headers look like:

Received: from ( [])

Learning new spam

Here is a script to save in e.g. /usr/local/sbin/sa-learn-from-md

#! /bin/sh

[ -x /usr/bin/sa-learn ] || exit 0

# For every existing user who has his homedir under /home and has a Maildir
for i in $(cut -f6 -d: /etc/passwd|grep /home);
    if [ -d $i/Maildir/.*SPAM.learn-spam/cur ];
        # Get the mails to train spamassassin
        for f in $i/Maildir/.*SPAM.learn-spam/cur/*; do
                if [ -e $f ]; then
                       # Debian-exim does not have read access to the mails so we pipe them
                        cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --spam" |grep -v "Learned tokens from"
                        # Move files to the Spam dir
                        #mv $f $i/Maildir/.*SPAM/cur/
                        # Or just delete it
                        rm -f $f
    if [ -d $i/Maildir/.*SPAM.learn-ham/cur ];
        # Get the mails to train spamassassin
        for f in $i/Maildir/.*SPAM.learn-ham/cur/*; do
                if [ -e $f ]; then
                       # Debian-exim does not have read access to the mails so we pipe them
                        cat $f|su - -s /bin/bash Debian-exim -c "sa-learn --ham" |grep -v "Learned tokens from"
                        # Move files to the Inbox dir
                        mv $f $i/Maildir/cur/
                        # Or just delete it
                        #rm -f $f

exit 0

And you can schedule cron to call it e.g. hourly:

mx:/etc/cron.hourly# ln -s /usr/local/sbin/sa-learn-from-md

So, what does it do?
To use it, create a "SPAM" directory with a "learn-spam" sub-dir in your Maildir via e.g. IMAP.
Drop the non-filtered spam you got into the SPAM/learn-spam.
Every hour the mails will be used to train the global spamassassin DB and then will be moved to the SPAM dir or just deleted, depending on what you've chosen.
If you want you can also create a "learn-ham" sub-dir and drop the false positives flagged as spam into the SPAM/learn-ham.

Converted with HTML::WikiConverter::MediaWiki from my old phpwiki site

To add a sender in the blacklist:

spamassassin --add-addr-to-blacklist <email spammeur>

To add a sender in the whitelist:

spamassassin --add-addr-to-whitelist <email ami fana de HTML ;-)>