Installation und Konfiguration von Spamassassin

Transcription

22.12.2016 13:32.
1/22
Installation und Konfiguration von Spamassassin
Installation und Konfiguration von
Spamassassin
Grundlagen
SpamAssassin ist ein weitverbreitetes Filterprogramm, mit dem unerwünschte eMails (Spam)
automatisch erkannt und aussortiert werden können. Ebenso wie AMaViS ist SpamAssassin ein
Perl-Programm, mit der eine inhaltliche Bewertung einer eMail erfolgt. SpamAssassin selbst ermittelt
und berechnet einen Scoring-Wert einer jeden eMail und übergibt diesen Wert an AMaVis. AMaViS
selbst kann nun an Hand des übermittelten Scoringwertes eine eMail durchlassen, taggen (also z.B.
die Betreffzeile manipulieren) oder ablehnen. SpamAssassin ist also nur ein Backendsystem von
AMaViS.
Linux - Wissensdatenbank - https://dokuwiki.nausch.org/
Last update: 19.11.2014 19:08.
centos:mail_c6:spam_5 https://dokuwiki.nausch.org/doku.php/centos:mail_c6:spam_5
Für die Unterscheidung zwischen HAM1) und SPAM2) bedient sich SpamAssassin unterschiedlicher
Techniken:
Abfrage von RBLs3).
Abfrage von Prüfsummenbasierten Filtern wie DCC, Pyzor und Razor.
Nutzung regulärer Ausdrücke zum statischen Bewerten der eMails
Nutzung interner Bayesscher Filter, die auf Grund der Einteilung der bisher empfangenen eMails
statistisch die Wahrscheinlichkeit von HAM zu SPAM ermitteln.
Installation
Wie üblich installieren wir die benötigten Programmpakete via YUM.
# yum install spamassassin -y
Programminfo
Was uns das Paket alle bei der Installation mitgebracht hat, zeigt uns ein Blick in das installierte rpm.
# rpm -qil spamassassin
Name
: spamassassin
Relocations: (not relocatable)
Version
: 3.3.1
Vendor: CentOS
Release
: 2.el6
Build Date: Mon 23 Aug 2010
04:28:38 AM CEST
Install Date: Sun 10 Jun 2012 12:35:02 PM CEST
Build Host:
c6b2.bsys.dev.centos.org
Group
: Applications/Internet
Source RPM:
spamassassin-3.3.1-2.el6.src.rpm
Size
: 3253352
License: ASL 2.0
Signature
: RSA/8, Sun 03 Jul 2011 07:02:17 AM CEST, Key ID
0946fca2c105b9de
Packager
: CentOS BuildSystem <http://bugs.centos.org>
URL
: http://spamassassin.apache.org/
Summary
: Spam filter for email which can be invoked from mail delivery
agents
Description :
SpamAssassin provides you with a way to reduce if not completely eliminate
Unsolicited Commercial Email (SPAM) from your incoming email. It can
be invoked by a MDA such as sendmail or postfix, or can be called from
a procmail script, .forward file, etc. It uses a genetic-algorithm
evolved scoring system to identify messages which look spammy, then
adds headers to the message so they can be filtered by the user's mail
reading software. This distribution includes the spamd/spamc components
which create a server that considerably speeds processing of mail.
To enable spamassassin, if you are receiving mail locally, simply add
https://dokuwiki.nausch.org/
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
3/22
this line to your ~/.procmailrc:
INCLUDERC=/etc/mail/spamassassin/spamassassin-default.rc
To filter spam for all users, add that line to /etc/procmailrc
(creating if necessary).
/etc/cron.d/sa-update
/etc/logrotate.d/sa-update
/etc/mail/spamassassin
/etc/mail/spamassassin/channel.d
/etc/mail/spamassassin/channel.d/sought.conf
/etc/mail/spamassassin/channel.d/spamassassin-official.conf
/etc/mail/spamassassin/init.pre
/etc/mail/spamassassin/local.cf
/etc/mail/spamassassin/sa-update-keys
/etc/mail/spamassassin/spamassassin-default.rc
/etc/mail/spamassassin/spamassassin-helper.sh
/etc/mail/spamassassin/spamassassin-spamc.rc
/etc/mail/spamassassin/v310.pre
/etc/portreserve/spamd
/etc/rc.d/init.d/spamassassin
/etc/sysconfig/sa-update
/etc/sysconfig/spamassassin
/usr/bin/sa-awl
/usr/bin/sa-check_spamd
/usr/bin/sa-compile
/usr/bin/sa-learn
/usr/bin/sa-update
/usr/bin/spamassassin
/usr/bin/spamc
/usr/bin/spamd
/usr/share/doc/spamassassin-3.3.1
/usr/share/doc/spamassassin-3.3.1/CREDITS
/usr/share/doc/spamassassin-3.3.1/Changes
/usr/share/doc/spamassassin-3.3.1/LICENSE
/usr/share/doc/spamassassin-3.3.1/NOTICE
/usr/share/doc/spamassassin-3.3.1/README
/usr/share/doc/spamassassin-3.3.1/README.RHEL.Fedora
/usr/share/doc/spamassassin-3.3.1/TRADEMARK
/usr/share/doc/spamassassin-3.3.1/UPGRADE
/usr/share/doc/spamassassin-3.3.1/USAGE
/usr/share/doc/spamassassin-3.3.1/sample-nonspam.txt
/usr/share/doc/spamassassin-3.3.1/sample-spam.txt
/usr/share/man/man1/sa-compile.1.gz
/usr/share/man/man1/sa-learn.1.gz
/usr/share/man/man1/sa-update.1.gz
/usr/share/man/man1/spamassassin-run.1.gz
/usr/share/man/man1/spamassassin.1.gz
/usr/share/man/man1/spamc.1.gz
Last update: 19.11.2014 19:08.
/usr/share/man/man1/spamd.1.gz
/usr/share/man/man3/Mail::SpamAssassin.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AICache.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::ArchiveIterator.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AsyncLoop.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AutoWhitelist.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Bayes.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::BDB.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::MySQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::PgSQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::SQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Client.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::LDAP.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::Parser.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::SQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::DnsResolver.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::File.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::Stderr.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::Syslog.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message::Metadata.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message::Node.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PerMsgLearner.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PersistentAddrList.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::ASN.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AWL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AccessDB.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AntiVirus.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AutoLearnThreshold.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Bayes.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::BodyRuleBaseExtractor.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Check.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DCC.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DKIM.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Hashcash.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::MIMEHeader.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::OneLineBodyRuleType.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::PhishTag.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Pyzor.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Razor2.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::RelayCountry.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::ReplaceTags.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Reuse.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Rule2XSBody.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::SPF.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Shortcircuit.3pm.gz
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
5/22
/usr/share/man/man3/Mail::SpamAssassin::Plugin::SpamCop.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Test.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::TextCat.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::URIDNSBL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::URIDetail.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::VBounce.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::WhiteListSubject.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PluginHandler.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::SQLBasedAddrList.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::SubProcBackChannel.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Timeout.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util::DependencyInfo.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util::Progress.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util::RegistrarBoundaries.3pm.gz
/usr/share/man/man3/spamassassin-run.3pm.gz
/usr/share/perl5/Mail
/usr/share/perl5/Mail/SpamAssassin
/usr/share/perl5/Mail/SpamAssassin.pm
/usr/share/perl5/Mail/SpamAssassin/AICache.pm
/usr/share/perl5/Mail/SpamAssassin/ArchiveIterator.pm
/usr/share/perl5/Mail/SpamAssassin/AsyncLoop.pm
/usr/share/perl5/Mail/SpamAssassin/AutoWhitelist.pm
/usr/share/perl5/Mail/SpamAssassin/Bayes
/usr/share/perl5/Mail/SpamAssassin/Bayes.pm
/usr/share/perl5/Mail/SpamAssassin/Bayes/CombineChi.pm
/usr/share/perl5/Mail/SpamAssassin/Bayes/CombineNaiveBayes.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore
/usr/share/perl5/Mail/SpamAssassin/BayesStore.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/BDB.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/DBM.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/MySQL.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/PgSQL.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/SDBM.pm
/usr/share/perl5/Mail/SpamAssassin/BayesStore/SQL.pm
/usr/share/perl5/Mail/SpamAssassin/Client.pm
/usr/share/perl5/Mail/SpamAssassin/Conf
/usr/share/perl5/Mail/SpamAssassin/Conf.pm
/usr/share/perl5/Mail/SpamAssassin/Conf/LDAP.pm
/usr/share/perl5/Mail/SpamAssassin/Conf/Parser.pm
/usr/share/perl5/Mail/SpamAssassin/Conf/SQL.pm
/usr/share/perl5/Mail/SpamAssassin/Constants.pm
/usr/share/perl5/Mail/SpamAssassin/DBBasedAddrList.pm
/usr/share/perl5/Mail/SpamAssassin/Dns.pm
/usr/share/perl5/Mail/SpamAssassin/DnsResolver.pm
/usr/share/perl5/Mail/SpamAssassin/HTML.pm
/usr/share/perl5/Mail/SpamAssassin/Locales.pm
/usr/share/perl5/Mail/SpamAssassin/Locker
/usr/share/perl5/Mail/SpamAssassin/Locker.pm
/usr/share/perl5/Mail/SpamAssassin/Locker/Flock.pm
/usr/share/perl5/Mail/SpamAssassin/Locker/UnixNFSSafe.pm
Last update: 19.11.2014 19:08.
/usr/share/perl5/Mail/SpamAssassin/Locker/Win32.pm
/usr/share/perl5/Mail/SpamAssassin/Logger
/usr/share/perl5/Mail/SpamAssassin/Logger.pm
/usr/share/perl5/Mail/SpamAssassin/Logger/File.pm
/usr/share/perl5/Mail/SpamAssassin/Logger/Stderr.pm
/usr/share/perl5/Mail/SpamAssassin/Logger/Syslog.pm
/usr/share/perl5/Mail/SpamAssassin/MailingList.pm
/usr/share/perl5/Mail/SpamAssassin/Message
/usr/share/perl5/Mail/SpamAssassin/Message.pm
/usr/share/perl5/Mail/SpamAssassin/Message/Metadata
/usr/share/perl5/Mail/SpamAssassin/Message/Metadata.pm
/usr/share/perl5/Mail/SpamAssassin/Message/Metadata/Received.pm
/usr/share/perl5/Mail/SpamAssassin/Message/Node.pm
/usr/share/perl5/Mail/SpamAssassin/NetSet.pm
/usr/share/perl5/Mail/SpamAssassin/PerMsgLearner.pm
/usr/share/perl5/Mail/SpamAssassin/PerMsgStatus.pm
/usr/share/perl5/Mail/SpamAssassin/PersistentAddrList.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin
/usr/share/perl5/Mail/SpamAssassin/Plugin.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/ASN.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/AWL.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/AccessDB.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/AntiVirus.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/AutoLearnThreshold.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Bayes.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/BodyEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/BodyRuleBaseExtractor.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Check.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/DCC.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/DKIM.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/DNSEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/FreeMail.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/HTMLEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/HTTPSMismatch.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Hashcash.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/HeaderEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/ImageInfo.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/MIMEEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/MIMEHeader.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/OneLineBodyRuleType.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/PhishTag.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Pyzor.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Razor2.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/RelayCountry.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/RelayEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/ReplaceTags.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Reuse.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Rule2XSBody.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/SPF.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/Shortcircuit.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/SpamCop.pm
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
7/22
/usr/share/perl5/Mail/SpamAssassin/Plugin/Test.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/TextCat.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/URIDNSBL.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/URIDetail.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/URIEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/VBounce.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/WLBLEval.pm
/usr/share/perl5/Mail/SpamAssassin/Plugin/WhiteListSubject.pm
/usr/share/perl5/Mail/SpamAssassin/PluginHandler.pm
/usr/share/perl5/Mail/SpamAssassin/Reporter.pm
/usr/share/perl5/Mail/SpamAssassin/SQLBasedAddrList.pm
/usr/share/perl5/Mail/SpamAssassin/SpamdForkScaling.pm
/usr/share/perl5/Mail/SpamAssassin/SubProcBackChannel.pm
/usr/share/perl5/Mail/SpamAssassin/Timeout.pm
/usr/share/perl5/Mail/SpamAssassin/Util
/usr/share/perl5/Mail/SpamAssassin/Util.pm
/usr/share/perl5/Mail/SpamAssassin/Util/DependencyInfo.pm
/usr/share/perl5/Mail/SpamAssassin/Util/Progress.pm
/usr/share/perl5/Mail/SpamAssassin/Util/RegistrarBoundaries.pm
/usr/share/perl5/Mail/SpamAssassin/Util/ScopedTimer.pm
/usr/share/perl5/Mail/SpamAssassin/Util/TieOneStringHash.pm
/usr/share/perl5/spamassassin-run.pod
/usr/share/spamassassin
/usr/share/spamassassin/10_default_prefs.cf
/usr/share/spamassassin/20_advance_fee.cf
/usr/share/spamassassin/20_aux_tlds.cf
/usr/share/spamassassin/20_body_tests.cf
/usr/share/spamassassin/20_compensate.cf
/usr/share/spamassassin/20_dnsbl_tests.cf
/usr/share/spamassassin/20_drugs.cf
/usr/share/spamassassin/20_dynrdns.cf
/usr/share/spamassassin/20_fake_helo_tests.cf
/usr/share/spamassassin/20_freemail.cf
/usr/share/spamassassin/20_freemail_domains.cf
/usr/share/spamassassin/20_head_tests.cf
/usr/share/spamassassin/20_html_tests.cf
/usr/share/spamassassin/20_imageinfo.cf
/usr/share/spamassassin/20_meta_tests.cf
/usr/share/spamassassin/20_net_tests.cf
/usr/share/spamassassin/20_phrases.cf
/usr/share/spamassassin/20_porn.cf
/usr/share/spamassassin/20_ratware.cf
/usr/share/spamassassin/20_uri_tests.cf
/usr/share/spamassassin/20_vbounce.cf
/usr/share/spamassassin/23_bayes.cf
/usr/share/spamassassin/25_accessdb.cf
/usr/share/spamassassin/25_antivirus.cf
/usr/share/spamassassin/25_asn.cf
/usr/share/spamassassin/25_dcc.cf
/usr/share/spamassassin/25_dkim.cf
/usr/share/spamassassin/25_hashcash.cf
Last update: 19.11.2014 19:08.
/usr/share/spamassassin/25_pyzor.cf
/usr/share/spamassassin/25_razor2.cf
/usr/share/spamassassin/25_replace.cf
/usr/share/spamassassin/25_spf.cf
/usr/share/spamassassin/25_textcat.cf
/usr/share/spamassassin/25_uribl.cf
/usr/share/spamassassin/30_text_de.cf
/usr/share/spamassassin/30_text_fr.cf
/usr/share/spamassassin/30_text_it.cf
/usr/share/spamassassin/30_text_nl.cf
/usr/share/spamassassin/30_text_pl.cf
/usr/share/spamassassin/30_text_pt_br.cf
/usr/share/spamassassin/50_scores.cf
/usr/share/spamassassin/60_adsp_override_dkim.cf
/usr/share/spamassassin/60_awl.cf
/usr/share/spamassassin/60_shortcircuit.cf
/usr/share/spamassassin/60_whitelist.cf
/usr/share/spamassassin/60_whitelist_dkim.cf
/usr/share/spamassassin/60_whitelist_spf.cf
/usr/share/spamassassin/60_whitelist_subject.cf
/usr/share/spamassassin/72_active.cf
/usr/share/spamassassin/72_scores.cf
/usr/share/spamassassin/STATISTICS-set0-72_scores.cf.txt
/usr/share/spamassassin/languages
/usr/share/spamassassin/local.cf
/usr/share/spamassassin/regression_tests.cf
/usr/share/spamassassin/sa-update-pubkey.txt
/usr/share/spamassassin/sa-update.cron
/usr/share/spamassassin/user_prefs.template
/var/lib/spamassassin
/var/run/spamassassin
Konfiguration
spamassassin
Eine besondere Konfiguration von SpamAssassin ist eigentlich nicht notwendig. Im Verzeichnis
/etc/mail/spamassassin/ befindet sich die Konfigurationsdatei local.cf mit Hilfe derer lokale
Anpassungen an der Installation vorgenommen werden können.
# vim /etc/mail/spamassassin/local.cf
/etc/mail/spamassassin/local.cf
# These values can be overridden by editing
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
9/22
~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)
# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.
# Ab welchem Punktestand soll eine eMail als Spam betrachtet werden?
required_hits 5
# Diese Option legt fest, wie SpamAssassin eine als Spam eingestufte EMail markieren soll.
# Wenn report_safe 0 angegeben ist, fügt Spamassassin lediglich einige
X-Spam-Header ein
# und lässt die E-Mail ansonsten unverändert.
report_safe
# Mit dieser Option wird definiert, daß eine Nachricht, welche als SPAM
klassifiziert wurde,
# zusätzlich mit dem Hinweis "**** SPAM ****" in der Betreffzeile
gekennzeichnet werden sollen.
rewrite_header Subject [SPAM]
# Django : 2012-05-21
# Diese Direktive bestimmt, welche Sperrmethode verwendet wird, um die
beiden Datenbanken (
# Bayes- und Autowhitelisting) vor gleichzeitigem Zugriffen zu
schützen. Wenn sichergestellt
# ist, daß auf die beiden Datenbanken nie über ein NFS zugegriffen
wird, kann auf Unix-Plattformen
# erheblich an Performance gewonnen werden, indem die Sperrmethode
flock verwendet wird.
lock_method flock
# Django : 2009-08-19
# Headercheck-Filterliste für die Absicherung des Postfix-Mailservers
Information aus einer
# vorhandenen Postfixdatei /etc/postfix/header_checks übernommen, da es
unter gewissen Umständen
# zu Backscatter-Problemen kommen könnte (Stand. 10-07-2009 AMaViS
Version
# amavisd-new-2.5.4-1.el5.rf.src.rpm Version 0.02 / 2009-08-19
#
# /i = i Case-Insensitivity (die Nichtbeachtung von Groß- und
Kleinschreibung) einschalten
# /m = m Multiline-Faehigkeit - Zeilenumbrueche ignorieren
#
# Header-Checks "From" (Nummerierung 1000 ...)
#
header
HEADER_FROM_CHECKS_NR_1001
From =~ /^.*Euro Dice
Casino/im
score
20
Last update: 19.11.2014 19:08.
tflags
noautolearn
# Header-Checks "From" (Nummerierung 1000 ...)
header
drei.de/im
score
tflags
HEADER_FROM_CHECKS_NR1002
From =~ /^.*ic-
20
noautolearn
header
score
tflags
From =~ /^.*Lottery/im
20
noautolearn
amavisd
Da wir weder SPAM, noch Viren noch unerwünschte Dateianhänge annehmen, noch speichern (wir
haben die eMail ja gar nicht angenommen und mit einem 250er bestätigt und dem Endnutzer
zustellen können, tragen wir in der Konfigurstionsdatei unseres AMaViS-Servers folgende Zeilen ein.
# vim /etc/amavisd.conf
...
# Django : 2012-05-21
# default: $sa_tag2_level_deflt
$sa_tag2_level_deflt = 6.31; #
# Django : 2012-05-21
# default: $sa_kill_level_deflt
$sa_kill_level_deflt = 6.31; #
mail)
= 6.2;
add 'spam detected' headers at that level
= 6.9;
triggers spam evasive actions (e.g. blocks
...
...
# Django : 2012-05-21
# default: unset
$final_virus_destiny
= D_REJECT;
# Django : 2012-05-21
# default: unset
$final_banned_destiny
= D_REJECT;
# Django : 2012-05-21
# default: unset
$final_spam_destiny
= D_REJECT;
# $final_bad_header_destiny = D_PASS;
# $bad_header_quarantine_method = undef;
# Django : 2012-05-21
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
11/22
# default: unset
$virus_quarantine_to = undef;
# Django : 2012-05-21
# default: unset
$banned_quarantine_to = undef;
# Django : 2012-05-21
# default: unset
$spam_quarantine_to = undef;
...
Zum Aktivieren der Änderungen starten wir den Daemon einmal durch.
# service amavisd restart
Shutting down Mail Virus Scanner (amavisd):
Starting Mail Virus Scanner (amavisd):
[
[
OK
OK
]
]
[
OK
]
Programmstart
erster Systemstart
Nun können wir unseren Anti-SMAP-Daemon das erste mal starten.
# service spamassassin start
Starting spamd:
Im Maillog wird der Start des Daemon entsprechend protokolliert.
# less /var/log/maillog
Jun 10 22:44:30 vml000060 spamd[14620]: logger: removing stderr method
Jun 10 22:44:34 vml000060 spamd[14625]: rules: meta test FROM_41_FREEMAIL
has dependency 'NSL_RCVD_FROM_41' with a zero score
Jun 10 22:44:34 vml000060 spamd[14625]: spamd: server started on port
783/tcp (running version 3.3.1)
Jun 10 22:44:34 vml000060 spamd[14625]: spamd: server pid: 14625
Jun 10 22:44:34 vml000060 spamd[14625]: spamd: server successfully spawned
child process, pid 14636
Jun 10 22:44:34 vml000060 spamd[14625]: spamd: server successfully spawned
child process, pid 14638
Jun 10 22:44:34 vml000060 spamd[14625]: prefork: child states: IS
Jun 10 22:44:34 vml000060 spamd[14625]: prefork: child states: II
Mit folgendem Befehl kann überprüft werden, auf welchem Port unser SpamAssassin horcht:
Last update: 19.11.2014 19:08.
# lsof -i :783
COMMAND
PID USER
spamd
14625 root
spamd
14636 root
spamd
14638 root
FD
5u
5u
5u
TYPE DEVICE SIZE/OFF NODE NAME
IPv4 59884
0t0 TCP localhost:783 (LISTEN)
IPv4 59884
IPv4 59884
Eine ähnliche Abfrage kann man natürlich auch mit Hilfe von netstat -tulpen erreichen.
# netstat -tulpen | grep spam
tcp
LISTEN
0
0
0 127.0.0.1:783
0.0.0.0:*
59884
14625/spamd.pid
automatisches Starten des Dienste beim Systemstart
Damit nun unser AMaViS-Server beim Booten automatisch gestartet wird, nehmen wir noch folgende
Konfigurationsschritte vor.
# chkconfig spamassassin on
Anschließend überprüfen wir noch unsere Änderung:
# chkconfig --list | grep spamassassin
spamassassin
0:off
1:off
2:on
3:on
4:on
5:on
6:off
Tests
HAM
Als erstes schicken wir eine Testnachricht via telnet an einen User.
$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mx1.nausch.org ESMTP Postfix
helo vml00080.dmz.nausch.org
250 mx1.nausch.org
mail from:<bigchief@omni128.de>
250 2.1.0 Ok
rcpt to:<django@nausch.org>
250 2.1.5 Ok
DATA
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
13/22
354 End data with <CR><LF>.<CR><LF>
From: <bigchief@omni128.de>
To: <django@nausch.org>
Date: 2012-06-11 13:45
Subject: Testnachricht
Test
.
250 2.0.0 from MTA([mail.dmz.nausch.org]:10025): 250 2.0.0 Ok: queued as
4709153
quit
221 2.0.0 Bye
Connection closed by foreign host.
Im Maillog des Postfix-servers wir die erfolgreiche Annahme der Nachricht entsprechend quittiert.
Jun 11 14:09:22 vml000080 postfix/smtpd[26920]: connect from
localhost[127.0.0.1]
Jun 11 14:09:37 vml000080 postfix/smtpd[26920]: NOQUEUE:
client=localhost[127.0.0.1]
Jun 11 14:09:52 vml000080 postfix/smtpd[26908]: connect from
vml000060.dmz.nausch.org[10.0.0.60]
Jun 11 14:09:52 vml000080 postfix/smtpd[26908]: 4709153:
client=localhost[127.0.0.1]
Jun 11 14:09:52 vml000080 postfix/cleanup[26923]: 4709153: messageid=<20120611120952.4709153@mx1.nausch.org>
Jun 11 14:09:52 vml000080 postfix/qmgr[24754]: 4709153:
from=<bigchief@omni128.de>, size=777, nrcpt=1 (queue active)
Jun 11 14:09:52 vml000080 postfix/smtpd[26908]: disconnect from
vml000060.dmz.nausch.org[10.0.0.60]
Im Maillog auf unserem AMaVis-Host sind die Ausgaben im Moment, dank des loglevel = 3, doch
recht aussagekräftig.
Jun 11 14:09:37 vml000060 amavis[18855]: (18855-01) process_request: fileno
sock=11, STDIN=0, STDOUT=1
Jun 11 14:09:37 vml000060 amavis[18855]: (18855-02) loaded policy bank
"MYNETS"
Jun 11 14:09:39 vml000060 amavis[18855]: (18855-02) ESMTP:[10.0.0.60]:10024
/var/amavis/tmp/amavis-20120611T135937-18855: <bigchief@omni128.de> ->
<django@nausch.org> Received: from mx1.nausch.org ([10.0.0.80]) by localhost
(amavis.dmz.nausch.org [10.0.0.60]) (amavisd-new, port 10024) with ESMTP for
<django@nausch.org>; Mon, 11 Jun 2012 14:09:37 +0200 (CEST)
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) smtp connection cache,
dt: 578.4, state: 1
dt: 578.4 -> disabling
Last update: 19.11.2014 19:08.
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) body hash:
2205e48de5f93c784733ffcca841d2b5
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) Checking: 8GFFkUKKobVo
MYNETS [127.0.0.1] <bigchief@omni128.de> -> <django@nausch.org>
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) 2822.From:
<bigchief@omni128.de>
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) Cached virus check
expired, TTL = 180 s
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) cached
2205e48de5f93c784733ffcca841d2b5 from <bigchief@omni128.de> (0,0)
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) p001 1 Content-Type:
text/plain, size: 5 B, name:
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) inspect_dsn: not a
bounce
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) Checking for banned
types and filenames
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) collect banned table[0]:
django@nausch.org, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x20db1a0)
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) p.path
django@nausch.org: "P=p001,L=1,M=text/plain,T=asc"
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) presenting full original
message to scanners as
/var/amavis/tmp/amavis-20120611T135937-18855/parts/p002
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) ask_av Using (ClamAVclamd): CONTSCAN /var/amavis/tmp/amavis-20120611T135937-18855/parts\n
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) ClamAV-clamd: Connecting
to socket /var/run/clamav/clamd.sock
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) ClamAV-clamd: Sending
CONTSCAN /var/amavis/tmp/amavis-20120611T135937-18855/parts\n to UNIX socket
/var/run/clamav/clamd.sock
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) run_av (ClamAV-clamd):
CLEAN
Jun 11 14:09:51 vml000060 amavis[18855]: (18855-02) run_av (ClamAV-clamd)
result: clean
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) spam_scan: score=-0.427
autolearn=no
tests=[ALL_TRUSTED=-1,INVALID_DATE=0.432,MISSING_MID=0.14,TVD_SPACE_RATIO=0.
001]
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) do_notify_and_quar:
ccat=Clean (1,0) ("1":Clean, "0":CatchAll) ccat_block=(), qar_mth=
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp session reuse, 1
transactions so far
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> NOOP
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to NOOP (idle
593.5 s): 421 4.4.2 mx1.nausch.org Error: timeout exceeded
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02)
Amavis::Out::SMTP::Session close, disconnecting
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp creating socket by
IO::Socket::INET6 to [mail.dmz.nausch.org]:10025
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to greeting:
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
15/22
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> EHLO localhost
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to EHLO: 250
mx1.nausch.org\nPIPELINING\nSIZE 52428800\nETRN\nSTARTTLS\nXFORWARD NAME
ADDR PROTO HELO SOURCE PORT\nENHANCEDSTATUSCODES\n8BITMIME\nDSN
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> XFORWARD
ADDR=127.0.0.1 NAME=localhost PORT=42232 PROTO=SMTP
HELO=vml00080.dmz.nausch.org SOURCE=LOCAL
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to XFORWARD:
250 2.0.0 Ok
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) AUTH not needed,
user='', MTA offers ''
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> MAIL
FROM:<bigchief@omni128.de> BODY=7BIT
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> RCPT
TO:<django@nausch.org>
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> DATA
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to MAIL (pip):
250 2.1.0 Ok
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to RCPT (pip)
(<django@nausch.org>): 250 2.1.5 Ok
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to DATA: 354
End data with <CR><LF>.<CR><LF>
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp cmd> QUIT
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) smtp resp to data-dot
(<django@nausch.org>): 250 2.0.0 Ok: queued as 4709153
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02)
Amavis::Out::SMTP::Session close, disconnecting
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) FWD via SMTP:
<bigchief@omni128.de> -> <django@nausch.org>,BODY=7BIT 250 2.0.0 from
MTA([mail.dmz.nausch.org]:10025): 250 2.0.0 Ok: queued as 4709153
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) DSN: sender is credible
(orig), SA: -0.427, <bigchief@omni128.de>
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) Passed CLEAN, MYNETS
LOCAL [127.0.0.1] [127.0.0.1] <bigchief@omni128.de> -> <django@nausch.org>,
mail_id: 8GFFkUKKobVo, Hits: -0.427, size: 280, queued_as: 4709153, 15120 ms
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) TIMING-SA total 435 ms parse: 2 (0.6%), extract_message_metadata: 308 (70.9%), poll_dns_idle: 291
(67.0%), get_uri_detail_list: 0.43 (0.1%), tests_pri_-1000: 7 (1.7%),
tests_pri_-950: 2 (0.5%), tests_pri_-900: 1.75 (0.4%), tests_pri_-400: 1.23
(0.3%), tests_pri_0: 89 (20.6%), check_dkim_adsp: 13 (3.0%), check_spf: 0.48
(0.1%), check_pyzor: 0.42 (0.1%), tests_pri_500: 5 (1.1%), get_report: 1.09
(0.3%)
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) sending SMTP response:
"250 2.0.0 from MTA([mail.dmz.nausch.org]:10025): 250 2.0.0 Ok: queued as
4709153"
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) TIMING [total 15125 ms]
- SMTP greeting: 4 (0%)0, SMTP EHLO: 1 (0%)0, SMTP pre-MAIL: 1 (0%)0, SMTP
pre-DATA-flush: 2718 (18%)18, SMTP DATA: 11840 (78%)96, check_init: 1
(0%)96, digest_hdr: 1 (0%)96, digest_body_dkim: 1 (0%)96, gen_mail_id: 1
(0%)96, mime_decode: 10 (0%)96, get-file-type1: 15 (0%)96, decompose_part: 1
(0%)96, parts_decode: 0 (0%)96, check_header: 2 (0%)96, AV-scan-1: 8 (0%)97,
Last update: 19.11.2014 19:08.
spam-wb-list: 2 (0%)97, SA parse: 5 (0%)97, SA check: 429 (3%)99,
update_cache: 6 (0%)99, decide_mail_destiny: 1 (0%)99, fwd-connect: 12
(0%)100, fwd-xforward: 1 (0%)100, fwd-mail-pip: 12 (0%)100, fwd-rcpt-pip: 0
(0%)100, fwd-data-chkpnt: 0 (0%)100, write-header: 1 (0%)100, fwd-datacontents: 0 (0%)100, fwd-end-chkpnt: 39 (0%)100, prepare-dsn: 1 (0%)100,
main_log_entry: 8 (0%)100, update_snmp: 2 (0%)100, SMTP pre-response: 0
(0%)100, SMTP response: 1 (0%)100, unlink-2-files: 0 (0%)100, rundown: 1
(0%)100
Jun 11 14:09:52 vml000060 amavis[18855]: (18855-02) load: 5 %, total idle
583.913 s, busy 30.553 s
SPAM (Blacklist)
Als nächstes schicken wir nun eine Testmessage an einen unserer User, die in der Betreffzeile einen
verbotenen Ausdruck beinhaltet, z.B. gevoegelt:
$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
250 mx1.nausch.org
250 2.1.0 Ok
250 2.1.5 Ok
DATA
From: <bigchief@omni128.de>
To: <django@nausch.org>
Date: 2012-06-11 13:45
Subject: Hast Du Sie heute schon gevoegelt?
Spamnachricht mit verbotenem Ausdruck im Betreff.
.
554 5.7.0 Reject, id=19055-01 - SPAM
quit
221 2.0.0 Bye
Die Testmessage wird natürlich nicht angenommen und direkt und nur einmal rejected.
554 5.7.0 Reject, id=19055-01 - SPAM
Im Maillog unseres AMaViS-Frontendsystems können wir dann den genauen Ablehnungsgrund, an
Hand des übermitteltet AMaViS-Codes 19055-01 ermitteln. (Voraussetzung ist hierzu das der
Loglevel in der /etc/amavisd.conf mindestens auf dem Wert 2 steht!):
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
17/22
Jun 11 14:27:36 vml000060 amavis[19055]: process_request: fileno sock=11,
STDIN=0, STDOUT=1
"MYNETS"
a49713537d48347c846b5432811446b3
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) Checking: B0eSk4whQh6x
<bigchief@omni128.de>
bounce
types and filenames
django@nausch.org, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x3be71a0)
CLEAN
result: clean
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) spam_scan: score=19.572
autolearn=no
tests=[ALL_TRUSTED=-1,HEADER_SUBJECT_CHECKS_NR2041=20,INVALID_DATE=0.432,MIS
SING_MID=0.14]
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) blocking contents
category is (6) for django@nausch.org
ccat=Spam (6,0) ("6":Spam, "5":Spammy, "1,1":CleanTag, "1":Clean,
"0":CatchAll) ccat_block=(6), qar_mth=
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) SPAM,
<bigchief@omni128.de> -> <django@nausch.org>, Yes, score=19.572 tag=2
tag2=6.31 kill=6.31 tests=[ALL_TRUSTED=-1, HEADER_SUBJECT_CHECKS_NR2041=20,
Last update: 19.11.2014 19:08.
INVALID_DATE=0.432, MISSING_MID=0.14] autolearn=no
(orig), SA: 19.572, <bigchief@omni128.de>
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) Blocked SPAM, MYNETS
mail_id: B0eSk4whQh6x, Hits: 19.572, size: 346, 16258 ms
Jun 11 14:27:52 vml000060 amavis[19055]: (19055-01) TIMING-SA total 143 ms parse: 3 (1.8%), extract_message_metadata: 5 (3.5%), get_uri_detail_list:
0.50 (0.3%), tests_pri_-1000: 10 (7.0%), tests_pri_-950: 3 (1.9%),
tests_pri_-900: 1.92 (1.3%), tests_pri_-400: 1.30 (0.9%), tests_pri_0: 94
(66.1%), check_dkim_adsp: 15 (10.4%), check_spf: 0.48 (0.3%), check_pyzor:
0.34 (0.2%), tests_pri_500: 4 (2.8%), get_report: 1.44 (1.0%)
"554 5.7.0 Reject, id=19055-01 - SPAM"
- SMTP greeting: 12 (0%)0, SMTP EHLO: 1 (0%)0, SMTP pre-MAIL: 1 (0%)0, mkdir
tempdir: 1 (0%)0, create email.txt: 1 (0%)0, SMTP pre-DATA-flush: 2361
(15%)15, SMTP DATA: 13667 (84%)99, check_init: 1 (0%)99, digest_hdr: 2
(0%)99, digest_body_dkim: 1 (0%)99, gen_mail_id: 2 (0%)99, mkdir parts: 2
(0%)99, mime_decode: 11 (0%)99, get-file-type1: 16 (0%)99, decompose_part: 2
(0%)99, parts_decode: 0 (0%)99, check_header: 2 (0%)99, AV-scan-1: 9 (0%)99,
spam-wb-list: 2 (0%)99, SA parse: 7 (0%)99, SA check: 136 (1%)100,
update_cache: 7 (0%)100, decide_mail_destiny: 3 (0%)100, prepare-dsn: 4
(0%)100, main_log_entry: 8 (0%)100, update_snmp: 2 (0%)100, SMTP preresponse: 0 (0%)100, SMTP response: 1 (0%)100, unlink-2-files: 0 (0%)100,
rundown: 1 (0%)100
2.356 s, busy 13.912 s
Die Regel HEADER_SUBJECT_CHECKS_NR2041=20 hat also zugeschlagen - so könnten wir bei
einem etwaigen FalsePositiv die Ursache einer Ablehnung ergründen.
# grep HEADER_SUBJECT_CHECKS_NR2041 /etc/mail/spamassassin/local.cf
header
HEADER_SUBJECT_CHECKS_NR2041
/.*gevoegelt.*/im
score
tflags
Subject =~
20
noautolearn
SPAM (GTUBE)
Im Dokumentationspfad ( /usr/share/doc/spamassassin-3.3.1 ) unserer SpamAssassinInstallation finden wird unter anderem das GTUBE Testfile.
Generic
Test for
Unsolicited
Bulk
Email
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
19/22
# less /usr/share/doc/spamassassin-3.3.1/sample-spam.txt
/usr/share/doc/spamassassin-3.3.1/sample-spam.txt
Subject: Test spam mail (GTUBE)
Message-ID: <GTUBE1.1010101@example.net>
Date: Wed, 23 Jul 2003 23:30:00 +0200
From: Sender <sender@example.net>
To: Recipient <recipient@example.net>
Precedence: junk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
This is the GTUBE, the
Generic
Test for
Unsolicited
Bulk
Email
If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting
incoming
spam. You can send yourself a test mail containing the following string
of
characters (in upper case and with no white spaces and line breaks):
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
You should send this test mail from an account outside of your network.
Wir verbinden uns nun auf Port 25 auf unserem Postfix-server und laden dort den Inhalt dieser Datei
als eMail ab.
$ telnet mail.dmz.nausch.org 25
Trying 10.0.0.80...
Connected to mail.dmz.nausch.org.
250 mx1.nausch.org
250 2.1.0 Ok
250 2.1.5 Ok
DATA
Last update: 19.11.2014 19:08.
Subject: Test spam mail (GTUBE)
Message-ID: <GTUBE1.1010101@example.net>
Date: Wed, 23 Jul 2003 23:30:00 +0200
From: Sender <sender@example.net>
To: Recipient <recipient@example.net>
Precedence: junk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
This is the GTUBE, the
Generic
Test for
Unsolicited
Bulk
Email
If your spam filter supports it, the GTUBE provides a test by which you
can verify that the filter is installed correctly and is detecting incoming
spam. You can send yourself a test mail containing the following string of
characters (in upper case and with no white spaces and line breaks):
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
You should send this test mail from an account outside of your network.
.
554 5.7.0 Reject, id=19056-02 - SPAM
quit
221 2.0.0 Bye
Im Maillog unseres AMaViS-Servers finden wir nun wiederum einen Hinweis. warum die Nachricht mit
dem Fehlercode 554 5.7.0 Reject, id=19056-02 - SPAM abgewiesen wurde.
Jun 11 14:55:45 vml000060 amavis[19056]: (19056-01) process_request: fileno
sock=11, STDIN=0, STDOUT=1
"MYNETS"
dt: 201.8, state: 1
dt: 201.8 -> disabling
a2740fd1baff60a1aa0bfb88a79036d6
Printed on 22.12.2016 13:32.
22.12.2016 13:32.
21/22
Jun 11 14:56:11 vml000060 amavis[19056]: (19056-02) Checking: juTHROjwPrnV
<sender@example.net>, 2821.Mail_From: <bigchief@omni128.de>
bounce
types and filenames
django@nausch.org, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x3be71a0)
CLEAN
result: clean
Jun 11 14:56:11 vml000060 amavis[19056]: (19056-02) wbl: soft-blacklisted
(3) sender <sender@example.net> => <django@nausch.org>, recip_key="."
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) spam_scan: score=1001.07
autolearn=no tests=[ALL_TRUSTED=-1,DATE_IN_PAST_96_XX=2.07,GTUBE=1000]
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) blocking contents
category is (6) for django@nausch.org
ccat=Spam (6,0) ("6":Spam, "5":Spammy, "1,1":CleanTag, "1":Clean,
"0":CatchAll) ccat_block=(6), qar_mth=
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) SPAM,
<bigchief@omni128.de> -> <django@nausch.org>, Yes, score=1001.07+3 tag=2
tag2=6.31 kill=6.31 tests=[AM:BOOST=3, ALL_TRUSTED=-1,
DATE_IN_PAST_96_XX=2.07, GTUBE=1000] autolearn=no
(orig), SA: 1001.070, <bigchief@omni128.de>
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) Blocked SPAM, MYNETS
Message-ID: <GTUBE1.1010101@example.net>, mail_id: juTHROjwPrnV, Hits:
1004.07, size: 993, 26905 ms
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) TIMING-SA total 492 ms parse: 3 (0.6%), extract_message_metadata: 5 (1.1%), get_uri_detail_list:
0.94 (0.2%), tests_pri_-1000: 8 (1.7%), tests_pri_-950: 3 (0.5%),
tests_pri_-900: 1.75 (0.4%), tests_pri_-400: 1.35 (0.3%), tests_pri_0: 316
Last update: 19.11.2014 19:08.
(64.2%), check_dkim_adsp: 204 (41.4%), check_spf: 0.56 (0.1%), check_pyzor:
0.44 (0.1%), tests_pri_500: 134 (27.2%), poll_dns_idle: 128 (26.0%),
get_report: 1.88 (0.4%)
"554 5.7.0 Reject, id=19056-02 - SPAM"
- SMTP greeting: 4 (0%)0, SMTP EHLO: 1 (0%)0, SMTP pre-MAIL: 1 (0%)0, SMTP
pre-DATA-flush: 2179 (8%)8, SMTP DATA: 24165 (90%)98, check_init: 1 (0%)98,
digest_hdr: 2 (0%)98, digest_body_dkim: 1 (0%)98, gen_mail_id: 1 (0%)98,
mime_decode: 10 (0%)98, get-file-type1: 16 (0%)98, decompose_part: 2 (0%)98,
parts_decode: 0 (0%)98, check_header: 2 (0%)98, AV-scan-1: 9 (0%)98, spamwb-list: 3 (0%)98, SA parse: 5 (0%)98, SA check: 485 (2%)100, update_cache:
7 (0%)100, decide_mail_destiny: 3 (0%)100, prepare-dsn: 3 (0%)100,
main_log_entry: 7 (0%)100, update_snmp: 2 (0%)100, SMTP pre-response: 0
(0%)100, SMTP response: 1 (0%)100, unlink-2-files: 0 (0%)100, rundown: 1
(0%)100
204.011 s, busy 25.318 s
In der Zeile:
Jun 11 14:56:12 vml000060 amavis[19056]: (19056-02) spam_scan:
score=1001.07 autolearn=no
tests=[ALL_TRUSTED=-1,DATE_IN_PAST_96_XX=2.07,GTUBE=1000]
wird der eMail ein SPAM-Score von 1001,07 bescheinigt, der - nun sagen wir mal geringfügig - über
den 6.31, die wir in der /etc/amavisd.conf definiert hatten. Die Annahme der eMail wird also mit
einem 500er-Fehlercode verweigert.
Links
Zurück zum Kapitel >>Mailserverinstallation unter CentOS 6<<
Zurück zu >>Projekte und Themenkapitel<<
Zurück zur Startseite
1)
erwünschten Nachrichten
unerwünschten Nachrichten
3)
Real Blackhole Lists
2)
From:
https://dokuwiki.nausch.org/ - Linux - Wissensdatenbank
Permanent link:
https://dokuwiki.nausch.org/doku.php/centos:mail_c6:spam_5
Last update: 19.11.2014 19:08.
Printed on 22.12.2016 13:32.

Installation und Konfiguration von Spamassassin

Transcription

Similar documents

Virenschutz mit Hilfe von AMaViS und SpamAssassin

erweiterter SPAM-Schutz mit Hilfe von SpamAssassin

Installation und Konfiguration von ClamAV