erweiterter SPAM-Schutz mit Hilfe von SpamAssassin

Transcription

16.01.2017 03:14.
1/19
erweiterter SPAM-Schutz mit Hilfe von
SpamAssassin
Zur weiteren Absicherung unseres Mailservers bzw. -verkehrs bedienen wir uns des Dienstes
spamassassin.
Installation
Wie üblich installieren wir die benötiten Programmpakete via YUM.
yum install spamassassin
Programminfo
Info
Auch bei diesem Paket spamassassin informieren wir uns erst einmal an Hand der RPM-Info:
# yum info spamassassin
Name
: spamassassin
...
Summary: Spam-Filter für E-Mails, der durch Mail-Agenten aufgerufen werden
kann.
Description:
SpamAssassin provides you with a way to reduce if not completely eliminate
Unsolicited Commercial Email (SPAM) from your incoming email. It can
be invoked by a MDA such as sendmail or postfix, or can be called from
a procmail script, .forward file, etc. It uses a genetic-algorithm
evolved scoring system to identify messages which look spammy, then
adds headers to the message so they can be filtered by the user's mail
reading software. This distribution includes the spamd/spamc components
which create a server that considerably speeds processing of mail.
To enable spamassassin, if you are receiving mail locally, simply add
this line to your ~/.procmailrc:
INCLUDERC=/etc/mail/spamassassin/spamassassin-default.rc
To filter spam for all users, add that line to /etc/procmailrc
(creating if necessary).
Linux - Wissensdatenbank - https://dokuwiki.nausch.org/
Last
update:
centos:mailserver:installation_von_spamassassin https://dokuwiki.nausch.org/doku.php/centos:mailserver:installation_von_spamassassin
04.08.2011
08:00.
Programmpfade und -inhalte
Über die einzelnen Dateien und Pfade der installierten Programme, informieren wir uns auch hier
mittels:
rpm -ql spamassassin
/etc/cron.d/sa-update
/etc/logrotate.d/sa-update
/etc/mail/spamassassin
/etc/mail/spamassassin/init.pre
/etc/mail/spamassassin/local.cf
/etc/mail/spamassassin/spamassassin-default.rc
/etc/mail/spamassassin/spamassassin-helper.sh
/etc/mail/spamassassin/spamassassin-spamc.rc
/etc/mail/spamassassin/v310.pre
/etc/rc.d/init.d/spamassassin
/etc/sysconfig/spamassassin
/usr/bin/sa-compile
/usr/bin/sa-learn
/usr/bin/sa-update
/usr/bin/spamassassin
/usr/bin/spamc
/usr/bin/spamd
/usr/lib/perl5/vendor_perl/5.8.8/Mail
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/AICache.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/ArchiveIterator.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/AsyncLoop.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/AutoWhitelist.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Bayes
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Bayes.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Bayes/CombineChi.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Bayes/CombineNaiveBayes.p
m
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/DBM.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/MySQL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/PgSQL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/SDBM.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/BayesStore/SQL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Client.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Conf
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Conf.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Conf/LDAP.pm
https://dokuwiki.nausch.org/
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
3/19
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Conf/Parser.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Conf/SQL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Constants.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/DBBasedAddrList.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Dns.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/DnsResolver.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/HTML.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locales.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locker
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locker.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locker/Flock.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locker/UnixNFSSafe.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Locker/Win32.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Logger
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Logger.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Logger/File.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Logger/Stderr.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Logger/Syslog.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/MailingList.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message/Metadata
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message/Metadata.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message/Metadata/Received
.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Message/Node.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/NetSet.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgLearner.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PerMsgStatus.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PersistentAddrList.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/ASN.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/AWL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/AccessDB.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/AntiVirus.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/AutoLearnThreshold
.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Bayes.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/BodyEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/BodyRuleBaseExtrac
tor.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Check.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/DCC.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/DKIM.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/DNSEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/DomainKeys.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/HTMLEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/HTTPSMismatch.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Hashcash.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/HeaderEval.pm
Last
update:
04.08.2011
08:00.
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/ImageInfo.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/MIMEEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/MIMEHeader.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/OneLineBodyRuleTyp
e.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Pyzor.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Razor2.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/RelayCountry.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/RelayEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/ReplaceTags.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Rule2XSBody.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/SPF.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Shortcircuit.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/SpamCop.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/Test.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/TextCat.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/URIDNSBL.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/URIDetail.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/URIEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/VBounce.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/WLBLEval.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Plugin/WhiteListSubject.p
m
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/PluginHandler.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Reporter.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/SQLBasedAddrList.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/SpamdForkScaling.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/SubProcBackChannel.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Timeout.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util/DependencyInfo.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util/Progress.pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util/RegistrarBoundaries.
pm
/usr/lib/perl5/vendor_perl/5.8.8/Mail/SpamAssassin/Util/TieOneStringHash.pm
/usr/lib/perl5/vendor_perl/5.8.8/spamassassin-run.pod
/usr/share/doc/spamassassin-3.2.4
/usr/share/doc/spamassassin-3.2.4/CREDITS
/usr/share/doc/spamassassin-3.2.4/Changes
/usr/share/doc/spamassassin-3.2.4/LICENSE
/usr/share/doc/spamassassin-3.2.4/NOTICE
/usr/share/doc/spamassassin-3.2.4/README
/usr/share/doc/spamassassin-3.2.4/TRADEMARK
/usr/share/doc/spamassassin-3.2.4/UPGRADE
/usr/share/doc/spamassassin-3.2.4/USAGE
/usr/share/doc/spamassassin-3.2.4/sample-nonspam.txt
/usr/share/doc/spamassassin-3.2.4/sample-spam.txt
/usr/share/man/man1/sa-compile.1.gz
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
5/19
/usr/share/man/man1/sa-learn.1.gz
/usr/share/man/man1/sa-update.1.gz
/usr/share/man/man1/spamassassin-run.1.gz
/usr/share/man/man1/spamassassin.1.gz
/usr/share/man/man1/spamc.1.gz
/usr/share/man/man1/spamd.1.gz
/usr/share/man/man3/Mail::SpamAssassin.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AICache.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::ArchiveIterator.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AsyncLoop.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::AutoWhitelist.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Bayes.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::MySQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::PgSQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::BayesStore::SQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Client.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::LDAP.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::Parser.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Conf::SQL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::DnsResolver.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::File.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::Stderr.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Logger::Syslog.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message::Metadata.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Message::Node.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PerMsgLearner.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PersistentAddrList.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::ASN.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AWL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AccessDB.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AntiVirus.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::AutoLearnThreshold.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::BodyRuleBaseExtractor.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Check.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DCC.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DKIM.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::DomainKeys.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Hashcash.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::MIMEHeader.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::OneLineBodyRuleType.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Pyzor.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Razor2.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::RelayCountry.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::ReplaceTags.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Rule2XSBody.3pm.gz
Last
update:
04.08.2011
08:00.
/usr/share/man/man3/Mail::SpamAssassin::Plugin::SPF.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Shortcircuit.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::SpamCop.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::Test.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::TextCat.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::URIDNSBL.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::URIDetail.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::VBounce.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Plugin::WhiteListSubject.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::PluginHandler.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::SQLBasedAddrList.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::SubProcBackChannel.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Timeout.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util.3pm.gz
/usr/share/man/man3/Mail::SpamAssassin::Util::Progress.3pm.gz
/usr/share/man/man3/spamassassin-run.3pm.gz
/usr/share/spamassassin
/usr/share/spamassassin/10_default_prefs.cf
/usr/share/spamassassin/20_advance_fee.cf
/usr/share/spamassassin/20_body_tests.cf
/usr/share/spamassassin/20_compensate.cf
/usr/share/spamassassin/20_dnsbl_tests.cf
/usr/share/spamassassin/20_drugs.cf
/usr/share/spamassassin/20_dynrdns.cf
/usr/share/spamassassin/20_fake_helo_tests.cf
/usr/share/spamassassin/20_head_tests.cf
/usr/share/spamassassin/20_html_tests.cf
/usr/share/spamassassin/20_imageinfo.cf
/usr/share/spamassassin/20_meta_tests.cf
/usr/share/spamassassin/20_net_tests.cf
/usr/share/spamassassin/20_phrases.cf
/usr/share/spamassassin/20_porn.cf
/usr/share/spamassassin/20_ratware.cf
/usr/share/spamassassin/20_uri_tests.cf
/usr/share/spamassassin/20_vbounce.cf
/usr/share/spamassassin/23_bayes.cf
/usr/share/spamassassin/25_accessdb.cf
/usr/share/spamassassin/25_antivirus.cf
/usr/share/spamassassin/25_asn.cf
/usr/share/spamassassin/25_dcc.cf
/usr/share/spamassassin/25_dkim.cf
/usr/share/spamassassin/25_domainkeys.cf
/usr/share/spamassassin/25_hashcash.cf
/usr/share/spamassassin/25_pyzor.cf
/usr/share/spamassassin/25_razor2.cf
/usr/share/spamassassin/25_replace.cf
/usr/share/spamassassin/25_spf.cf
/usr/share/spamassassin/25_textcat.cf
/usr/share/spamassassin/25_uribl.cf
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
7/19
/usr/share/spamassassin/30_text_de.cf
/usr/share/spamassassin/30_text_fr.cf
/usr/share/spamassassin/30_text_it.cf
/usr/share/spamassassin/30_text_nl.cf
/usr/share/spamassassin/30_text_pl.cf
/usr/share/spamassassin/30_text_pt_br.cf
/usr/share/spamassassin/50_scores.cf
/usr/share/spamassassin/60_awl.cf
/usr/share/spamassassin/60_shortcircuit.cf
/usr/share/spamassassin/60_whitelist.cf
/usr/share/spamassassin/60_whitelist_dk.cf
/usr/share/spamassassin/60_whitelist_dkim.cf
/usr/share/spamassassin/60_whitelist_spf.cf
/usr/share/spamassassin/60_whitelist_subject.cf
/usr/share/spamassassin/72_active.cf
/usr/share/spamassassin/languages
/usr/share/spamassassin/sa-update-pubkey.txt
/usr/share/spamassassin/sa-update.cron
/usr/share/spamassassin/user_prefs.template
/var/lib/spamassassin
/var/run/spamassassin
Konfiguration
Unter gewissen Umständen, bei Verwendung von header- und body-cheks mit und AMaViS als
smtpd_proxy_filter kann es passieren, dass Postfix und AMaViS Bounced, also backscatter
erzeugen. Eine Diskussion auf der Postfix-Mailingliste beleuchtet die damaligen Hintergründe. Die
aktuelle amavisd-.new Version vom Juli 2009 wurde zwar dahingegen optimiert und geändert. Aber
für den laufenden Betrieb wollen wir die Headerchecks in Richtung AMaVis und Spamassassin
verlagern.
Postfix
Die Headerchecks auf seiten von Postfix deaktivieren wir, in dem wir die angelegte Datei
header_checks wegsichern und eine leere Datei anlegen.
# mv /etc/postfix/header_checks /etc/postfix/header_checks.old
# touch /etc/postfix/header_check
Anschließend führen wir einen Reload unseres Mailservers durch.
# service postfix reload
Spamassassin
Die Regeln für die Header-Checks tragen wir nun in die Datei /etc/mail/spamassassin/local.cf ein.
Last
update:
04.08.2011
08:00.
# vim /etc/mail/spamassassin/local.cf
local.cf
# These values can be overridden by editing
~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)
# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.
# Ab welchem Punktestand soll eine eMail als Spam betrachtet werden?
required_hits 5
# Diese Option legt fest, wie SpamAssassin eine als Spam eingestufte EMail markieren soll. Wenn report_safe 0 angegeben ist, fügt
# Spamassassin lediglich einige X-Spam-Header ein und lässt die E-Mail
ansonsten unverändert.
report_safe 0
# Mit dieser Option wird definiert, daß eine Nachricht, welche als SPAM
klassifiziert wurde, zusätzlich mit dem Hinweis "**** SPAM ****"
#in der Betreffzeile gekennzeichnet werden sollen.
rewrite_header Subject [SPAM]
# Django: 15.07.2010
# Diese Direktive bestimmt, welche Sperrmethode verwendet wird, um die
beiden Datenbanken (Bayes- und Autowhitelisting) vor gleichzeitigem
# Zugriffen zu schützen. Wenn sichergestellt ist, daß auf die beiden
Datenbanken nie über ein NFS zugegriffen wird, kann auf UnixPlattformen
# erheblich an Performance gewonnen werden, indem die Sperrmethode
flock verwendet wird.
lock_method flock
# Headercheck-Filterliste für die Absicherung des Postfix-Mailservers
Information aus der vorhandenen Postfixdatei /etc/postfix/header_checks
# übernommen, da es unter gewissen Umständen zu Backscatter-Problemen
kommen könnte (Stand. 10-07-2009 AMaViS Version
# amavisd-new-2.5.4-1.el5.rf.src.rpm Version 0.02 / 2009-08-19
# /i = i Case-Insensitivity (die Nichtbeachtung von Groß- und
Kleinschreibung) einschalten
# /m = m Multiline-Faehigkeit - Zeilenumbrueche ignorieren
# Header-Checks "From" (Nummerierung 1000 ...)
header
drei.de/im
score
HEADER_FROM_CHECKS_NR1008
From =~ /^.*ic-
20
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
9/19
tflags
noautolearn
header
score
tflags
From =~ /^.*Lottery/im
20
noautolearn
header
News/im
score
tflags
From =~ /^.*Apotheken-
20
noautolearn
header
/^.*Online.*Spiele/im
score
tflags
From =~
header
score
tflags
From =~ /^.*Kasino/im
20
noautolearn
header
score
tflags
From =~ /^.*Pharmacy/im
20
noautolearn
header
Casino/im
score
tflags
From =~ /^.*Royal Club
20
noautolearn
header
Casino/im
score
tflags
From =~ /^.*Euro Dice
20
noautolearn
header
/^.*happydigits.de/im
score
tflags
20
noautolearn
From =~
20
noautolearn
# Header-Checks "Subject" (Nummerierung 2000 ...)
header
HEADER_SUBJECT_CHECKS_NR2073
MAIL HAT GEWONNEN DIE.*/im
score
tflags
Subject =~ /.*IHRE E-
header
/.*Potenzschw.che.*/im
score
tflags
Subject =~
20
noautolearn
20
noautolearn
Last
update:
04.08.2011
08:00.
header
/.*Sicherheitsaktualisierung.*/im
score
tflags
Subject =~
header
/.*PARTNERSHIP.*/im
score
tflags
Subject =~
header
JOB OFFER.*/im
score
tflags
Subject =~ /.*TEMPORARY
20
noautolearn
header
ATTENTION.*/im
score
tflags
Subject =~ /.*URGENT
20
noautolearn
header
/.*Penis.*/im
score
tflags
Subject =~
20
noautolearn
20
noautolearn
20
noautolearn
header
/.*saxaelle.*/im
score
tflags
Subject =~
header
for men.*/im
score
tflags
Subject =~ /.*formula
20
noautolearn
header
happiness.*/im
score
tflags
Subject =~ /.*wife
20
noautolearn
header
sich.*/im
score
tflags
Subject =~ /.*rentiert
20
noautolearn
header
camera.*/im
score
tflags
Subject =~ /.*caught on
20
noautolearn
20
noautolearn
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
11/19
header
/.*Betriebsstaette sucht Beschaeftigte.*/im
score
tflags
Subject =~
header
her.*/im
score
tflags
Subject =~ /.*Stimulate
20
noautolearn
header
RESPECT.*/im
score
tflags
Subject =~ /.*WITH DUE
20
noautolearn
header
snake..*/im
score
tflags
Subject =~ /.*Bigger
20
noautolearn
header
her.*/im
score
tflags
Subject =~ /.*Bang
20
noautolearn
header
enhanced.*/im
score
tflags
Subject =~ /.*young and
20
noautolearn
20
noautolearn
header
ASSISTANCE.*/im
score
tflags
Subject =~ /.*YOUR
header
people.*/im
score
tflags
Subject =~ /.*Helping
20
noautolearn
20
noautolearn
header
/.*Enhancing.*/im
score
tflags
Subject =~
header
Pillchen.*/im
score
tflags
Subject =~ /.*Blaue
20
noautolearn
20
noautolearn
Last
update:
04.08.2011
08:00.
header
/.*Impotenz.*/im
score
tflags
Subject =~
header
/.*ge.fi.ckt.*/im
score
tflags
Subject =~
header
/.*Softshell.*/im
score
tflags
Subject =~
header
Ramona.*/im
score
tflags
Subject =~ /.*rollige
20
noautolearn
header
Gesch.ft.*/im
score
tflags
Subject =~ /.*Dringende
20
noautolearn
header
xy.*/im
score
tflags
Subject =~ /.*Se-
20
noautolearn
header
party.*/im
score
tflags
Subject =~ /.*private
20
noautolearn
header
Teeny.*/im
score
tflags
Subject =~ /.*williges
20
noautolearn
header
Offer.*/im
score
tflags
Subject =~ /.*Special
20
noautolearn
header
/.*LiveCams.*/im
score
tflags
20
noautolearn
20
noautolearn
20
noautolearn
Subject =~
20
noautolearn
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
13/19
header
/.*gevoegelt.*/im
score
tflags
Subject =~
header
/.*gefi.ckte.*/im
score
tflags
Subject =~
header
/.*medications.*/im
score
tflags
Subject =~
header
/.*Drecksstueck.*/im
score
tflags
Subject =~
header
/.*Miststueck.*/im
score
tflags
Subject =~
header
/.*verdorbene Hausfrau.*/im
score
tflags
Subject =~
header
/.*Ficken.*/im
score
tflags
Subject =~
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
header
/.*verdorbene Schlampe.*/im
score
tflags
Subject =~
header
/.*fi.ckbereit.*/im
score
tflags
Subject =~
header
feucht.*/im
score
tflags
Subject =~ /.*immer
20
noautolearn
20
noautolearn
20
noautolearn
Last
update:
04.08.2011
08:00.
header
chat.*/im
score
tflags
Subject =~ /.*lets
20
noautolearn
header
/.*bumbsbare.*/im
score
tflags
Subject =~
header
Weib.*/im
score
tflags
Subject =~ /.*geiles
20
noautolearn
header
/.*Dild_o.*/im
score
tflags
Subject =~
20
noautolearn
20
noautolearn
header
einmal pro Stunde.*/im
score
tflags
Subject =~ /.*kommen
header
pleasuring.*/im
score
tflags
Subject =~ /.*secret to
header
schlucken.*/im
score
tflags
Subject =~ /.*will
20
noautolearn
header
algeiles.*/im
score
tflags
Subject =~ /.*an-
20
noautolearn
20
noautolearn
20
noautolearn
header
/.*impotence.*/im
score
tflags
Subject =~
header
Freund.*/im
score
tflags
Subject =~ /.*deutscher
20
noautolearn
20
noautolearn
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
header
rno.*/im
score
tflags
15/19
Subject =~ /.*Po-
20
noautolearn
header
60 Minuten nicht kommen.*/im
score
tflags
Subject =~ /.*Entspannt
header
small and tiny again.*/im
score
tflags
Subject =~ /.*Never be
header
wieder Spass am Leben.*/im
score
tflags
Subject =~ /.*Haben Sie
header
ildo.*/im
score
tflags
Subject =~ /.*D
20
noautolearn
header
you.*/im
score
tflags
Subject =~ /.*chat with
20
noautolearn
header
kommen.*/im
score
tflags
Subject =~ /.*zu frueh
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
header
/.*aufgeschlossene Kontakte.*/im
score
tflags
Subject =~
header
/.*Viagra.*/im
score
tflags
Subject =~
20
noautolearn
header
kt.*/im
score
tflags
Subject =~ /.*gefic-
20
noautolearn
20
noautolearn
Last
update:
04.08.2011
08:00.
header
sucht aufgeschlossenen Mann.*/im
score
tflags
Subject =~ /.*Frau
header
Minuten kommen.*/im
score
tflags
Subject =~ /.*Nach 10
header
nur einmal.*/im
score
tflags
Subject =~ /.*Mann lebt
header
received an eCard.*/im
score
tflags
Subject =~ /.*You have
header
/.*D.i.l.d.o.*/im
score
tflags
Subject =~
header
/.*naturgeil.*/im
score
tflags
Subject =~
header
sie von jeder Frau vergoettert!.*/im
score
tflags
Subject =~ /.*So werden
header
/.*Advocacy.Notary Notice.*/im
score
tflags
Subject =~
header
Luder.*/im
score
tflags
Subject =~ /.*Webcam
20
noautolearn
header
/.*Potenzprobleme.*/im
score
tflags
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
20
noautolearn
Subject =~
20
noautolearn
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
17/19
header
fur Ihr bestes Stueck.*/im
score
tflags
Subject =~ /.*RedBull
header
Zuckerschnute.*/im
score
tflags
Subject =~ /.*geile
20
noautolearn
20
noautolearn
Eine aktuelle Version, der Header-Checks kann man sich bei Bedarf auch hier herunterladen.
Abschließend starten wir unseren AMaViS-Dämon einmal durch:
# service amavisd restart
Test
Nun schicken wir eine Testmessage an einen unserer User:
$ telnet mx1.nausch.org 25
Trying 88.217.187.21...
Connected to mx1.nausch.org (88.217.187.21).
Escape character is '^]'.
220 mx1.nausch.org ESMTP Postfix
HELO spamschleuder.com
250 mx1.nausch.org
MAIL FROM: <[email protected]>
250 2.1.0 Ok
RCPT TO: <[email protected]>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: <[email protected]>
To: <[email protected]>
Subject: Du kleines WEBCam Luder!
test
.
554 5.7.0 Reject, id=24409-03 - SPAM
quit
221 2.0.0 Bye
Connection closed by foreign host.
Die Testmessage wird natürlich nicht angenommen und direkt und nur einmal rejected.
554 5.7.0 Reject, id=24409-03 - SPAM
Last
update:
04.08.2011
08:00.
Im Maillog können wir dann den genauen Ablehnungsgrund, an Hand des übermitteltet AMaViS-Codes
24409-03 ermitteln. (Voraussetzung ist hierzu das der Loglevel in der /etc/amavisd.conf
mindestens auf dem Wert 2 steht!):
Jul 14 21:57:52 nss postfix/smtpd[27787]: connect from
office.nausch.org[192.168.10.20]
Jul 14 21:58:03 nss postfix/smtpd[27787]: NOQUEUE:
client=office.nausch.org[192.168.10.20]
Jul 14 21:58:06 nss amavis[24409]: (24409-03) ESMTP::10024
/var/amavis/tmp/amavis-20090714T215454-24409: <[email protected]> ->
<[email protected]> Received: from mx1.nausch.org ([127.0.0.1]) by
localhost (amavis.nausch.org [127.0.0.1]) (amavisd-new, port 10024) with
ESMTP for <[email protected]>; Tue, 14 Jul 2009 21:58:03 +0200 (CEST)
Jul 14 21:58:56 nss amavis[24409]: (24409-03) Checking: fT1PyS4yVPfT MYNETS
[192.168.10.20] <[email protected]> -> <[email protected]>
Jul 14 21:58:56 nss amavis[24409]: (24409-03) p001 1 Content-Type:
text/plain, size: 5 B, name:
Jul 14 21:58:56 nss amavis[24409]: (24409-03) check_header: 7, Missing
required header field: "Date"
Jul 14 21:58:56 nss amavis[24409]: (24409-03) SPAM, <[email protected]> ->
<[email protected]>, Yes, score=20.654 tag=2 tag2=6.31 kill=6.31
tests=[ALL_TRUSTED=-1.44, AWL
=2.092, HEADER_SUBJECT_CHECKS_NR2003=20, MISSING_DATE=0.001,
MISSING_MID=0.001] autolearn=no
Jul 14 21:58:56 nss amavis[24409]: (24409-03) Blocked SPAM, MYNETS LOCAL
[192.168.10.20] [192.168.10.20] <[email protected]> ->
<[email protected]>, mail_id: fT1PyS4yVPf
T, Hits: 20.654, size: 275, 52435 ms
Jul 14 21:58:56 nss amavis[24409]: (24409-03) TIMING [total 52442 ms] - SMTP
greeting: 2 (0%)0, SMTP EHLO: 1 (0%)0, SMTP pre-MAIL: 0 (0%)0, SMTP preDATA-flush: 3070 (6%)6,
SMTP DATA: 49167 (94%)100, check_init: 1 (0%)100, digest_hdr: 1 (0%)100,
digest_body_dkim: 0 (0%)100, gen_mail_id: 2 (0%)100, mime_decode: 11
(0%)100, get-file-type1: 23 (
0%)100, decompose_part: 1 (0%)100, parts_decode: 0 (0%)100, check_header: 3
(0%)100, AV-scan-1: 8 (0%)100, spam-wb-list: 3 (0%)100, SA parse: 4 (0%)100,
SA check: 97 (0%)10
0, update_cache: 14 (0%)100, decide_mail_destiny: 3 (0%)100, prepare-dsn: 5
(0%)100, main_log_entry: 19 (0%)100, update_snmp: 4 (0%)100, SMTP preresponse: 1 (0%)100, SMTP
response: 0 (0%)100, unlink-2-files: 0 (0%)100, rundown: 1 (0%)100
Jul 14 21:58:59 nss postfix/smtpd[27787]: disconnect from
office.nausch.org[192.168.10.20]
Die Regel HEADER_SUBJECT_CHECKS_NR2003 hat also zugeschlagen - so könnten wir bei einem
etwaigen FalsePositiv die Ursache einer Ablehnung ergründen.
Printed on 16.01.2017 03:14.
16.01.2017 03:14.
19/19
erster Programmstart
service spamassassin start
automatisches Starten der Dienste beim Systemstart
Damit nun unser spamassassion-daemon beim Booten automatisch gestartet wird, nehmen wir noch
folgende Konfigurationsschritte vor.
chkconfig spamassassin on
Anschließend überprüfen wir noch unsere Änderung:
chkconfig --list | grep spamassassin
spamassassin
0:Aus
1:Aus
2:Ein
3:Ein
4:Ein
5:Ein
From:
https://dokuwiki.nausch.org/ - Linux - Wissensdatenbank
Permanent link:
https://dokuwiki.nausch.org/doku.php/centos:mailserver:installation_von_spamassassin
Last update: 04.08.2011 08:00.
6:Aus

erweiterter SPAM-Schutz mit Hilfe von SpamAssassin

Transcription

Similar documents

Installation und Konfiguration von Spamassassin

Virenschutz mit Hilfe von AMaViS und SpamAssassin