Stats quotidiennes SpamAssassin

Stats quotidiennes SpamAssassin - Logiciels - Linux et OS Alternatifs

Marsh Posté le 30-10-2007 à 08:51:29    

Salut,
 
 
Utilisant SpamAssassin je souhaiterais générer un fichier de stats (% de hams, de spams, etc.) que je pourrais consulter chaque soir afin de suivre un peu l'évolution du filtrage.
Est-ce qu'il existe des applications permettant de générer ce genre de fichier ?
 
Merci d'avance.

Reply

Marsh Posté le 30-10-2007 à 08:51:29   

Reply

Marsh Posté le 30-10-2007 à 10:45:35    

si tu utilises amavisd  pour lancer spamassassin tu peux utiliser logwatch pour obtenir des stats completes..
 
si tu utilises que spamd pour SA, je ne sais pas si logwatch peut le faire, donc a tester.
 
tu peux aussi avoir des stats sur l'utilisation du filtre bayesien de SA, si tu l'utilises, avec la commande sa-learn


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 30-10-2007 à 11:06:45    

Ok, merci pour les infos.
J'utilise amavisd pour lancer spamassassin, je vais donc me tourner vers logwatch.

Reply

Marsh Posté le 30-10-2007 à 13:30:27    

une fois logwatch installé, je te conseille de modifier ses filtres pour amavisd, ce qui donnera une analyse encore plus pertinente:
 
regarde la procedure ici (paragraphe logwatch)
http://www.starbridge.org/spip/spi [...] sommaire_1


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 30-10-2007 à 13:59:43    

Merci pour le lien, c'est vrai que c'est bien plus détaillé  :D

Reply

Marsh Posté le 30-10-2007 à 17:06:28    

J'ai mis en place logwatch.
 
Le niveau de détail que j'ai paramétré est satisfaisant par contre il y a un truc qui me chiffonne : tous les mails qui ont transités à travers amavis sont marqués comme hams  :heink:  
Or, j'ai quelques dizaines de spams dans mes boîtes mails qui ont bien été marqués.
 
J'ai même envoyé un spam dans une boîte, qui s'est gentillement dirigé vers le répertoire spams, mais ce dernier n'apparaît pas lors de la génération du fichier par logwatch.

Reply

Marsh Posté le 30-10-2007 à 18:29:31    

fais voir le debut du rapport ?


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 08:15:35    

Voici le début du rapport :
 

Code :
  1. ################### Logwatch 7.3.1 (09/15/06) ####################
  2.         Processing Initiated: Wed Oct 31 07:46:16 2007
  3.         Date Range Processed: today
  4.                               ( 2007-Oct-31 )
  5.                               Period is day.
  6.       Detail Level of Output: 9
  7.               Type of Output: mail
  8.            Logfiles for Host: xxx
  9.   ##################################################################
  11. --------------------- amavis Begin ------------------------
  13. ****** Summary *************************************************************************************
  15.        31                              Clean passed    96.88%
  16.         1                         Bad header passed     3.12%
  17.        32   Ham                                                100.00%
  19.        32   Total messages scanned                             100.00%
  20. ========   ========================================================
  21.        31   SpamAssassin bypassed

Reply

Marsh Posté le 31-10-2007 à 10:31:20    

Code :
  1. SpamAssassin bypassed


 
fais voir les headers d'un mail en question ?


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 10:50:51    

Le problème c'est que je n'ai pas le détail du SpamAssassin bypassed.
Je ne peux donc pas t'envoyer de headers.
Y'a peut être une option non activée dans le amavis.conf de logwatch.

Reply

Marsh Posté le 31-10-2007 à 10:50:51   

Reply

Marsh Posté le 31-10-2007 à 10:54:49    

il n'y a rien de particulier a faire dans logwatch  a part la verbosité.
 
tes mails sont bien marqués comme spam ?
 
peux tu faire voir l'entete d'un spam et celle d'un Ham ?
 


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 11:08:42    

Oui, mes mails sont bien marqués comme Spams.
 
Headers Spam :

Code :
  1. Return-Path: <mailing@solypresse.com>
  2. X-Original-To: xxx@xxx.xxx
  3. Delivered-To: xxx@xxx.xxx
  4. Received: from localhost (localhost [127.0.0.1])
  5.         by xxx.xxx.xxx (Postfix) with ESMTP id 788D37D5F
  6.         for <xxx@xxx.xxx>; Wed, 31 Oct 2007 10:44:47 +0100 (CET)
  7. Received: from xxx.xxx.xxx ([127.0.0.1])
  8.         by localhost (xxx.xxx.xxx [127.0.0.1]) (amavisd-new, port 10024)
  9.         with ESMTP id qSeaWNQf1hPm for <xxx@xxx.xxx>;
  10.         Wed, 31 Oct 2007 10:44:47 +0100 (CET)
  11. Received: by xxx.xxx.xx (Postfix, from userid xxx)
  12.         id 297AC7E07; Wed, 31 Oct 2007 10:44:47 +0100 (CET)
  13. Received: from localhost by XXX
  14.         with SpamAssassin (version 3.1.7-deb);
  15.         Wed, 31 Oct 2007 10:44:47 +0100
  16. From: Solypresse <mailing@solypresse.com>
  17. To: xxx@xxx.xxx
  18. Subject: {Spam?}
  19. Date: 30 Oct 2007 22:18:05 -0000
  20. Message-Id: <20071030221805.3288.qmail@sd111.futie.net>
  21. X-Spam-Flag: YES
  22. X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on SRVINTRA
  23. X-Spam-Level: ******
  24. X-Spam-Status: Yes, score=6.9 required=5.0 tests=BAYES_50,HTML_IMAGE_ONLY_16,
  25.         HTML_MESSAGE,HTML_SHORT_LINK_IMG_2,MIME_HEADER_CTYPE_ONLY,
  26.         MIME_HTML_ONLY,MISSING_SUBJECT,URIBL_OB_SURBL autolearn=disabled
  27.         version=3.1.7-deb
  28. MIME-Version: 1.0
  29. Content-Type: multipart/mixed; boundary="----------=_47284E8F.DCEDBCFC"
  31. This is a multi-part message in MIME format.


 
Headers Ham :

Code :
  1. From: nik600 <nik600@gmail.com>
  2. To: hylafax-users@hylafax.org
  3. Subject: Re: [hylafax-users] notify with attachment
  4. In-Reply-To: <4727657A.6090701@howardsilvan.com>
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=ISO-8859-1
  7. Content-Disposition: inline
  8. References: <9469c3170710291251w28de201fqb98331ea2991b380@mail.gmail.com>
  9.          <4727657A.6090701@howardsilvan.com>
  10. X-Virus-Scanned: amavisd-new at ifax.com
  11. X-archive-position: 30533
  12. X-ecartis-version: Ecartis v1.0.0
  13. Sender: hylafax-users-bounce@hylafax.org
  14. Errors-To: hylafax-users-bounce@hylafax.org
  15. X-original-sender: nik600@gmail.com
  16. Precedence: bulk
  17. List-help: <mailto:ecartis@hylafax.org?Subject=help>
  18. List-unsubscribe: <mailto:hylafax-users-request@hylafax.org?Subject=unsubscribe>
  19. List-software: Ecartis version 1.0.0
  20. List-Id: hylafax-users <hylafax-users.hylafax.org>
  21. X-List-ID: hylafax-users <hylafax-users.hylafax.org>
  22. List-subscribe: <mailto:hylafax-users-request@hylafax.org?Subject=subscribe>
  23. List-owner: <mailto:listmaster@hylafax.org>
  24. List-post: <mailto:hylafax-users@hylafax.org>
  25. List-archive: <http://www.hylafax.org/archive/>
  26. X-list: hylafax-users
  27. Resent-Date: Wed, 31 Oct 2007 11:03:22 +0100
  28. Resent-From: xxx@xxx.xxx
  29. Resent-To: xxx@xxx.xxx
  30. Resent-Message-ID: <1193825002.472852ea97fde@imp.free.fr>
  31. X-Originating-IP: x.x.x.x


Message édité par jaymzwise le 31-10-2007 à 11:09:31
Reply

Marsh Posté le 31-10-2007 à 11:15:53    

sur le ham on dirait bien que SA est bypassé, donc cela colle.
 
 tu n'avait peut etre pas recu de spam sur la periode d'analyse de logwatch plus haut ?
 


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 11:27:06    

Si, j'en ai envoyé quelques uns dans la matinée avant de faire l'analyse de logwatch.
Ils ont bien été marqués comme Spams mais n'apparaissent pas dans l'analyse.

Reply

Marsh Posté le 31-10-2007 à 11:27:57    

fais voir leur header


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 11:30:49    

Le header Spam que j'ai posté plus haut fait partit de ces envois de la matinée.

Reply

Marsh Posté le 31-10-2007 à 11:55:54    

tu as lancé logwatch comment ?


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 11:58:48    

Via cette commande :
 

Code :
  1. /usr/sbin/logwatch --detail 10 --range today --mailto xxx@xxx.xxx --output mail --service amavis

Reply

Marsh Posté le 31-10-2007 à 12:00:26    

essaye de tester plus globalement:

Code :
  1. /usr/sbin/logwatch --detail 11 --range all --mailto xxx@xxx.xxx


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 12:12:19    

Même résultat, que du hams dans l'analyse.
Et c'est bien ce que je pensais, à priori, ce n'est pas amavis qui marque comme spam les mails.
J'ai modifié le $sa_spam_subject_tag du amavisd.conf et cette modif n'a aucun impact sur la balise spam de mes mails.
Il semblerait que ce soit celui de /etc/spamassassin/local.cf qui soit utilisé.
A mon avis, j'ai un chtit problème au niveau de ma configuration...

Reply

Marsh Posté le 31-10-2007 à 12:15:49    

oui car cela doit etre amavisd.conf qui determine le TAG pas le local.cf.
 
 
poste ta conf d'amavisd et le local.cf


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 31-10-2007 à 12:26:58    

Local.cf :

Code :
  1. # This is the right place to customize your installation of SpamAssassin.
  2. #
  3. # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
  4. # tweaked.
  5. #
  6. # Only a small subset of options are listed below
  7. #
  8. ###########################################################################
  10. #   Add *****SPAM***** to the Subject header of spam e-mails
  11. #
  12. rewrite_header  Subject {Spam?}
  13. use_auto_whitelist 0
  15. #   Save spam messages as a message/rfc822 MIME attachment instead of
  16. #   modifying the original message (0: off, 2: use text/plain instead)
  17. #
  18. # report_safe 1
  21. #   Set which networks or hosts are considered 'trusted' by your mail
  22. #   server (i.e. not spammers)
  23. #
  24. clear_internal_networks
  25. clear_trusted_networks
  26. internal_networks x 127.0.0.1
  27. trusted_networks x 127.0.0.1
  30. #   Set file-locking method (flock is not safe over NFS, but is faster)
  31. #
  32. # lock_method flock
  35. #   Set the threshold at which a message is considered spam (default: 5.0)
  36. #
  37. required_score 5.0
  40. #   Use Bayesian classifier (default: 1)
  41. #
  42. use_bayes 1
  43. #bayes_auto_expire 0
  44. bayes_path /home/spamassassin/.spamassassin/bayes
  45. bayes_file_mode 0666
  46. bayes_use_hapaxes 1
  48. bayes_min_ham_num 10
  49. bayes_min_spam_num 10
  51. #   Bayesian classifier auto-learning (default: 1)
  52. #
  53. bayes_auto_learn 0
  56. #   Set headers which may provide inappropriate cues to the Bayesian
  57. #   classifier
  58. #
  59. bayes_ignore_header X-Bogosity
  60. bayes_ignore_header X-Spam-Flag
  61. bayes_ignore_header X-Spam-Status
  63. dns_available yes
  65. ok_languages fr
  67. skip_rbl_checks 0
  68. use_razor2 0
  69. use_pyzor 0
  71. # Exemple de Regle recherchant dans le BODY du Mail
  72. # body LOCAL_DEMONSTRATION_RULE /test/
  73. # score LOCAL_DEMONSTRATION_RULE 3
  74. # describe LOCAL_DEMONSTRATION_RULE This is a simple test rule


 
Amavisd.conf :

Code :
  1. use strict;
  3. #
  4. # Section I - Essential daemon and MTA settings
  5. #
  7. # $MYHOME serves as a quick default for some other configuration settings.
  8. # More refined control is available with each individual setting further down.
  9. # $MYHOME is not used directly by the program. No trailing slash!
  10. $MYHOME = '/var/lib/amavis';   # (default is '/var/amavis')
  12. # $mydomain serves as a quick default for some other configuration settings.
  13. # More refined control is available with each individual setting further down.
  14. # $mydomain is never used directly by the program.
  15. $mydomain = 'x';      # (no useful default)
  17. myhostname = 'x';  # fqdn of this host, default by uname(3)
  19. # Set the user and group to which the daemon will change if started as root
  20. # (otherwise just keeps the UID unchanged, and these settings have no effect):
  21. $daemon_user  = 'amavis'; # (no default (undef))
  22. $daemon_group = 'amavis'; # (no default (undef))
  24. # Runtime working directory (cwd), and a place where
  25. # temporary directories for unpacking mail are created.
  26. # if you change this, you might want to modify the cleanup()
  27. # function in /etc/init.d/amavisd-new
  28. # (no trailing slash, may be a scratch file system)
  29. $TEMPBASE = $MYHOME;           # (must be set if other config vars use is)
  30. #$TEMPBASE = "$MYHOME/tmp";     # prefer to keep home dir /var/amavis clean?
  32. # $helpers_home sets environment variable HOME, and is passed as option
  33. # 'home_dir_for_helpers' to Mail::SpamAssassin::new. It should be a directory
  34. # on a normal persistent file system, not a scratch or temporary file system
  35. #$helpers_home = $MYHOME;      # (defaults to $MYHOME)
  37. # Run the daemon in the specified chroot jail if nonempty:
  38. #$daemon_chroot_dir = $MYHOME;  # (default is undef, meaning: do not chroot)
  40. $pid_file  = "/var/run/amavis/amavisd.pid";  # (default: "$MYHOME/amavisd.pid" )
  41. $lock_file = "/var/run/amavis/amavisd.lock"; # (default: "$MYHOME/amavisd.lock" )
  43. # set environment variables if you want (no defaults):
  44. $ENV{TMPDIR} = $TEMPBASE;       # wise to set TMPDIR, but not obligatory
  45. #...
  48. # MTA SETTINGS, UNCOMMENT AS APPROPRIATE,
  49. # both $forward_method and $notify_method default to 'smtp:127.0.0.1:10025'
  51. # POSTFIX, or SENDMAIL in dual-MTA setup, or EXIM V4
  52. # (set host and port number as required; host can be specified
  53. # as IP address or DNS name (A or CNAME, but MX is ignored)
  54. $forward_method = 'smtp:127.0.0.1:10025';  # where to forward checked mail
  55. $notify_method = $forward_method;          # where to submit notifications
  57. # NOTE: The defaults (above) are good for Postfix or dual-sendmail. You MUST
  58. #       uncomment the appropriate settings below if using other setups!
  60. # SENDMAIL MILTER, using amavis-milter.c helper program:
  61. # SEE amavisd-new-milter package docs FOR DEBIAN INSTRUCTIONS
  62. #$forward_method = undef;  # no explicit forwarding, sendmail does it by itself
  63. # milter; option -odd is needed to avoid deadlocks
  64. #$notify_method = 'pipe:flags=q argv=/usr/sbin/sendmail -Ac -i -odd -f ${sender} -- ${recipient}';
  65. # just a thought: can we use use -Am instead of -odd ?
  67. # SENDMAIL (old non-milter setup, as relay):
  68. #$forward_method = 'pipe:flags=q argv=/usr/sbin/sendmail -C/etc/sendmail.orig.cf -i -f ${sender} -- ${recipient}';
  69. #$notify_method = $forward_method;
  71. # SENDMAIL (old non-milter setup, amavis.c calls local delivery agent):
  72. #$forward_method = undef;  # no explicit forwarding, amavis.c will call LDA
  73. #$notify_method = 'pipe:flags=q argv=/usr/sbin/sendmail -Ac -i -f ${sender} -- ${recipient}';
  75. # EXIM v3 (not recommended with v4 or later, which can use SMTP setup instead):
  76. #$forward_method = 'pipe:flags=q argv=/usr/sbin/exim -oMr scanned-ok -i -f ${sender} -- ${recipient}';
  77. #$notify_method = $forward_method;
  79. # prefer to collect mail for forwarding as BSMTP files?
  80. #$forward_method = "bsmtp:$MYHOME/out-%i-%n.bsmtp";
  81. #$notify_method = $forward_method;
  84. # Net::Server pre-forking settings
  85. # You may want $max_servers to match the width of your MTA pipe
  86. # feeding amavisd, e.g. with Postfix the 'Max procs' field in the
  87. # master.cf file, like the '2' in the:  smtp-amavis unix - - n - 2 smtp
  88. #
  89. $max_servers  =  2;   # number of pre-forked children          (default 2)
  90. $max_requests = 10;   # retire a child after that many accepts (default 10)
  92. $child_timeout=5*60;  # abort child if it does not complete each task in n sec
  93.                       # (default: 8*60 seconds)
  95. # Check also the settings of @av_scanners at the end if you want to use
  96. # virus scanners. If not, you may want to delete the whole long assignment
  97. # to the variable @av_scanners, which will also remove the virus checking
  98. # code (e.g. if you only want to do spam scanning).
  100. # Here is a QUICK WAY to completely DISABLE some sections of code
  101. # that WE DO NOT WANT (it won't even be compiled-in).
  102. # For more refined controls leave the following two lines commented out,
  103. # and see further down what these two lookup lists really mean.
  104. #
  105. # @bypass_virus_checks_acl = qw( . );  # uncomment to DISABLE anti-virus code
  106. @bypass_spam_checks_acl  = qw( . );  # uncomment to DISABLE anti-spam code
  107. #
  108. # Any setting can be changed with a new assignment, so make sure
  109. # you do not unintentionally override these settings further down!
  110. #@bypass_spam_checks_acl  = qw( . );    # No default dependency on spamassassin
  112. # Lookup list of local domains (see README.lookups for syntax details)
  113. #
  114. # NOTE:
  115. #   For backwards compatibility the variable names @local_domains (old) and
  116. #   @local_domains_acl (new) are synonyms. For consistency with other lookups
  117. #   the name @local_domains_acl is now preferred. It also makes it more
  118. #   obviously distinct from the new %local_domains hash lookup table.
  119. #
  120. # local_domains* lookup tables are used in deciding whether a recipient
  121. # is local or not, or in other words, if the message is outgoing or not.
  122. # This affects inserting spam-related headers for local recipients,
  123. # limiting recipient virus notifications (if enabled) to local recipients,
  124. # in deciding if address extension may be appended, and in SQL lookups
  125. # for non-fqdn addresses. Set it up correctly if you need features
  126. # that rely on this setting (or just leave empty otherwise).
  127. #
  128. # With Postfix (2.0) a quick reminder on what local domains normally are:
  129. # a union of domains specified in: $mydestination, $virtual_alias_domains,
  130. # $virtual_mailbox_domains, and $relay_domains.
  131. #
  132. @local_domains_acl = ( "." );  # $mydomain and its subdomains
  133. # @local_domains_acl = ( ".$mydomain", "my.other.domain" );
  134. # @local_domains_acl = qw();  # default is empty, no recipient treated as local
  135. # @local_domains_acl = qw( .example.com );
  136. # @local_domains_acl = qw( .example.com !host.sub.example.net .sub.example.net );
  138. # or alternatively(A), using a Perl hash lookup table, which may be assigned
  139. # directly, or read from a file, one domain per line; comments and empty lines
  140. # are ignored, a dot before a domain name implies its subdomains:
  141. #
  142. #read_hash(\%local_domains, '/etc/amavis/local_domains');
  144. #or alternatively(B), using a list of regular expressions:
  145. # $local_domains_re = new_RE( qr'[@.]example\.com$'i );
  146. #
  147. # see README.lookups for syntax and semantics
  150. #
  151. # Section II - MTA specific (defaults should be ok)
  152. #
  154. # if $relayhost_is_client is true, the IP address in $notify_method and
  155. # $forward_method is dynamically overridden with SMTP client peer address
  156. # (if available), which makes it possible for several hosts to share one
  157. # daemon.  The static port number is also overridden, and is dynamically
  158. # calculated  as being one above the incoming SMTP/LMTP session port number.
  159. #
  160. # These are logged at level 3, so enable logging until you know you got it
  161. # right.
  162. $relayhost_is_client = 0;         # (defaults to false)
  164. $insert_received_line = 1;        # behave like MTA: insert 'Received:' header
  165.             # (does not apply to sendmail/milter)
  166.             # (default is true (1) )
  168. # AMAVIS-CLIENT PROTOCOL INPUT SETTINGS (e.g. with sendmail milter)
  169. #   (used with amavis helper clients like amavis-milter.c and amavis.c,
  170. #   NOT needed for Postfix and Exim  or dual-sendmail - keep it undefined.)
  171. #$unix_socketname = "/var/lib/amavis/amavisd.sock"; # amavis helper protocol socket
  172. $unix_socketname = undef;         # disable listening on a unix socket
  173.                                   # (default is undef, i.e. disabled)
  175. # Do we receive quoted or raw addresses from the helper program?
  176. # (does not apply to SMTP;  defaults to true)
  177. #$gets_addr_in_quoted_form = 1;   # "Bob \"Funny\" Dude"@example.com
  178. #$gets_addr_in_quoted_form = 0;   # Bob "Funny" Dude@example.com
  182. # SMTP SERVER (INPUT) PROTOCOL SETTINGS (e.g. with Postfix, Exim v4, ...)
  183. #   (used when MTA is configured to pass mail to amavisd via SMTP or LMTP)
  184. $inet_socket_port = 10024;        # accept SMTP on this local TCP port
  185.                                   # (default is undef, i.e. disabled)
  186. # multiple ports may be provided: $inet_socket_port = [10024, 10026, 10028];
  188. # SMTP SERVER (INPUT) access control
  189. # - do not allow free access to the amavisd SMTP port !!!
  190. #
  191. # when MTA is at the same host, use the following (one or the other or both):
  192. $inet_socket_bind = '127.0.0.1';  # limit socket bind to loopback interface
  193.                                   # (default is '127.0.0.1')
  194. @inet_acl = qw( 127.0.0.1 );      # allow SMTP access only from localhost IP
  195.                                   # (default is qw( 127.0.0.1 ) )
  197. # when MTA (one or more) is on a different host, use the following:
  198. # @inet_acl = qw(127/8 10.1.0.1 10.1.0.2);  # adjust the list as appropriate
  199. # $inet_socket_bind = undef;      # bind to all IP interfaces if undef
  200. #
  201. # Example1:
  202. # @inet_acl = qw( 127/8 10/8 172.16/12 192.168/16 );
  203. # permit only SMTP access from loopback and rfc1918 private address space
  204. #
  205. # Example2:
  206. # @inet_acl = qw( !192.168.1.12 172.16.3.3 !172.16.3/255.255.255.0
  207. #    127.0.0.1 10/8 172.16/12 192.168/16 );
  208. # matches loopback and rfc1918 private address space except host 192.168.1.12
  209. # and net 172.16.3/24 (but host 172.16.3.3 within 172.16.3/24 still matches)
  210. #
  211. # Example3:
  212. # @inet_acl = qw( 127/8
  213. #    !172.16.3.0   !172.16.3.127 172.16.3.0/25
  214. #    !172.16.3.128 !172.16.3.255 172.16.3.128/25 );
  215. # matches loopback and both halves of the 172.16.3/24 C-class,
  216. # split into two subnets, except all four broadcast addresses
  217. # for these subnets
  218. #
  219. # See README.lookups for details on specifying access control lists.
  222. #
  223. # Section III - Logging
  224. #
  226. # true (e.g. 1) => syslog;  false (e.g. 0) => logging to file
  227. $DO_SYSLOG = 0;                 # (defaults to false)
  228. #$SYSLOG_LEVEL = 'user.info';     # (facility.priority, default 'mail.info')
  230. # Log file (if not using syslog)
  231. LOGFILE = "/var/log/amavis.log";  # (defaults to empty, no log)
  233. #NOTE: levels are not strictly observed and are somewhat arbitrary
  234. # 0: startup/exit/failure messages, viruses detected
  235. # 1: args passed from client, some more interesting messages
  236. # 2: virus scanner output, timing
  237. # 3: server, client
  238. # 4: decompose parts
  239. # 5: more debug details
  240. $log_level = 1;  # (defaults to 0)
  242. # Customizable template for the most interesting log file entry (e.g. with
  243. # $log_level=0) (take care to properly quote Perl special characters like '\')
  244. # For a list of available macros see README.customize .
  246. # only log infected messages (useful with log level 0):
  247. # $log_templ = '[? %#V |[? %#F ||banned filename ([%F|,])]|infected ([%V|,])]#
  248. # [? %#V |[? %#F ||, from=[?%o|(?)|<%o>], to=[<%R>|,][? %i ||, quarantine %i]]#
  249. # |, from=[?%o|(?)|<%o>], to=[<%R>|,][? %i ||, quarantine %i]]';
  251. # log both infected and noninfected messages (default):
  252. $log_templ = '[? %#V |[? %#F |[?%#D|Not-Delivered|Passed]|BANNED name/type (%F)]|INFECTED (%V)], #
  253. [?%o|(?)|<%o>] -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c';
  256. #
  257. # Section IV - Notifications/DSN, BOUNCE/REJECT/DROP/PASS destiny, quarantine
  258. #
  260. # Select notifications text encoding when Unicode-aware Perl is converting
  261. # text from internal character representation to external encoding (charset
  262. # in MIME terminology). Used as argument to Perl Encode::encode subroutine.
  263. #
  264. #   to be used in RFC 2047-encoded header field bodies, e.g. in Subject:
  265. #$hdr_encoding = 'iso-8859-1';  # (default: 'iso-8859-1')
  266. #
  267. #   to be used in notification body text: its encoding and Content-type.charset
  268. #$bdy_encoding = 'iso-8859-1';  # (default: 'iso-8859-1')
  270. # Default template texts for notifications may be overruled by directly
  271. # assigning new text to template variables, or by reading template text
  272. # from files. A second argument may be specified in a call to read_text(),
  273. # specifying character encoding layer to be used when reading from the
  274. # external file, e.g. 'utf8', 'iso-8859-1', or often just $bdy_encoding.
  275. # Text will be converted to internal character representation by Perl 5.8.0
  276. # or later; second argument is ignored otherwise. See PerlIO::encoding,
  277. # Encode::PerlIO and perluniintro man pages.
  278. #
  279. # $notify_sender_templ      = read_text('/var/amavis/notify_sender.txt');
  280. # $notify_virus_sender_templ= read_text('/var/amavis/notify_virus_sender.txt');
  281. # $notify_virus_admin_templ = read_text('/var/amavis/notify_virus_admin.txt');
  282. # $notify_virus_recips_templ= read_text('/var/amavis/notify_virus_recips.txt');
  283. # $notify_spam_sender_templ = read_text('/var/amavis/notify_spam_sender.txt');
  284. # $notify_spam_admin_templ  = read_text('/var/amavis/notify_spam_admin.txt');
  286. # If notification template files are collectively available in some directory,
  287. # use read_l10n_templates which calls read_text for each known template.
  288. #
  289. #   read_l10n_templates('/etc/amavis/en_US');
  290. #
  291. # Debian available locales: en_US, pt_BR, de_DE, it_IT
  292. read_l10n_templates('de_DE', '/etc/amavis');
  295. # Here is an overall picture (sequence of events) of how pieces fit together
  296. # (only virus controls are shown, spam controls work the same way):
  297. #
  298. #   bypass_virus_checks? ==> PASS
  299. #   no viruses?   ==> PASS
  300. #   log virus     if $log_templ is nonempty
  301. #   quarantine    if $virus_quarantine_to is nonempty
  302. #   notify admin  if $virus_admin (lookup) nonempty
  303. #   notify recips if $warnvirusrecip and (recipient is local or $warn_offsite)
  304. #   add address extensions if adding extensions is enabled and virus will pass
  305. #   send (non-)delivery notifications
  306. #      to sender if DSN needed (BOUNCE or ($warn_virus_sender and D_PASS))
  307. #   virus_lovers or final_destiny==D_PASS  ==> PASS
  308. #   DISCARD (2xx) or REJECT (5xx) (depending on final_*_destiny)
  309. #
  310. # Equivalent flow diagram applies for spam checks.
  311. # If a virus is detected, spam checking is skipped entirely.
  313. # The following symbolic constants can be used in *destiny settings:
  314. #
  315. # D_PASS     mail will pass to recipients, regardless of bad contents;
  316. #
  317. # D_DISCARD  mail will not be delivered to its recipients, sender will NOT be
  318. #            notified. Effectively we lose mail (but will be quarantined
  319. #            unless disabled). Losing mail is not decent for a mailer,
  320. #            but might be desired.
  321. #
  322. # D_BOUNCE   mail will not be delivered to its recipients, a non-delivery
  323. #            notification (bounce) will be sent to the sender by amavisd-new;
  324. #            Exception: bounce (DSN) will not be sent if a virus name matches
  325. #            $viruses_that_fake_sender_re, or to messages from mailing lists
  326. #            (Precedence: bulk|list|junk);
  327. #
  328. # D_REJECT   mail will not be delivered to its recipients, sender should
  329. #            preferably get a reject, e.g. SMTP permanent reject response
  330. #            (e.g. with milter), or non-delivery notification from MTA
  331. #            (e.g. Postfix). If this is not possible (e.g. different recipients
  332. #            have different tolerances to bad mail contents and not using LMTP)
  333. #            amavisd-new sends a bounce by itself (same as D_BOUNCE).
  334. #
  335. # Notes:
  336. #   D_REJECT and D_BOUNCE are similar, the difference is in who is responsible
  337. #            for informing the sender about non-delivery, and how informative
  338. #            the notification can be (amavisd-new knows more than MTA);
  339. #   With D_REJECT, MTA may reject original SMTP, or send DSN (delivery status
  340. #            notification, colloquially called 'bounce') - depending on MTA;
  341. #            Best suited for sendmail milter, especially for spam.
  342. #   With D_BOUNCE, amavisd-new (not MTA) sends DSN (can better explain the
  343. #            reason for mail non-delivery, but unable to reject the original
  344. #            SMTP session). Best suited to reporting viruses, and for Postfix
  345. #            and other dual-MTA setups, which can't reject original client SMTP
  346. #            session, as the mail has already been enqueued.
  348. $final_virus_destiny      = D_BOUNCE; # (defaults to D_BOUNCE)
  349. $final_banned_destiny     = D_BOUNCE;  # (defaults to D_BOUNCE)
  350. $final_spam_destiny       = D_PASS;  # (defaults to D_REJECT)
  351. $final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested
  353. # $allowed_header_tests{'8bit'} = 0;
  355. # Alternatives to consider for spam:
  356. # - use D_PASS if clients will do filtering based on inserted mail headers;
  357. # - use D_DISCARD, if kill_level is set safely high;
  358. # - use D_BOUNCE instead of D_REJECT if not using milter;
  359. #
  360. # D_BOUNCE is preferred for viruses, but consider:
  361. # - use D_DISCARD to avoid bothering the rest of the network, it is hopeless
  362. #   to try to keep up with the viruses that faker the envelope sender anyway,
  363. #   and bouncing only increases the network cost of viruses for everyone
  364. # - use D_PASS (or virus_lovers) and $warnvirussender=1 to deliver viruses;
  365. # - use D_REJECT instead of D_BOUNCE if using milter and under heavy
  366. #   virus storm;
  367. #
  368. # Don't bother to set both D_DISCARD and $warn*sender=1, it will get mapped
  369. # to D_BOUNCE.
  370. #
  371. # The separation of *_destiny values into D_BOUNCE, D_REJECT, D_DISCARD
  372. # and D_PASS made settings $warnvirussender and $warnspamsender only still
  373. # useful with D_PASS.
  375. # The following $warn*sender settings are ONLY used when mail is
  376. # actually passed to recipients ($final_*_destiny=D_PASS, or *_lovers*).
  377. # Bounces or rejects produce non-delivery status notification anyway.
  379. # Notify virus sender?
  380. #$warnvirussender = 1; # (defaults to false (undef))
  382. # Notify spam sender?
  383. #$warnspamsender = 1; # (defaults to false (undef))
  385. # Notify sender of banned files?
  386. $warnbannedsender = 1; # (defaults to false (undef))
  388. # Notify sender of syntactically invalid header containing non-ASCII characters?
  389. #$warnbadhsender = 1; # (defaults to false (undef))
  391. # Notify virus (or banned files) RECIPIENT?
  392. #  (not very useful, but some policies demand it)
  393. #$warnvirusrecip = 1; # (defaults to false (undef))
  394. $warnbannedrecip = 1; # (defaults to false (undef))
  396. # Notify also non-local virus/banned recipients if $warn*recip is true?
  397. #  (including those not matching local_domains*)
  398. #$warn_offsite = 1;    # (defaults to false (undef), i.e. only notify locals)
  401. # Treat envelope sender address as unreliable and don't send sender
  402. # notification / bounces if name(s) of detected virus(es) match the list.
  403. # Note that virus names are supplied by external virus scanner(s) and are
  404. # not standardized, so virus names may need to be adjusted.
  405. # See README.lookups for syntax, check also README.policy-on-notifications
  406. #
  407. $viruses_that_fake_sender_re = new_RE(
  408.   qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i,
  409.   qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|parite|spaces'i,
  410.   qr'dloader|galil|gibe|swen|netwatch|bics|sbrowse|sober|rox|val(hal)?la'i,
  411.   qr'frethem|sircam|be?agle|tanx|mydoom|novarg|shimg|netsky|somefool|moodown'i,
  412.   qr'@mm|@MM',    # mass mailing viruses as labeled by f-prot and uvscan
  413.   qr'Worm'i,      # worms as labeled by ClamAV, Kaspersky, etc
  414.   [qr'^(EICAR|Joke\.|Junk\.)'i         => 0],
  415.   [qr'^(WM97|OF97|W95/CIH-|JS/Fort)'i  => 0],
  416.   [qr/.*/ => 1],  # true by default  (remove or comment-out if undesired)
  417. );
  419. # where to send ADMIN VIRUS NOTIFICATIONS (should be a fully qualified address)
  420. # - the administrator address may be a simple fixed e-mail address (a scalar),
  421. #   or may depend on the SENDER address (e.g. its domain), in which case
  422. #   a ref to a hash table can be specified (specify lower-cased keys,
  423. #   dot is a catchall, see README.lookups).
  424. #
  425. #   Empty or undef lookup disables virus admin notifications.
  427. # $virus_admin = undef;   # do not send virus admin notifications (default)
  428. # $virus_admin = {'not.example.com' => '', '.' => 'virusalert@example.com'};
  429. # $virus_admin = 'virus-admin@example.com';
  430. $virus_admin = "postmaster\@$mydomain";  # due to D_DISCARD default
  432. # equivalent to $virus_admin, but for spam admin notifications:
  433. # $spam_admin = "spamalert\@$mydomain";
  434. # $spam_admin = undef;    # do not send spam admin notifications (default)
  435. # $spam_admin = {'not.example.com' => '', '.' => 'spamalert@example.com'};
  437. #advanced example, using a hash lookup table:
  438. #$virus_admin = {
  439. # 'baduser@sub1.example.com' => 'HisBoss@sub1.example.com',
  440. # '.sub1.example.com'  => 'virusalert@sub1.example.com',
  441. # '.sub2.example.com'  => '',                  # don't send admin notifications
  442. # 'a.sub3.example.com' => 'abuse@sub3.example.com',
  443. # '.sub3.example.com'  => 'virusalert@sub3.example.com',
  444. # '.example.com'       => 'noc@example.com',   # catchall for our virus senders
  445. # '.'                  => 'virusalert@hq.example.com',  # catchall for the rest
  446. #};
  449. # whom notification reports are sent from (ENVELOPE SENDER);
  450. # may be a null reverse path, or a fully qualified address:
  451. #   (admin and recip sender addresses default to $mailfrom
  452. #   for compatibility, which in turn defaults to undef (empty) )
  453. #   If using strings in double quotes, don't forget to quote @, i.e. \@
  454. #
  455. #$mailfrom_notify_admin     = "virusalert\@$mydomain";
  456. #$mailfrom_notify_recip     = "virusalert\@$mydomain";
  457. #$mailfrom_notify_spamadmin = "spam.police\@$mydomain";
  459. # 'From' HEADER FIELD for sender and admin notifications.
  460. # This should be a replyable address, see rfc1894. Not to be confused
  461. # with $mailfrom_notify_sender, which is the envelope return address
  462. # and should be empty (null reverse path) according to rfc2821.
  463. #
  464. # The syntax of the 'From' header field is specified in rfc2822, section
  465. # '3.4. Address Specification'. Note in particular that display-name must be
  466. # a quoted-string if it contains any special characters like spaces and dots.
  467. #
  468. $hdrfrom_notify_sender = "amavisd-new <postmaster\@$mydomain>";
  469. # $hdrfrom_notify_sender = 'amavisd-new <postmaster@example.com>';
  470. # $hdrfrom_notify_sender = '"Content-Filter Master" <postmaster@example.com>';
  471. #   (defaults to: "amavisd-new <postmaster\@$myhostname>" )
  472. # $hdrfrom_notify_admin = $mailfrom_notify_admin;
  473. #   (defaults to: $mailfrom_notify_admin)
  474. # $hdrfrom_notify_spamadmin = $mailfrom_notify_spamadmin;
  475. #   (defaults to: $mailfrom_notify_spamadmin)
  477. # whom quarantined messages appear to be sent from (envelope sender);
  478. # keeps original sender if undef, or set it explicitly, default is undef
  479. $mailfrom_to_quarantine = '';   # override sender address with null return path
  482. # Location to put infected mail into: (applies to 'local:' quarantine method)
  483. #   empty for not quarantining, may be a file (mailbox),
  484. #   or a directory (no trailing slash)
  485. #   (the default value is undef, meaning no quarantine)
  486. #
  487. $QUARANTINEDIR = '/var/mail/virus';
  489. #$virus_quarantine_method = "local:virus-%i-%n";    # default
  490. #$spam_quarantine_method  = "local:spam-%b-%i-%n";  # default
  491. #
  492. #use the new 'bsmtp:' method as an alternative to the default 'local:'
  493. #$virus_quarantine_method = "bsmtp:$QUARANTINEDIR/virus-%i-%n.bsmtp";
  494. #$spam_quarantine_method  = "bsmtp:$QUARANTINEDIR/spam-%b-%i-%n.bsmtp";
  496. # When using the 'local:' quarantine method (default), the following applies:
  497. #
  498. # A finer control of quarantining is available through variable
  499. # $virus_quarantine_to/$spam_quarantine_to. It may be a simple scalar string,
  500. # or a ref to a hash lookup table, or a regexp lookup table object,
  501. # which makes possible to set up per-recipient quarantine addresses.
  502. #
  503. # The value of scalar $virus_quarantine_to/$spam_quarantine_to (or a
  504. # per-recipient lookup result from the hash table %$virus_quarantine_to)
  505. # is/are interpreted as follows:
  506. #
  507. # VARIANT 1:
  508. #   empty or undef disables quarantine;
  509. #
  510. # VARIANT 2:
  511. #   a string NOT containing an '@';
  512. # amavisd will behave as a local delivery agent (LDA) and will quarantine
  513. # viruses to local files according to hash %local_delivery_aliases (pseudo
  514. # aliases map) - see subroutine mail_to_local_mailbox() for details.
  515. # Some of the predefined aliases are 'virus-quarantine' and 'spam-quarantine'.
  516. # Setting $virus_quarantine_to ($spam_quarantine_to) to this string will:
  517. #
  518. # * if $QUARANTINEDIR is a directory, each quarantined virus will go
  519. #   to a separate file in the $QUARANTINEDIR directory (traditional
  520. #   amavis style, similar to maildir mailbox format);
  521. #
  522. # * otherwise $QUARANTINEDIR is treated as a file name of a Unix-style
  523. #   mailbox. All quarantined messages will be appended to this file.
  524. #   Amavisd child process must obtain an exclusive lock on the file during
  525. #   delivery, so this may be less efficient than using individual files
  526. #   or forwarding to MTA, and it may not work across NFS or other non-local
  527. #   file systems (but may be handy for pickup of quarantined files via IMAP
  528. #   for example);
  529. #
  530. # VARIANT 3:
  531. #   any email address (must contain '@').
  532. # The e-mail messages to be quarantined will be handed to MTA
  533. # for delivery to the specified address. If a recipient address local to MTA
  534. # is desired, you may leave the domain part empty, e.g. 'infected@', but the
  535. # '@' character must nevertheless be included to distinguish it from variant 2.
  536. #
  537. # This method enables more refined delivery control made available by MTA
  538. # (e.g. its aliases file, other local delivery agents, dealing with
  539. # privileges and file locking when delivering to user's mailbox, nonlocal
  540. # delivery and forwarding, fan-out lists). Make sure the mail-to-be-quarantined
  541. # will not be handed back to amavisd for checking, as this will cause a loop
  542. # (hopefully broken at some stage)! If this can be assured, notifications
  543. # will benefit too from not being unnecessarily virus-scanned.
  544. #
  545. # By default this is safe to do with Postfix and Exim v4 and dual-sendmail
  546. # setup, but probably not safe with sendmail milter interface without
  547. # precaution.
  549. # (the default value is undef, meaning no quarantine)
  551. $virus_quarantine_to  = 'virus-quarantine';    # traditional local quarantine
  552. #$virus_quarantine_to = 'infected@';           # forward to MTA for delivery
  553. #$virus_quarantine_to = "virus-quarantine\@$mydomain";   # similar
  554. #$virus_quarantine_to = 'virus-quarantine@example.com';  # similar
  555. #$virus_quarantine_to = undef;                 # no quarantine
  556. #
  557. #$virus_quarantine_to = new_RE(                # per-recip multiple quarantines
  558. #  [qr'^user@example\.com$'i => 'infected@'],
  559. #  [qr'^(.*)@example\.com$'i => 'virus-${1}@example.com'],
  560. #  [qr'^(.*)(@[^@])?$'i      => 'virus-${1}${2}'],
  561. #  [qr/.*/                   => 'virus-quarantine'] );
  563. # similar for spam
  564. # (the default value is undef, meaning no quarantine)
  565. #
  566. #$spam_quarantine_to = 'spam-quarantine';
  567. #$spam_quarantine_to = "spam-quarantine\@$mydomain";
  568. #$spam_quarantine_to = new_RE(                 # per-recip multiple quarantines
  569. #  [qr'^(.*)@example\.com$'i => 'spam-${1}@example.com'],
  570. #  [qr/.*/                   => 'spam-quarantine'] );
  572. # In addition to per-recip quarantine, a by-sender lookup is possible. It is
  573. # similar to $spam_quarantine_to, but the lookup key is the sender address:
  574. #$spam_quarantine_bysender_to = undef;   # dflt: no by-sender spam quarantine
  577. # Add X-Virus-Scanned header field to mail?
  578. $X_HEADER_TAG = 'X-Virus-Scanned'; # (default: undef)
  579. # Leave empty to add no header  # (default: undef)
  580. $X_HEADER_LINE = "by $myversion (Debian) at $mydomain";
  582. # a string to prepend to Subject (for local recipients only) if mail could
  583. # not be decoded or checked entirely, e.g. due to password-protected archives
  584. $undecipherable_subject_tag = '***UNCHECKED*** ';  # undef disables it
  586. $remove_existing_x_scanned_headers = 0; # leave existing X-Virus-Scanned alone
  587. #$remove_existing_x_scanned_headers= 1; # remove existing headers
  588.     # (defaults to false)
  589. #$remove_existing_spam_headers = 0;     # leave existing X-Spam* headers alone
  590. $remove_existing_spam_headers  = 1;     # remove existing spam headers if
  591.     # spam scanning is enabled (default)
  593. # set $bypass_decode_parts to true if you only do spam scanning, or if you
  594. # have a good virus scanner that can deal with compression and recursively
  595. # unpacking archives by itself, and save amavisd the trouble.
  596. # Disabling decoding also causes banned_files checking to only see
  597. # MIME names and MIME content types, not the content classification types
  598. # as provided by the file(1) utility.
  599. # It is a double-edged sword, make sure you know what you are doing!
  600. #
  601. $bypass_decode_parts = 0;  # (defaults to false)
  603. # don't trust this file type or corresponding unpacker for this file type,
  604. # keep both the original and the unpacked file for a virus checker to see
  605. # (lookup key is what file(1) utility returned):
  606. #
  607. $keep_decoded_original_re = new_RE(
  608. # qr'^MAIL$',   # retain full original message for virus checking (can be slow)
  609.   qr'^MAIL-UNDECIPHERABLE$',  # retain full mail if it contains undecipherables
  610.   qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
  611. # qr'^Zip archive data',
  612. );
  614. # Checking for banned MIME types and names. If any mail part matches,
  615. # the whole mail is rejected, much like the way viruses are handled.
  616. # A list in object $banned_filename_re can be defined to provide a list
  617. # of Perl regular expressions to be matched against each part's:
  618. #
  619. #  * Content-Type value (both declared and effective mime-type),
  620. #    including the possible security risk content types
  621. #    message/partial and message/external-body, as specified by rfc2046;
  622. #
  623. #  * declared (i.e. recommended) file names as specified by MIME subfields
  624. #    Content-Disposition.filename and Content-Type.name, both in their
  625. #    raw (encoded) form and in rfc2047-decoded form if applicable;
  626. #
  627. #  * file content type as guessed by 'file' utility, both the raw
  628. #    result from 'file', as well as short type name, classified
  629. #    into names such as .asc, .txt, .html, .doc, .jpg, .pdf,
  630. #    .zip, .exe, ... - see subroutine determine_file_types().
  631. #    This step is done only if $bypass_decode_parts is not true.
  632. #
  633. #  * leave $banned_filename_re undefined to disable these checks
  634. #    (giving an empty list to new_RE() will also always return false)
  636. $banned_filename_re = new_RE(
  637. #  qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
  638. #   qr'\.[^.]*\.(ppt|exe|vbs|pif|scr|bat|cmd|com|dll)$'i, # some double extensions
  639. #   qr'[{}]',     # curly braces in names (serve as Class ID extensions - CLSID)
  640. #  qr'.\.(ppt|exe|vbs|pif|scr|bat|cmd|com)$'i,           # banned extension - basic
  641. #  qr'.\.(ppt|ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|
  642. #         jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb|
  643. #         vbe|vbs|wsc|wsf|wsh)$'ix,                  # banned extension - long
  644. #  qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
  645. #  qr'^\.(zip|lha|tnef|cab)$'i,                      # banned file(1) types
  646. #  qr'^\.exe$'i,      # banned file(1) types
  647. #  qr'^\.ppt$'i,
  648. # qr'.\.ppt$'i,
  649. # qr'.\.pps$'i,
  650. # qr'\.ppt$',
  651. # qr'\.pps$',
  652. # qr'.\.ppt$',
  653. #   qr'.\.pps$',
  654. #  qr'^application/x-msdownload$'i,                  # banned MIME types
  655. #  qr'^application/x-msdos-program$'i,
  656. #   qr'^message/partial$'i,  # rfc2046. this one is deadly for Outcrook
  657. #  qr'^message/external-body$'i, # block rfc2046
  658. # qr'^application/vnd.ms-powerpoint$'i
  659. );
  660. # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
  661. # and http://www.cknow.com/vtutor/vtextensions.htm
  663. # A little trick: a pattern qr'\.exe$' matches both a short type name '.exe',
  664. # as well as any file name which happens to end with .exe. If only matching
  665. # a file name is desired, but not the short name, a pattern qr'.\.exe$'i
  666. # or similar may be used, which requires that at least one character precedes
  667. # the '.exe', and so it will never match short file types, which always start
  668. # with a dot.
  671. #
  672. # Section V - Per-recipient and per-sender handling, whitelisting, etc.
  673. #
  675. # %virus_lovers, @virus_lovers_acl and $virus_lovers_re lookup tables:
  676. #   (these should be considered policy options, they do not disable checks,
  677. #   see bypass*checks for that!)
  678. #
  679. # Exclude certain RECIPIENTS from virus filtering by adding their lower-cased
  680. # envelope e-mail address (or domain only) to the hash %virus_lovers, or to
  681. # the access list @virus_lovers_acl - see README.lookups and examples.
  682. # Make sure the appropriate form (e.g. external/internal) of address
  683. # is used in case of virtual domains, or when mapping external to internal
  684. # addresses, etc. - this is MTA-specific.
  685. #
  686. # Notifications would still be generated however (see the overall
  687. # picture above), and infected mail (if passed) gets additional header:
  688. #   X-AMaViS-Alert: INFECTED, message contains virus: ...
  689. # (header not inserted with milter interface!)
  690. #
  691. # NOTE (milter interface only): in case of multiple recipients,
  692. # it is only possible to drop or accept the message in its entirety - for all
  693. # recipients. If all of them are virus lovers, we'll accept mail, but if
  694. # at least one recipient is not a virus lover, we'll discard the message.
  697. # %bypass_virus_checks, @bypass_virus_checks_acl and $bypass_virus_checks_re
  698. # lookup tables:
  699. #   (this is mainly a time-saving option, unlike virus_lovers* !)
  700. #
  701. # Similar in concept to %virus_lovers, a hash %bypass_virus_checks,
  702. # access list @bypass_virus_checks_acl and regexp list $bypass_virus_checks_re
  703. # are used to skip entirely the decoding, unpacking and virus checking,
  704. # but only if ALL recipients match the lookup.
  705. #
  706. # %bypass_virus_checks/@bypass_virus_checks_acl/$bypass_virus_checks_re
  707. # do NOT GUARANTEE the message will NOT be checked for viruses - this may
  708. # still happen when there is more than one recipient for a message, and
  709. # not all of them match these lookup tables. To guarantee virus delivery,
  710. # a recipient must also match %virus_lovers/@virus_lovers_acl lookups
  711. # (but see milter limitations above),
  713. # NOTE: it would not be clever to base virus checks on SENDER address,
  714. # since there are no guarantees that it is genuine. Many viruses
  715. # and spam messages fake sender address. To achieve selective filtering
  716. # based on the source of the mail (e.g. IP address, MTA port number, ...),
  717. # use mechanisms provided by MTA if available.
  720. # Similar to lookup tables controlling virus checking, there exist
  721. # spam scanning, banned names/types, and headers_checks control counterparts:
  722. #   %spam_lovers, @spam_lovers_acl, $spam_lovers_re
  723. #   %banned_files_lovers, @banned_files_lovers_acl, $banned_files_lovers_re
  724. #   %bad_header_lovers, @bad_header_lovers_acl, $bad_header_lovers_re
  725. # and:
  726. #   %bypass_spam_checks/@bypass_spam_checks_acl/$bypass_spam_checks_re
  727. #   %bypass_banned_checks/@bypass_banned_checks_acl/$bypass_banned_checks_re
  728. #   %bypass_header_checks/@bypass_header_checks_acl/$bypass_header_checks_re
  729. # See README.lookups for details about the syntax.
  731. # The following example disables spam checking altogether,
  732. # since it matches any recipient e-mail address (any address
  733. # is a subdomain of the top-level root DNS domain):
  734. #   @bypass_spam_checks_acl = qw( . );
  736. #   @bypass_header_checks_acl = qw( user@example.com );
  737. #   @bad_header_lovers_acl    = qw( user@example.com );
  740. # See README.lookups for further detail, and examples below.
  742. # $virus_lovers{lc("postmaster\@$mydomain" )} = 1;
  743. # $virus_lovers{lc('postmaster@example.com')} = 1;
  744. # $virus_lovers{lc('abuse@example.com')} = 1;
  745. # $virus_lovers{lc('some.user@')} = 1;  # this recipient, regardless of domain
  746. # $virus_lovers{lc('boss@example.com')} = 0; # never, even if domain matches
  747. # $virus_lovers{lc('example.com')} = 1; # this domain, but not its subdomains
  748. # $virus_lovers{lc('.example.com')}= 1; # this domain, including its subdomains
  749. #or:
  750. # @virus_lovers_acl = qw( me@lab.xxx.com !lab.xxx.com .xxx.com yyy.org );
  751. #
  752. # $bypass_virus_checks{lc('some.user2@butnot.example.com')} = 1;
  753. # @bypass_virus_checks_acl = qw( some.ddd !butnot.example.com .example.com );
  755. # @virus_lovers_acl = qw( postmaster@example.com );
  756. # $virus_lovers_re = new_RE( qr'^(helpdesk|postmaster)@example\.com$'i );
  758. # $spam_lovers{lc("postmaster\@$mydomain" )} = 1;
  759. # $spam_lovers{lc('postmaster@example.com')} = 1;
  760. # $spam_lovers{lc('abuse@example.com')} = 1;
  761. # @spam_lovers_acl = qw( !.example.com );
  762. # $spam_lovers_re = new_RE( qr'^user@example\.com$'i );
  765. # don't run spam check for these RECIPIENT domains:
  766. #   @bypass_spam_checks_acl = qw( d1.com .d2.com a.d3.com );
  767. # or the other way around (bypass check for all BUT these):
  768. #   @bypass_spam_checks_acl = qw( !d1.com !.d2.com !a.d3.com . );
  769. # a practical application: don't check outgoing mail for spam:
  770. #   @bypass_spam_checks_acl = ( "!.$mydomain", "." );
  771. # (a downside of which is that such mail will not count as ham in SA bayes db)
  774. # Where to find SQL server(s) and database to support SQL lookups?
  775. # A list of triples: (dsn,user,passw).   (dsn = data source name)
  776. # More than one entry may be specified for multiple (backup) SQL servers.
  777. # See 'man DBI', 'man DBD::mysql', 'man DBD::Pg', ... for details.
  778. # When chroot-ed, accessing SQL server over inet socket may be more convenient.
  779. #
  780. # @lookup_sql_dsn =
  781. #   ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
  782. #     ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'] );
  783. #
  784. # ('mail' in the example is the database name, choose what you like)
  785. # With PostgreSQL the dsn (first element of the triple) may look like:
  786. #      'DBI:Pg:host=host1;dbname=mail'
  788. # The SQL select clause to fetch per-recipient policy settings.
  789. # The %k will be replaced by a comma-separated list of query addresses
  790. # (e.g. full address, domain only, catchall).  Use ORDER, if there
  791. # is a chance that multiple records will match - the first match wins.
  792. # If field names are not unique (e.g. 'id'), the later field overwrites the
  793. # earlier in a hash returned by lookup, which is why we use '*,users.id'.
  794. # $sql_select_policy = 'SELECT *,users.id FROM users,policy'.
  795. #   ' WHERE (users.policy_id=policy.id) AND (users.email IN (%k))'.
  796. #   ' ORDER BY users.priority DESC';
  797. #
  798. # The SQL select clause to check sender in per-recipient whitelist/blacklist
  799. # The first SELECT argument '?' will be users.id from recipient SQL lookup,
  800. # the %k will be sender addresses (e.g. full address, domain only, catchall).
  801. # $sql_select_white_black_list = 'SELECT wb FROM wblist,mailaddr'.
  802. #     ' WHERE (wblist.rid=?) AND (wblist.sid=mailaddr.id)'.
  803. #     '   AND (mailaddr.email IN (%k))'.
  804. #   ' ORDER BY mailaddr.priority DESC';
  806. $sql_select_white_black_list = undef;  # undef disables SQL white/blacklisting
  809. # If you decide to pass viruses (or spam) to certain recipients using the
  810. # above lookup tables or using $final_virus_destiny=D_PASS, you can set
  811. # the variable $addr_extension_virus ($addr_extension_spam) to some
  812. # string, and the recipient address will have this string appended
  813. # as an address extension to the local-part of the address. This extension
  814. # can be used by final local delivery agent to place such mail in different
  815. # folders. Leave these two variables undefined or empty strings to prevent
  816. # appending address extensions. Setting has no effect on recipient which will
  817. # not be receiving viruses/spam. Recipients who do not match lookup tables
  818. # local_domains* are not affected.
  819. #
  820. # LDAs usually default to stripping away address extension if no special
  821. # handling is specified, so having this option enabled normally does no harm,
  822. # provided the $recipients_delimiter matches the setting on the final
  823. # MTA's LDA.
  825. # $addr_extension_virus  = 'virus'; # (default is undef, same as empty)
  826. # $addr_extension_spam   = 'spam'; # (default is undef, same as empty)
  827. # $addr_extension_banned = 'banned'; # (default is undef, same as empty)
  830. # Delimiter between local part of the recipient address and address extension
  831. # (which can optionally be added, see variables $addr_extension_virus and
  832. # $addr_extension_spam). E.g. recipient address <user@example.com> gets changed
  833. # to <user+virus@example.com>.
  834. #
  835. # Delimiter should match equivalent (final) MTA delimiter setting.
  836. # (e.g. for Postfix add 'recipient_delimiter = +' to main.cf)
  837. # Setting it to an empty string or to undef disables this feature
  838. # regardless of $addr_extension_virus and $addr_extension_spam settings.
  840. $recipient_delimiter = '+';  # (default is '+')
  842. # true: replace extension;  false: append extension
  843. $replace_existing_extension = 1; # (default is false)
  845. # Affects matching of localpart of e-mail addresses (left of '@')
  846. # in lookups: true = case sensitive, false = case insensitive
  847. $localpart_is_case_sensitive = 0; # (default is false)
  850. # ENVELOPE SENDER WHITELISTING / BLACKLISTING  - GLOBAL (RECIPIENT-INDEPENDENT)
  851. # (affects spam checking only, has no effect on virus and other checks)
  853. # WHITELISTING: use ENVELOPE SENDER lookups to ENSURE DELIVERY from whitelisted
  854. # senders even if the message would be recognized as spam. Effectively, for
  855. # the specified senders, message recipients temporarily become 'spam_lovers'.
  856. # To avoid surprises, whitelisted sender also suppresses inserting/editing
  857. # the tag2-level header fields (X-Spam-*, Subject), appending spam address
  858. # extension, and quarantining.
  860. # BLACKLISTING: messages from specified SENDERS are DECLARED SPAM.
  861. # Effectively, for messages from blacklisted senders, spam level
  862. # is artificially pushed high, and the normal spam processing applies,
  863. # resulting in 'X-Spam-Flag: YES', high 'X-Spam-Level' bar and other usual
  864. # reactions to spam, including possible rejection. If the message nevertheless
  865. # still passes (e.g. for spam loving recipients), it is tagged as BLACKLISTED
  866. # in the 'X-Spam-Status' header field, but the reported spam value and
  867. # set of tests in this report header field (if available from SpamAssassin,
  868. # which may have not been called) is not adjusted.
  869. #
  870. # A sender may be both white- and blacklisted at the same time, settings
  871. # are independent. For example, being both white- and blacklisted, message
  872. # is delivered to recipients, but is not tagged as spam (X-Spam-Flag: No;
  873. # X-Spam-Status: No, ...), but the reported spam level (if computed) may
  874. # still indicate high spam score.
  875. #
  876. # If ALL recipients of the message either white- or blacklist the sender,
  877. # spam scanning (calling the SpamAssassin) is bypassed, saving on time.
  878. #
  879. # The following variables (lookup tables) are available, with the semantics
  880. # and syntax as specified in README.lookups:
  881. #
  882. # %whitelist_sender, @whitelist_sender_acl, $whitelist_sender_re
  883. # %blacklist_sender, @blacklist_sender_acl, $blacklist_sender_re
  885. # SOME EXAMPLES:
  886. #
  887. #ACL:
  888. # @whitelist_sender_acl = qw( .example.com );
  889. #
  890. # @whitelist_sender_acl = ( ".$mydomain" );  # $mydomain and its subdomains
  891. # NOTE: This is not a reliable way of turning off spam checks for
  892. #       locally-originating mail, as sender address can easily be faked.
  893. #       To reliably avoid spam-scanning outgoing mail,
  894. #       use @bypass_spam_checks_acl .
  896. #RE:
  897. # $whitelist_sender_re = new_RE(
  898. #   qr'^postmaster@.*\bexample\.com$'i,
  899. #   qr'owner-[^@]*@'i,  qr'-request@'i,
  900. #   qr'\.example\.com$'i );
  901. #
  902. $blacklist_sender_re = new_RE(
  903.     qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou|greatcasino)@'i,
  904.     qr'^(investments|lose_weight_today|market\.alert|money2you|MyGreenCard)@'i,
  905.     qr'^(new\.tld\.registry|opt-out|opt-in|optin|saveonl|smoking2002k)@'i,
  906.     qr'^(specialoffer|specialoffers|stockalert|stopsnoring|wantsome)@'i,
  907.     qr'^(workathome|yesitsfree|your_friend|greatoffers)@'i,
  908.     qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i,
  909. );
  911. #HASH lookup variant:
  912. # NOTE: Perl operator qw splits its argument string by whitespace
  913. # and produces a list. This means that addresses can not contain
  914. # whitespace, and there is no provision for comments within the string.
  915. # You can use the normal Perl list syntax if you have special requirements,
  916. # e.g. map {...} ('one user@bla', '.second.com'), or use read_hash to read
  917. # addresses from a file.
  918. #
  920. # a hash lookup table can be read from a file,
  921. # one address per line, comments and empty lines are permitted:
  922. #
  923. # read_hash(\%whitelist_sender, '/var/amavis/whitelist_sender');
  925. # ... or set directly:
  926. map { $whitelist_sender{lc($_)}=1 } (qw(
  927.   nobody@cert.org
  928.   owner-alert@iss.net
  929.   slashdot@slashdot.org
  930.   bugtraq@securityfocus.com
  931.   NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
  932.   security-alerts@linuxsecurity.com
  933.   amavis-user-admin@lists.sourceforge.net
  934.   razor-users-admin@lists.sourceforge.net
  935.   notification-return@lists.sophos.com
  936.   mailman-announce-admin@python.org
  937.   zope-announce-admin@zope.org
  938.   owner-postfix-users@postfix.org
  939.   owner-postfix-announce@postfix.org
  940.   owner-sendmail-announce@lists.sendmail.org
  941.   sendmail-announce-request@lists.sendmail.org
  942.   ca+envelope@sendmail.org
  943.   owner-technews@postel.ACM.ORG
  944.   lvs-users-admin@LinuxVirtualServer.org
  945.   ietf-123-owner@loki.ietf.org
  946.   cvs-commits-list-admin@gnome.org
  947.   rt-users-admin@lists.fsck.com
  948.   owner-announce@mnogosearch.org
  949.   owner-hackers@ntp.org
  950.   owner-bugs@ntp.org
  951.   clp-request@comp.nus.edu.sg
  952.   surveys-errors@lists.nua.ie
  953.   emailNews@genomeweb.com
  954.   owner-textbreakingnews@CNNIMAIL12.CNN.COM
  955.   yahoo-dev-null@yahoo-inc.com
  956. ));
  959. # ENVELOPE SENDER WHITELISTING / BLACKLISTING - PER-RECIPIENT
  961. # The same semantics as for global white/blacklisting applies, but this
  962. # time each recipient (or its domain, or subdomain, ...) can be given
  963. # an individual lookup table for matching senders. The per-recipient lookups
  964. # override the global lookups, which serve as a fallback default.
  966. # Specify a two-level lookup table: the key for the outer table is recipient,
  967. # and the result should be an inner lookup table (hash or ACL or RE),
  968. # where the key used will be the sender.
  969. #
  970. #$per_recip_blacklist_sender_lookup_tables = {
  971. # 'user1@my.example.com'=>new_RE(qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i),
  972. # 'user2@my.example.com'=>[qw( spammer@d1.example,org .d2.example,org )],
  973. #};
  974. #$per_recip_whitelist_sender_lookup_tables = {
  975. # 'user@my.example.com' => [qw( friend@example.org .other.example.org )],
  976. # '.my1.example.com'    => [qw( !foe.other.example,org .other.example,org )],
  977. # '.my2.example.com'    => read_hash('/var/amavis/my2-wl.dat'),
  978. # 'abuse@' => { 'postmaster@'=>1,
  979. #               'cert-advisory-owner@cert.org'=>1, 'owner-alert@iss.net'=>1 },
  980. #};
  983. #
  984. # Section VI - Resource limits
  985. #
  987. # Sanity limit to the number of allowed recipients per SMTP transaction
  988. # $smtpd_recipient_limit = 1000;  # (default is 1000)
  991. # Resource limits to protect unpackers, decompressors and virus scanners
  992. # against mail bombs (e.g. 42.zip)
  994. # Maximum recursion level for extraction/decoding (0 or undef disables limit)
  995. $MAXLEVELS = 14;  # (default is undef, no limit)
  997. # Maximum number of extracted files (0 or undef disables the limit)
  998. $MAXFILES = 1500;  # (default is undef, no limit)
  1000. # For the cumulative total of all decoded mail parts we set max storage size
  1001. # to defend against mail bombs. Even though parts may be deleted (replaced
  1002. # by decoded text) during decoding, the size they occupied is _not_ returned
  1003. # to the quota pool.
  1004. #
  1005. # Parameters to storage quota formula for unpacking/decoding/decompressing
  1006. #   Formula:
  1007. #     quota = max($MIN_EXPANSION_QUOTA,
  1008. #                 $mail_size*$MIN_EXPANSION_FACTOR,
  1009. #                 min($MAX_EXPANSION_QUOTA, $mail_size*$MAX_EXPANSION_FACTOR))
  1010. #   In plain words (later condition overrules previous ones):
  1011. #     allow MAX_EXPANSION_FACTOR times initial mail size,
  1012. #     but not more than MAX_EXPANSION_QUOTA,
  1013. #     but not less than MIN_EXPANSION_FACTOR times initial mail size,
  1014. #     but never less than MIN_EXPANSION_QUOTA
  1015. #
  1016. $MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not enforced)
  1017. $MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes  (default undef, not enforced)
  1018. $MIN_EXPANSION_FACTOR =   5;  # times original mail size  (must be specified)
  1019. $MAX_EXPANSION_FACTOR = 500;  # times original mail size  (must be specified)
  1022. #
  1023. # Section VII - External programs, virus scanners
  1024. #
  1026. # Specify a path string, which is a colon-separated string of directories
  1027. # (no trailing slashes!) to be assigned to the environment variable PATH
  1028. # and to serve for locating external programs below.
  1030. # NOTE: if $daemon_chroot_dir is nonempty, the directories will be
  1031. #       relative to the chroot directory specified;
  1033. $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
  1035. # Specify one string or a search list of strings (first match wins).
  1036. # The string (or: each string in a list) may be an absolute path,
  1037. # or just a program name, to be located via $path;
  1038. # Empty string or undef (=default) disables the use of that external program.
  1039. # Optionally command arguments may be specified - only the first substring
  1040. # up to the whitespace is used for file searching.
  1042. $file   = 'file';   # file(1) utility; use 3.41 or later to avoid vulnerability
  1044. $gzip   = 'gzip';
  1045. $bzip2  = 'bzip2';
  1046. $lzop   = 'lzop';
  1047. $uncompress = ['uncompress', 'gzip -d', 'zcat'];
  1048. $unfreeze   = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
  1049. $arc        = ['nomarch', 'arc'];
  1050. $unarj      = ['arj', 'unarj'];  # both can extract, arj is recommended
  1051. $unrar      = ['rar', 'unrar'];  # both can extract, same options
  1052. $zoo    = 'zoo';
  1053. $lha    = 'lha';
  1054. $cpio   = 'cpio';   # comment out if cpio does not support GNU options
  1057. # SpamAssassin settings
  1059. # $sa_local_tests_only is passed to Mail::SpamAssassin::new as a value
  1060. # of the option local_tests_only. See Mail::SpamAssassin man page.
  1061. # If set to 1, SA tests are restricted to local tests only, i.e. no tests
  1062. # that require internet access will be performed.
  1063. #
  1064. $sa_local_tests_only = 0;   # (default: false)
  1065. #$sa_auto_whitelist = 1;    # turn on AWL (default: false)
  1067. # Timout for SpamAssassin. This is only used if spamassassin does NOT
  1068. # override it (which it often does if sa_local_tests_only is not true)
  1069. $sa_timeout = 30;           # timeout in seconds for a call to SpamAssassin
  1070.                             # (default is 30 seconds, undef disables it)
  1072. # AWL (auto whitelisting), requires spamassassin 2.44 or better
  1073. # $sa_auto_whitelist = 1;   # defaults to undef
  1075. $sa_mail_body_size_limit = 150*1024;  # don't waste time on SA is mail is larger
  1076.       # (less than 1% of spam is > 64k)
  1077.       # default: undef, no limitations
  1079. # default values, can be overridden by more specific lookups, e.g. SQL
  1080. $sa_tag_level_deflt  = -9999.9; # add spam info headers if at, or above that level
  1081. $sa_tag2_level_deflt = 5.0;  # add 'spam detected' headers at that level
  1082. $sa_kill_level_deflt = -9999.9; # $sa_tag2_level_deflt; triggers spam evasive actions
  1083.                              # at or above that level: bounce/reject/drop,
  1084.                              # quarantine, and adding mail address extension
  1086. $sa_dsn_cutoff_level = 10;  # spam level beyond which a DSN is not sent,
  1087.                             # effectively turning D_BOUNCE into D_DISCARD;
  1088.                             # undef disables this feature and is a default;
  1090. #
  1091. # The $sa_tag_level_deflt, $sa_tag2_level_deflt and $sa_kill_level_deflt
  1092. # may also be hashrefs to hash lookup tables, to make static per-recipient
  1093. # settings possible without having to resort to SQL or LDAP lookups.
  1095. # a quick reference:
  1096. #   tag_level  controls adding the X-Spam-Status and X-Spam-Level headers,
  1097. #   tag2_level controls adding 'X-Spam-Flag: YES', and editing Subject,
  1098. #   kill_level controls 'evasive actions' (reject, quarantine, extensions);
  1099. # it only makes sense to maintain the relationship:
  1100. # tag_level <= tag2_level <= kill_level < $sa_dsn_cutoff_level
  1102. # string to prepend to Subject header field when message exceeds tag2 level
  1103. $sa_spam_subject_tag = '{Spamy?}'; # (defaults to undef, disabled)
  1104.        # (only seen when spam is not to be rejected
  1105.        # and recipient is in local_domains*)
  1107. $sa_spam_report_header = 1;
  1108. $sa_spam_modifies_subj = 1; # may be a ref to a lookup table, default is true
  1109. # Example: modify Subject for all local recipients except user@example.com
  1110. #$sa_spam_modifies_subj = [qw( !user@example.com . )];
  1112. # stop anti-virus scanning when the first scanner detects a virus?
  1113. $first_infected_stops_scan = 1;  # default is false, all scanners are called


Message édité par jaymzwise le 31-10-2007 à 12:30:20
Reply

Marsh Posté le 31-10-2007 à 12:54:05    

j'ai regardé rapidement et apparemment ton SA est desactivé dans amavisd:
 

Code :
  1. ...
  2. # Here is a QUICK WAY to completely DISABLE some sections of code
  3. # that WE DO NOT WANT (it won't even be compiled-in).
  4. # For more refined controls leave the following two lines commented out,
  5. # and see further down what these two lookup lists really mean.
  6. #
  7. # @bypass_virus_checks_acl = qw( . );  # uncomment to DISABLE anti-virus code
  8. @bypass_spam_checks_acl  = qw( . );  # uncomment to DISABLE anti-spam code
  9. #
  10. # Any setting can be changed with a new assignment, so make sure
  11. # you do not unintentionally override these settings further down!
  12. #@bypass_spam_checks_acl  = qw( . );    # No default dependency on spamassassin
  13. ....


 
 
 
comment est configuré postfix ?
fais voir postconf -n et le master.cf


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 08:25:08    

Salut,
 
Voici ce que renvoie le postconf -n :

Code :
  1. alias_database = hash:/etc/postfix/aliases
  2. alias_maps = hash:/etc/postfix/aliases
  3. append_dot_mydomain = no
  4. biff = no
  5. bounce_template_file = /etc/postfix/bounce.cf
  6. config_directory = /etc/postfix
  7. content_filter = smtp-amavis:[127.0.0.1]:10024
  8. header_checks = regexp:/etc/postfix/header_checks
  9. home_mailbox = Maildir/
  10. inet_interfaces = all
  11. local_recipient_maps = $alias_maps
  12. mailbox_size_limit = 0
  13. message_size_limit = 4500000
  14. mydestination = $mydomain, $myhostname.$mydomain, localhost.$mydomain
  15. mydomain = x.x
  16. myhostname = x.x.x
  17. mynetworks = x.x.x.x/x, x.x.x.x/x
  18. myorigin = $mydomain
  19. receive_override_options = no_address_mappings
  20. recipient_delimiter = +
  21. relay_domains = x.x
  22. relayhost = x.x.x
  23. smtp_data_done_timeout = 120s
  24. smtp_data_init_timeout = 360s
  25. smtp_data_xfer_timeout = 120s
  26. smtp_destination_concurrency_limit = 10
  27. smtp_helo_timeout = 150s
  28. smtp_mail_timeout = 360s
  29. smtp_quit_timeout = 120s
  30. smtp_rcpt_timeout = 360s
  31. smtp_sasl_auth_enable = yes
  32. smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
  33. smtp_sasl_security_options =
  34. smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
  35. smtpd_client_restrictions = permit_mynetworks
  36. smtpd_delay_reject = yes
  37. smtpd_helo_required = yes
  38. smtpd_helo_restrictions = permit_mynetworks, reject_invalid_hostname, reject_unauth_pipelining, reject_non_fqdn_hostname
  39. smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unverified_recipient, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_destination, permit
  40. smtpd_sasl_auth_enable = yes
  41. smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_unauth_destination


 
Et le master.cf :

Code :
  1. #
  2. # Postfix master process configuration file.  For details on the format
  3. # of the file, see the master(5) manual page (command: "man 5 master" ).
  4. #
  5. # ==========================================================================
  6. # service type  private unpriv  chroot  wakeup  maxproc command + args
  7. #               (yes)   (yes)   (yes)   (never) (100)
  8. # ==========================================================================
  9. # smtp      inet  n       -       -       -       -       smtpd
  10. smtp      inet  n       -       -       -       -       smtpd -o content_filter=spamassassin
  11. #submission inet n       -       -       -       -       smtpd
  12. #  -o smtpd_enforce_tls=yes
  13. #  -o smtpd_sasl_auth_enable=yes
  14. #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  15. #smtps     inet  n       -       -       -       -       smtpd
  16. #  -o smtpd_tls_wrappermode=yes
  17. #  -o smtpd_sasl_auth_enable=yes
  18. #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  19. #628      inet  n       -       -       -       -       qmqpd
  20. pickup    fifo  n       -       -       60      1       pickup
  21. cleanup   unix  n       -       -       -       0       cleanup
  22. qmgr      fifo  n       -       n       300     1       qmgr
  23. #qmgr     fifo  n       -       -       300     1       oqmgr
  24. tlsmgr    unix  -       -       -       1000?   1       tlsmgr
  25. rewrite   unix  -       -       -       -       -       trivial-rewrite
  26. bounce    unix  -       -       -       -       0       bounce
  27. defer     unix  -       -       -       -       0       bounce
  28. trace     unix  -       -       -       -       0       bounce
  29. verify    unix  -       -       -       -       1       verify
  30. flush     unix  n       -       -       1000?   0       flush
  31. proxymap  unix  -       -       n       -       -       proxymap
  32. smtp      unix  -       -       -       -       -       smtp
  33. # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
  34. relay     unix  -       -       -       -       -       smtp
  35.         -o fallback_relay=
  36. #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
  37. showq     unix  n       -       -       -       -       showq
  38. error     unix  -       -       -       -       -       error
  39. discard   unix  -       -       -       -       -       discard
  40. local     unix  -       n       n       -       -       local
  41. virtual   unix  -       n       n       -       -       virtual
  42. lmtp      unix  -       -       -       -       -       lmtp
  43. anvil     unix  -       -       -       -       1       anvil
  44. scache    unix  -       -       -       -       1       scache
  45. #
  46. # ====================================================================
  47. # Interfaces to non-Postfix software. Be sure to examine the manual
  48. # pages of the non-Postfix software to find out what options it wants.
  49. #
  50. # Many of the following services use the Postfix pipe(8) delivery
  51. # agent.  See the pipe(8) man page for information about ${recipient}
  52. # and other message envelope options.
  53. # ====================================================================
  54. #
  55. # maildrop. See the Postfix MAILDROP_README file for details.
  56. # Also specify in main.cf: maildrop_destination_recipient_limit=1
  57. #
  58. maildrop  unix  -       n       n       -       -       pipe
  59.   flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
  60. #
  61. # See the Postfix UUCP_README file for configuration details.
  62. #
  63. uucp      unix  -       n       n       -       -       pipe
  64.   flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
  65. #
  66. # Other external delivery methods.
  67. #
  68. ifmail    unix  -       n       n       -       -       pipe
  69.   flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
  70. bsmtp     unix  -       n       n       -       -       pipe
  71.   flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
  72. scalemail-backend unix  -       n       n       -       2       pipe
  73.   flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
  74. mailman   unix  -       n       n       -       -       pipe
  75.   flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  76.   ${nexthop} ${user}
  78. smtp-amavis     unix    -       -       n       -       2       smtp    -o smtp_data_done_timeout=1200 -o smtp_send_xforward_command=yes -o disable_dns_lookups=yes
  80. 127.0.0.1:10025 inet n - - - - smtpd -o content_filter= -o local_recipient_maps= -o relay_recipient_maps= -o smtpd_restriction_classes= -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= -o smtpd_recipient_restrictions=permit_mynetworks,reject -o mynetworks=127.0.0.0/8 -o strict_rfc821_envelopes=yes -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks -o smtpd_bind_address=127.0.0.1
  82. spamassassin unix  -       n       n       -       -       pipe
  83.    user=spamassassin argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

Reply

Marsh Posté le 05-11-2007 à 10:10:12    

ok c'est ce que je pensais:
on voit bien que SA n'est pas appelé par amavisd dans ta conf
 
c'est donc logique que logwatch ne voit pas de logs.


Message édité par toniotonio le 05-11-2007 à 10:10:44

---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 11:31:20    

Ok, j'ai essayé de me baser sur le site que tu conseilles pour modifier ma configuration.
J'ai commenté ma ligne spamassassin dans le master.cf, supprimé le -o content_filter=spamassassin et activé le spam_check dans amavisd.conf.
J'ai redémarré postfix et amavis mais les mails ne passent plus via spamassassin, pourtant j'ai bien commenté la ligne

Code :
  1. @bypass_spam_checks_acl  = qw( . );

Reply

Marsh Posté le 05-11-2007 à 11:41:41    

que disent les logs ?
 
quand tu dis "activé le spam_check dans amavisd.conf." c'est quoi ?
 
dans les dernieres version d'amavisd la commande c'est "@bypass_spam_checks_maps"
 
quelle version d'amavis a tu ?


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 11:54:02    

C'est une version pas très récente : 2.4.2 (20060627).
 
En fait, j'ai commenté la ligne bypass_spam_checks_acl, d'où le "j'ai activé le spam check".
 
Ce qui est bizarre, lorsque je redémarre amavisd, dans les logs j'ai ceci :  

Code :
  1. Nov  5 11:28:46 srvintra amavis[19417]: ANTI-VIRUS code      NOT loaded
  2. Nov  5 11:28:46 srvintra amavis[19417]: ANTI-SPAM code       NOT loaded
  3. Nov  5 11:28:46 srvintra amavis[19417]: ANTI-SPAM-SA code    NOT loaded


 
Alors que j'ai bien commenté les lignes :

Code :
  1. # @bypass_virus_checks_acl = qw( . );
  2. # @bypass_spam_checks_acl  = qw( . );


 
Je n'ai pas de ligne @bypass_spam_checks_maps dans mon fichier amavisd.conf.


Message édité par jaymzwise le 05-11-2007 à 11:57:22
Reply

Marsh Posté le 05-11-2007 à 12:00:06    

tu peux mettre a jour amavisd ? (direct depuis les sources, c'est juste un fichier perl)
 
et recreer un fichier de conf plus simple ?


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 12:01:57    

Oui, je pense pouvoir mettre à jour amavisd mais pourrais-tu me donner le nom du fichier perl, merci.
 
Edit : Le problème est qu'il a été installé via un apt-get.


Message édité par jaymzwise le 05-11-2007 à 12:03:10
Reply

Marsh Posté le 05-11-2007 à 12:03:50    

/usr/local/sbin/amavisd tout simplement.
 
si tu l'as installé en package pour ta version actuelle, l'emplacement ne doit pas etre le meme.


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 12:10:43    

J'ai fait un whereis sur amavisd il ne me renvoie rien. Par contre j'ai du amavisd-new dans /usr/sbin.
Le fichier que tu as cité, je dois l'exécuter pour mettre à jour amavis, il a besoin d'un argument ?

Message cité 1 fois
Reply

Marsh Posté le 05-11-2007 à 12:35:32    

jaymzwise a écrit :

J'ai fait un whereis sur amavisd il ne me renvoie rien. Par contre j'ai du amavisd-new dans /usr/sbin.
Le fichier que tu as cité, je dois l'exécuter pour mettre à jour amavis, il a besoin d'un argument ?


 
 
donc ton installation initiale semble etre un package de ta distrib.
tu peux soit le desinstaller , soit le desactiver dans /etc/init.d/
 
 
pour mettre a jour amavisd tu vas sur le site d'amavisd, il faut l'installer a partir des sources c'est le plus propre.
 
regardes la procedure complete ici: http://starbridge.org/spip/spip.ph [...] sommaire_3
 
a priori tu peux sauter l'etape sur les modules perl
 
 
 


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 14:17:47    

Ok, merci pour les infos.
Je mettrai à jour amavis ce soir, je ne sais pas ce que l'absence d'amavis pendant quelques minutes peut engendrer sur le serveur de messagerie.

Reply

Marsh Posté le 05-11-2007 à 14:21:46    

si amavis est down, postfix garde les mails en queue dans l'attente du retour du content_filter.
donc pas de risque de perte de mails.
 


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 14:33:54    

Ok, c'est bien ce que je pensais.
Donc je vais faire l'update d'amavis.
Je saute la partie des modules d'après toi ?

Message cité 1 fois
Message édité par jaymzwise le 05-11-2007 à 14:34:20
Reply

Marsh Posté le 05-11-2007 à 14:42:44    

jaymzwise a écrit :

Ok, c'est bien ce que je pensais.
Donc je vais faire l'update d'amavis.
Je saute la partie des modules d'après toi ?


 
oui  
de toutes facons au demarrage si il en manque un, amavisd te le dira !


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 16:56:57    

Encore merci pour ton aide.
 
Bon, j'ai réinstallé amavis (2.5.2).
J'ai un petit problème avec clamav, que j'ai également réinstallé en suivant les instructions du site.
Dans les logs, j'ai ce genre de messages :
 

Code :
  1. WARN: all primary virus scanners failed, considering backups


 
ClamAv tourne bien.
J'ai bien commenté la ligne @bypass_virus_checks...
 
Autre problème, à priori, la configuration actuelle d'amavis fait que les messages avec bad headers sont stockés dans le répertoire /var/virusmails.
Pour le moment, j'ai activé le bypass_header_checks mais il y a quelques mails dans /var/virusmails que je dois réenvoyer mais je ne sais pas du tout comment m'y prendre.

Reply

Marsh Posté le 05-11-2007 à 18:05:46    

dans la config de base les bad headers sont livrés au destinataire. ils sont juste copiés dans /var/virusmails
 
pour clam c'est surement le demon clam qui ne tourne pas.


---------------
Messagerie dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com
Reply

Marsh Posté le 05-11-2007 à 18:17:46    

Oui, effectivement concernant les bad headers, les mails sont bien livrés au destinataire.
Je vérifierai si le daemon clam tourne correctement.
 
En tout cas, merci beaucoup pour ton aide ;)

Reply

Marsh Posté le    

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed