Gregory Colpart
3 years ago
3 changed files with 329 additions and 123 deletions
Split View
Diff Options
-
+113 -92HowtoAmavis.md
-
+31 -31HowtoDovecot.md
-
+185 -0HowtoSpamAssassin.md
+ 113
- 92
HowtoAmavis.md
View File
+ 31
- 31
HowtoDovecot.md
View File
+ 185
- 0
HowtoSpamAssassin.md
View File
| @ -0,0 +1,185 @@ | |||
| --- | |||
| categories: mail | |||
| title: Howto SpamAssassin | |||
| ... | |||
| * Documentation : <http://spamassassin.apache.org/doc.html> | |||
| [SpamAssassin](http://spamassassin.apache.org/) est un filtre pour évaluer si des emails sont des spams. | |||
| ## Installation | |||
| Nous utilisons la version [Apache-ITK](http://mpm-itk.sesse.net/) depuis des années en production sur de nombreux serveurs critiques. Apache-ITK permet de préciser pour chaque VirtualHost un utilisateur, un groupe et une option *MaxClients* spécifiques, ce qui est utile pour la sécurité d'un serveur multi-sites. | |||
| ~~~ | |||
| # apt install spamassassin spamc | |||
| ~~~ | |||
| ## Configuration | |||
| ~~~ | |||
| required_score 5 | |||
| report_safe 0 | |||
| rewrite_header Subject [SPAM] | |||
| add_header all Report _REPORT_ | |||
| # filtre bayesien | |||
| # mkdir -p /var/spool/spam | |||
| use_bayes 1 | |||
| bayes_auto_learn 1 | |||
| bayes_path /var/spool/spam/bayes | |||
| bayes_file_mode 0777 | |||
| # AWL : AutoWhitelist | |||
| # mkdir -p /var/spool/spam | |||
| loadplugin Mail::SpamAssassin::Plugin::AWL | |||
| use_auto_whitelist 1 | |||
| auto_whitelist_path /var/spool/spam/auto_whitelist | |||
| auto_whitelist_file_mode 0666 | |||
| # LANG TESTS | |||
| Mail::SpamAssassin::Plugin::TextCat | |||
| ok_languages en fr es it | |||
| ok_locales en fr es it | |||
| score BODY_8BITS 1.500 | |||
| score CHARSET_FARAWAY 3.200 | |||
| score CHARSET_FARAWAY_HEADER 3.200 | |||
| score HTML_CHARSET_FARAWAY 0.500 | |||
| score MIME_CHARSET_FARAWAY 2.450 | |||
| score UNWANTED_LANGUAGE_BODY 2.800 | |||
| # DCC | |||
| # use_dcc 1 => un plugin maintenant... | |||
| score DCC_CHECK 2.9 | |||
| # RAZOR : <http://razor.sourceforge.net> | |||
| use_razor2 1 | |||
| razor_timeout 10 | |||
| score RAZOR2_CHECK 2.9 | |||
| score RAZOR2_CF_RANGE_51_100 1.3 | |||
| # pyzor : <http://pyzor.sourceforge.net/> | |||
| use_pyzor 0 | |||
| # RBL (Realtime Blackhole List) | |||
| skip_rbl_checks 0 | |||
| score RCVD_IN_BL_SPAMCOP_NET 3 | |||
| # misc | |||
| score HELO_DYNAMIC_IPADDR 0.3 | |||
| score BIZ_TLD 0.1 | |||
| score PRIORITY_NO_NAME 0.2 | |||
| # disable HTML tests | |||
| score HTML_MESSAGE 0 | |||
| score HTML_00_10 0 | |||
| score HTML_10_20 0 | |||
| score HTML_20_30 0 | |||
| score HTML_30_40 0 | |||
| score HTML_40_50 0 | |||
| score HTML_50_60 0 | |||
| score HTML_60_70 0 | |||
| score HTML_70_80 0 | |||
| score HTML_80_90 0 | |||
| score HTML_90_100 0 | |||
| #score HTML_COMMENT_8BITS 0 | |||
| score UPPERCASE_25_50 0 | |||
| score UPPERCASE_50_75 0 | |||
| score UPPERCASE_75_100 0 | |||
| score MIME_HTML_ONLY 0.1 | |||
| # From <http://maxime.ritter.eu.org/Spam/user_prefs> | |||
| # Trop de faux negatifs avec BAYES_(0|1|2|3|4)* | |||
| score BAYES_00 0 0 -0.01 -0.01 | |||
| score BAYES_01 0 0 -0.01 -0.01 | |||
| score BAYES_10 0 0 -0.01 -0.01 | |||
| score BAYES_20 0 0 -0.01 -0.01 | |||
| score BAYES_30 0 0 -0.01 -0.01 | |||
| score BAYES_40 0 0 -0.01 -0.01 | |||
| score BAYES_44 0 0 -0.01 -0.01 | |||
| score BAYES_50 0 0 0.1 0.1 | |||
| score BAYES_56 0 0 0.5 0.5 | |||
| score BAYES_60 0 0 1.0 1.0 | |||
| score BAYES_70 0 0 2.5 2.5 | |||
| score BAYES_80 0 0 3.5 3.5 | |||
| score BAYES_90 0 0 4.5 4.5 | |||
| score BAYES_99 0 0 8.0 8.0 | |||
| score RCVD_IN_SORBS_DUL 0.3 | |||
| score SUBJ_ILLEGAL_CHARS 0 | |||
| score RCVD_IN_NJABL_DUL 0.3 | |||
| score ADDRESS_IN_SUBJECT 0.1 | |||
| score HELO_LH_HOME 1.0 | |||
| #internal_networks 192.168.XXX/24 | |||
| trusted_networks 31.170.8.33 31.170.8.15 62.212.111.216 88.179.18.233 85.118.59.50 | |||
| #score ALL_TRUSTED 0.3 | |||
| score HELO_DYNAMIC_IPADDR 0.3 | |||
| score FORGED_MUA_OUTLOOK 0.5 | |||
| # Eudora sucks | |||
| score EXTRA_MPART_TYPE 0.1 | |||
| score MIME_BOUND_EQ_REL 0.1 | |||
| score MIME_QP_LONG_LINE 0.1 | |||
| # SMTP senders *have* dynamic IP addresses | |||
| # A.B.C.D.dnsbl.sorbs.net -> 127.0.0.10 | |||
| score RCVD_IN_DYNABLOCK 0 | |||
| score HELO_DYNAMIC_IPADDR 0.3 | |||
| score RCVD_IN_SORBS 0.1 | |||
| score RCVD_IN_PBL 0.1 | |||
| score RCVD_IN_SORBS_DUL 0 | |||
| # old bug... | |||
| score FH_DATE_PAST_20XX 0.0 | |||
| ~~~ | |||
| ### AWL : AutoWhiteList | |||
| SpamAssassin a un puissant outil d’AWL si l’on définit bien une liste d’emails / expéditeurs avant de l’initialiser. | |||
| Néanmoins, il faut le maintenir. | |||
| Pour lister sa whitelist (couple email / 2 1er octets de l’IP) | |||
| ~~~ | |||
| # sa-awl /var/spool/spam/auto_whitelist | |||
| AVG (TOTSCORE/COUNT) -- EMAIL|ip=IPBASE | |||
| AVG est le score moyen | |||
| TOTSCORE est le score total des mails | |||
| COUNT est le nombre de mails | |||
| ~~~ | |||
| Pour supprimer les entrées “vues” moins de 2 fois : | |||
| ~~~ | |||
| # sa-awl --clean --min 2 /var/spool/spam/auto_whitelist | |||
| ~~~ | |||
| Pour supprimer des entrées particulières : | |||
| ~~~ | |||
| # spamassassin --remove-addr-from-whitelist=foo@bar | |||
| SpamAssassin auto-whitelist: removing address: foo@bar | |||
| ~~~ | |||
| ## Administration | |||
| ### Whitelist / blacklist | |||
| Par utilisateur (`~/.spamassassin/user_prefs`) ou global : | |||
| ~~~ | |||
| whitelist_from jdoe@example.org | |||
| whitelist_from *@example.com | |||
| blacklist_from bad@example.net | |||
| ~~~ | |||