乌秋博客
梦想在左,生活在右。   

Sendmail+SpamAssassin+MIMEDefang处理垃圾邮件
安装SpamAssassin和MIMEDefang需要很多附加软件支持,可以到 http://search.cpan.org 搜索下载

一、安装SpamAssassin
# groupadd spamd
# useradd -g spamd -s /bin/false spamd
# tar xzvf Mail-SpamAssassin-3.0.2.tar.gz
# cd Mail-SpamAssassin-3.0.2
# export LC_ALL=C
# perl Makefile.PL
# make
# make install
# cp spamd/redhat-rc-script.sh /etc/rc.d/init.d/spamd
# chmod 755 /etc/rc.d/init.d/spamd
# chkconfig --add spamd
# vi /etc/rc.d/init.d/spamd

SPAMDOPTIONS="-d -c -u spamd -H /home/spamd -m5"


# vi /etc/mail/spamassassin/local.cf (我的local.cf)

# These values can be overridden by editing ~/.spamassassin/user_prefs.cf
# (see spamassassin(1) for details)

# These should be safe assumptions and allow for simple visual sifting
# without risking lost emails.

required_hits 5.5
rewrite_subject 1
rewrite_header Subject *****SPAM*****
report_safe 1
defang_mime 0
rewrite_subject 1
report_header 1
use_terse_report 1
whitelist_from *@quickmail.51job.com
whitelist_from *@gmail.com
#whitelist_from *@163.com
whitelist_from *@sina.com
whitelist_from *@126.com
whitelist_from *@21cn.com
whitelist_from *@qq.com
whitelist_from *@tom.com
whitelist_from *@yahoo.com.cn
whitelist_from *@hotmail.com
whitelist_from *@sky.net.cn
whitelist_from *@gddc.com.cn
whitelist_from *@sharebank.com.cn
whitelist_from *@pcsoft.com.cn
whitelist_from *@igrand.cn
whitelist_from *@iresearch.cn

use_bayes 1
auto_learn 1
skip_rbl_checks 1
use_razor2 0
use_dcc 0
use_pyzor 0

score SUBJ_FULL_OF_8BITS 0.0
score BASE64_ENC_TEXT 0.0
score BAYES_99 0.1
score BAYES_90 0.1
score BAYES_80 0.1
score BAYES_70 0.1
score BAYES_60 0.1
score FROM_ILLEGAL_CHARS 0.1
score HEAD_ILLEGAL_CHARS 0.1
score SUBJ_ILLEGAL_CHARS 0.1
score MIME_BASE64_TEXT 0.1
score FAKE_HELO_AOL 0.1
score NO_RDNS_DOTCOM_HELO 0.1
score MIME_HTML_ONLY 0.1
score SUBJ_HAS_UNIQ_ID 0.1
score HTML_SHORT_COMMENT 0.5
score MISSING_SUBJECT 0.1
score RCVD_DOUBLE_IP_SPAM 2.0

score BAYES_99 0 0 2.700 2.000
score BAYES_50 0.2
score BAYES_56 0.2
score ADDR_NUMS_AT_BIGSITE 0.522 0.362 .543 0.699
score FROM_ENDS_IN_NUMS 0.999 0.869 0.677 0.594
score FROM_WEBMAIL_END_NUMS6 0.489 1.062 0.809 1.399
score FROM_NUM_AT_WEBMAIL 0.506 0.501 2.100 2.100
score HTML_20_30 0.691 0.474 1.572 1
score HTML_30_40 0.837 0.809 1.919 1
score HTML_40_50 0.870 0.474 1.898 1
score HTML_50_60 0.699 0.183 1.514 2.100
score HTML_60_70 0.359 0.100 1.516 2.113
score HTML_70_80 0.383 0.105 1.305 2.100
score HTML_80_90 0.014 0 1 1
score HTML_90_100 0.308 1.073 1.5 2.187
score HTML_FONTCOLOR_BLUE 1.100
score HTML_FONT_BIG 0.571 0.500 0.570 0.567
score HTML_MESSAGE 0.5

ok_locales en zh


#邮件主题全英文
header __EIS_RULE_SUBJECT_WITH_CHN Subject =~ /[\x80-\xff][\x80-\xff]/
meta EIS_RULE_SUBJECT_NO_CHN !__EIS_RULE_SUBJECT_WITH_CHN
describe EIS_RULE_SUBJECT_NO_CHN EIS_RULE_SUBJECT_NO_CHN
score EIS_RULE_SUBJECT_NO_CHN 5

#邮件正文全英文
body __EIS_RULE_BODY_WITH_CHN /[\x80-\xff][\x80-\xff]/
meta EIS_RULE_BODY_NO_CHN !__EIS_RULE_BODY_WITH_CHN
describe EIS_RULE_BODY_NO_CHN EIS_RULE_BODY_NO_CHN
score EIS_RULE_BODY_NO_CHN 3


进行一个spam和non-spam的测试
# spamassassin -t < sample-spam.txt > spamtest.txt
# less spamtest.txt
# spamassassin -t < sample-nonspam.txt > nospamtest.txt
# less nospamtest.txt

spamtest.txt文件在主题一段中将包含"*****SPAM*****" 这一行, 而nospamtest.txt文件中则没有.

建立SpamAssassin的学习系统
# sa-learn --rebuild -D -p user_prefs
# sa-learn --dump all (可以查看自学习的数据信息)


修改openwebmail配置:
spamcheck_pipe /usr/bin/spamc -c -x -t60 -u @@@USERNAME@@@



二、安装MIME-tools

# wget http://www.mimedefang.org/static/MIME-tools-5.420.tar.gz
# tar xzvf MIME-tools-5.420.tar.gz
# cd MIME-tools-5.420
# perl Makefile.PL
# make
# make install


三、安装MIMEDefang
# wget http://cpan.linuxforum.net/authors/id/D/DS/DSKOLL/IO-stringy-2.110.tar.gz
# wget http://search.cpan.org/CPAN/authors/id/M/MA/MARKOV/MailTools-1.77.tar.gz
# wget http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/MIME-Base64-3.07.tar.gz (我的系统需要安装此3个附加软件)
# wget http://www.mimedefang.org/static/mimedefang-2.63.tar.gz
# tar xzvf mimedefang-2.63.tar.gz
# cd mimedefang-2.63
# ./configure
# useradd defang
# make
# make install
# cp examples/init-script /etc/init.d/ (redhat系统是 redhat/mimedefang-init)

# vi /etc/mail/sendmail.cf
# Input mail filters
O InputMailFilters=mimedefang

######################################################################
######################################################################
#####
##### MAIL FILTER DEFINITIONS
#####
######################################################################
######################################################################
Xmimedefang, S=unix:/var/spool/MIMEDefang/mimedefang.sock, F=,T=S:60s;R:60s;E:60s


# service sendmail restart
# wget -N -P /usr/share/spamassassin/ www.ccert.edu.cn/spam/sa/Chinese_rules.cf
# vi /etc/init.d/mimedefang-init

MX_USER="defang" #否则不能启动


# vi /etc/procmailrc

# 启动SpamAssassin系統, filter all incoming mail through SpamAssassin and tags probable spam with a unique header
# 小于100K的信件要执行检查, 超过直接放过他!
#### 如果看到是被打上Spam字样,就送入垃圾信箱
#SHELL=/bin/sh
LOGFILE=/var/log/procmail.log #如果启用这个,就是加日志功能
MAILDIR=/var/mail
VERBOSE=off
PATH=/bin:/sbin:/usr/bin:/usr/sbin/:/usr/local/bin:/usr/local/sbin
LOGFILE=/var/log/procmail.log
:0fw: spamassassin.lock
* < 100000 #
| /usr/bin/spamassassin #仅检查100K以内的邮件

:0:
* ^X-Spam-Flag: Yes
$HOME/mail/spam-mail


# /etc/init.d/spamd start
# /etc/init.d/mimedefang-init start


/etc/init.d/mimedefang-init: line 163: mimedefang.pl: command not found
#BUG FIX FOR REDHAT INIT SCRIPT:
# The configtest procedure in the redhat init script is needs $PROGDIR
# prepended in case mimedefang.pl isn't in the path:

# e.g., line 163 should read:

$PROGDIR/mimedefang.pl $([ -n "$SUBFILTER" ] && echo "-f $SUBFILTER") -test > /var/spool/MIMEDefang/configtest.out 2>&1

观察系统日志统计
mailstat -km /var/log/procmail.log
  - m 合并错误至同一行(会删除原记录,重新计算)
  - l 增加统计平均每人邮件大小,(会删除原记录,重新计算)
  - k 保持原来的log檔
  - o 使用旧的统计数据文件
  - t 没有总统计资料

定期下载中国反垃圾邮件联盟的过滤文件:
0 0 1 * * wget -N -P /usr/share/spamassassin http://www.ccert.edu.cn/spam/sa/Chinese_rules.cf;/etc/init.d/mimedefang-init restart

本站原创,转载请注明版权!

参考资料:
http://kb.discuz.net/index.php?title=Qmail%E6%90%AD%E5%BB%BA%E5%85%A8%E6%94%BB%E7%95%A5#SpamAssassin
http://blog.zhangjianfeng.com/?p=460
posted at 07/10/24 16:06 | 开发手记 - 工作日志 | 浏览(110) | 引用 | 评论

 Track this back : http://www.koven.org/rserver.php?mode=tb&sl=306
  name   password   homepage
隐藏评论(只有管理员可见)    


      << prev    1  ...  260  261  262  263  264  265  266  267  268  ...  336    next >>