主页 / server / 问题 / 619537
Accepted
Alexander Farber
Asked: 2014-08-12 04:35:01 +0800 CST

在 CentOS 6 上使用 postfix 和 spamassassin 包拒绝垃圾邮件 - 无需自定义用户和脚本

  • 772

这是我在 CentOS 6.5 Linux 服务器上尝试的内容：

  1. 安装了 postfix 和 spamassassin 软件包
  2. 已配置的 Postfix - 它运行良好（我在此省略详细信息）
  3. 添加-x到/etc/sysconfig/spamassassin中的 SPAMDOPTIONS
  4. 将以下 2 行添加到/etc/postfix/master.cf

这里：

smtp         inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

不幸的是，当我发送带有主题的测试垃圾邮件时

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

它仍然通过！（并且主题没有被重写 - 尽管rewrite_header Subject [SPAM]在未修改的/etc/mail/spamassassin/local.cf文件中）。

我想知道，我错过了什么？我的/var/log/maillog如下：

postfix/postfix-script[2546]: starting the Postfix mail system
postfix/master[2547]: daemon started -- version 2.6.6, configuration /etc/postfix
postfix/qmgr[2550]: D5B19807033: from=<[email protected]>, size=1843, nrcpt=1 (queue active)
postfix/qmgr[2550]: 831CA809733: from=<[email protected]>, size=41369, nrcpt=1 (queue active)
postfix/qmgr[2550]: 42B7A80A312: from=<[email protected]>, size=4399, nrcpt=1 (queue active)
postfix/qmgr[2550]: AED94809D29: from=<[email protected]>, size=28035, nrcpt=1 (queue active)
postfix/qmgr[2550]: E69AA809D3C: from=<>, size=3487, nrcpt=1 (queue active)
postfix/qmgr[2550]: 2BDE980A61B: from=<[email protected]>, size=4073, nrcpt=1 (queue active)
postfix/qmgr[2550]: 0D37280A51F: from=<[email protected]>, size=7888, nrcpt=1 (queue active)
postfix/smtp[2552]: D5B19807033: host gmail-smtp-in.l.google.com[74.125.136.27] said: 421-4.7.0 [144.76.184.154      15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. l16si23407549wjr.0 - gsmtp (in reply to end of DATA command)
postfix/smtp[2552]: D5B19807033: to=<[email protected]>, orig_to=<[email protected]>, relay=alt1.gmail-smtp-in.l.google.com[74.125.25.27]:25, delay=6325, delays=6323/0/1.2/0.61, dsn=4.7.0, status=deferred (host alt1.gmail-smtp-in.l.google.com[74.125.25.27] said: 421-4.7.0 [144.76.184.154      15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. f7si4794087pdm.22 - gsmtp (in reply to end of DATA command))
postfix/smtpd[2557]: connect from mail-ie0-f180.google.com[209.85.223.180]
postfix/smtpd[2557]: B3FFF809367: client=mail-ie0-f180.google.com[209.85.223.180]
postfix/cleanup[2561]: B3FFF809367: message-id=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>
postfix/qmgr[2550]: B3FFF809367: from=<[email protected]>, size=1767, nrcpt=1 (queue active)
spamd[2034]: spamd: connection from localhost [127.0.0.1] at port 42928
spamd[2034]: spamd: setuid to nobody succeeded
spamd[2034]: spamd: processing message <CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com> for nobody:99
postfix/smtpd[2557]: disconnect from mail-ie0-f180.google.com[209.85.223.180]
spamd[2034]: spamd: identified spam (999.9/5.0) for nobody:99 in 0.2 seconds, 1730 bytes.
spamd[2034]: spamd: result: Y 999 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,GTUBE,HTML_MESSAGE,T_TO_NO_BRKTS_FREEMAIL scantime=0.2,size=1730,user=nobody,uid=99,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=42928,mid=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>,autolearn=no
postfix/pickup[2549]: 3124F80A3DA: uid=99 from=<[email protected]>
postfix/cleanup[2561]: 3124F80A3DA: message-id=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>
postfix/pipe[2562]: B3FFF809367: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.59, delays=0.37/0.01/0/0.22, dsn=2.0.0, status=sent (delivered via spamassassin service)
postfix/qmgr[2550]: B3FFF809367: removed
spamd[2032]: prefork: child states: II
postfix/qmgr[2550]: 3124F80A3DA: from=<[email protected]>, size=2843, nrcpt=1 (queue active)
centos

2 个回答

  1. 好的，所以基本上，您将电子邮件通过管道发送到 spamc，然后让 spamc 将输出通过电子邮件发送给收件人（嗯，实际上是重新邮寄给发件人，但我认为目的是重新邮寄给收件人）..

    没有冒犯，但这很疯狂。

    如果您希望根据 SA 分数拒绝邮件，您将需要一个 milter 或策略守护程序来执行此操作。Spamassassin 不会拒绝邮件，它只会给它打分。Avamisd-new 或 spamass-milter 可以为您工作。

    至于为什么 spamassassin 不重写，它可能只是没有将修改后的电子邮件版本发送到您期望的位置。

    原始 QueueID 是3124F80A3DA. Spamassassin 将其作为 QueueIDB3FFF809367 重新邮寄给发件人！

    查看日志转储的其余部分，您似乎正在处理所有传入的垃圾邮件 - 由于它的数量，Gmail 甚至“推迟”了您的 IP。

    不要重新发明轮子并在此过程中意外被列入黑名单。您想根据 SA 分数拒绝传入的垃圾邮件，使用 milter 或策略守护程序。

    • 1
  2. Best Answer

    我的问题的重点（也许我说得不够清楚）是：如何在 CentOS上以最小的努力结合 Postfix 和 Spamassassin 。

    这是我的解决方案，只需 5 个步骤：

    1. yum install spamassassin

    2. chkconfig spamassassin on

    3. useradd spam（不能省略这一步！）

    4. 添加/^Subject: \[SPAM\]/ DISCARD到/etc/postfix/header_checks（请查阅/etc/mail/spamassassin/local.cf以获取要匹配的确切字符串）

    5. 将以下 2 行添加到/etc/postfix/master.cf：

    spam（注意步骤 2中新用户的用法）：

    smtp         inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=spam argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

    最后重启postfix和spamassassin服务。

    使用 GTUBE 主题向自己发送测试垃圾邮件：

    XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

    查看/var/log/maillog中丢弃的邮件：

    postfix/smtpd[2048]: connect from mail-ig0-f176.google.com[209.85.213.176]
postfix/smtpd[2048]: 333F28007C1: client=mail-ig0-f176.google.com[209.85.213.176]
postfix/cleanup[2052]: 333F28007C1: message-id=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>
postfix/qmgr[2037]: 333F28007C1: from=<[email protected]>, size=1883, nrcpt=1 (queue active)
spamd[1643]: spamd: connection from localhost [127.0.0.1] at port 53400
spamd[1643]: spamd: setuid to spam succeeded
spamd[1643]: spamd: processing message <CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com> for spam:502
postfix/smtpd[2048]: disconnect from mail-ig0-f176.google.com[209.85.213.176]
spamd[1643]: spamd: identified spam (999.9/5.0) for spam:502 in 0.1 seconds, 1846 bytes.
spamd[1643]: spamd: result: Y 999 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,GTUBE,HTML_MESSAGE scantime=0.1,size=1846,user=spam,uid=502,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=53400,mid=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>,autolearn=no
postfix/pickup[2036]: 92AE8809366: uid=502 from=<[email protected]>
postfix/cleanup[2052]: 92AE8809366: message-id=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>
postfix/cleanup[2052]: 92AE8809366: discard: header Subject: [SPAM] XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X from local; from=<[email protected]> to=<[email protected]>
postfix/pipe[2053]: 333F28007C1: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.51, delays=0.35/0.01/0/0.15, dsn=2.0.0, status=sent (delivered via spamassassin service)
postfix/qmgr[2037]: 333F28007C1: removed
spamd[1642]: prefork: child states: II
    • -1

相关问题