LINUX.ORG.RU
ФорумAdmin

Centos, Exim. Как увеличить очки Spam вместо дропа, согласно конфига.

 , , , ,


0

1
code

Собственно есть почтовый сервер на базе vestacp :)

exim.conf

SPAMASSASSIN = yes
SPAM_SCORE = 50
CLAMD =  yes

domainlist local_domains = dsearch;/etc/exim/domains/
domainlist relay_to_domains = dsearch;/etc/exim/domains/
hostlist relay_from_hosts = 127.0.0.1
hostlist whitelist = net-iplsearch;/etc/exim/white-blocks.conf
hostlist spammers = net-iplsearch;/etc/exim/spam-blocks.conf
addresslist whitelist_mail = wildlsearch;/etc/exim/white-mail.conf
no_local_from_check
untrusted_set_sender = *
acl_smtp_connect = acl_check_spammers
acl_smtp_mail = acl_check_mail
acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data
#acl_smtp_mime = acl_check_mime

.ifdef SPAMASSASSIN
spamd_address = 127.0.0.1 783
.endif

.ifdef CLAMD
av_scanner = clamd: /var/run/clamav/clamd.sock
.endif

######################################################################
#                       ACL CONFIGURATION                            #
#         Specifies access control lists for incoming SMTP mail      #
######################################################################
begin acl

acl_check_spammers:
  accept  hosts         = +whitelist

  drop    message       = Your host [$sender_host_address] in blacklist spam-blocks on this server.
          log_message   = Host [$sender_host_address] [$sender_host_name] in blacklist. spam-blocks.conf.
          hosts         = +spammers

  accept

acl_check_mail:
  deny    condition     = ${if eq{$sender_helo_name}{}}
          message       = HELO required before MAIL

  drop    message       = Helo name contains a ip address (HELO was $sender_helo_name) and not is valid
          condition     = ${if match{$sender_helo_name}{\N((\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3})|([0-9a-f]{8})|([0-9A-F]{8}))\N}{yes}{no}}
          condition     = ${if match {${lookup dnsdb{>: defer_never,ptr=$sender_host_address}}\}{$sender_helo_name}{no}{yes}}
          delay         = 45s

  drop    condition     = ${if isip{$sender_helo_name}}
          message       = Access denied - Invalid HELO name (See RFC2821 4.1.3)

  drop    condition     = ${if eq{[$interface_address]}{$sender_helo_name}}
          message       = $interface_address is _my_ address

  accept


acl_check_rcpt:
  accept  hosts         = :

  deny    message       = Restricted characters in address
          domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  deny    message       = Restricted characters in address
          domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  require verify        = sender

  accept  hosts         = +relay_from_hosts
          control       = submission

  accept  authenticated = *
          control       = submission/domain=

  warn    message       = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text (dnsbl)
          log_message   = [$sender_host_address] [$sender_host_name] is in a black list (dnsbl.conf) at $dnslist_domain\n$dnslist_text (dnsbl)
          hosts         = !+whitelist
          dnslists      = ${readfile {/etc/exim/dnsbl.conf}{:}}

  require message       = relay not permitted
          domains       = +local_domains : +relay_to_domains

  deny    message       = smtp auth requried
         sender_domains = +local_domains
         !authenticated = *

  require verify        = recipient



.ifdef CLAMD
  warn    set acl_m0    = no

  warn    condition     = ${if exists {/etc/exim/domains/$domain/antivirus}{yes}{no}}
          set acl_m0    = yes
.endif

.ifdef SPAMASSASSIN
  warn    set acl_m1    = no

  warn    condition     = ${if exists {/etc/exim/domains/$domain/antispam}{yes}{no}}
          set acl_m1    = yes
.endif

  accept


acl_check_data:
.ifdef CLAMD
  deny   message        = Message contains a virus ($malware_name) and has been rejected
         malware        = *
         condition      = ${if eq{$acl_m0}{yes}{yes}{no}}
.endif

.ifdef SPAMASSASSIN
  warn   !authenticated = *
         hosts          = !+relay_from_hosts
         condition      = ${if < {$message_size}{100K}}
         condition      = ${if eq{$acl_m1}{yes}{yes}{no}}
         spam           = spamd:true/defer_ok
         add_header     = X-Spam-Score: $spam_score_int
         add_header     = X-Spam-Bar: $spam_bar
         add_header     = X-Spam-Report: $spam_report
         set acl_m2     = $spam_score_int

  warn   condition      = ${if !eq{$acl_m2}{} {yes}{no}}
         condition      = ${if >{$acl_m2}{SPAM_SCORE} {yes}{no}}
         add_header     = X-Spam-Status: Yes
         message        = SpamAssassin detected spam (from $sender_address to $recipients).
.endif

#acl_check_mime:
#  warn   message        = Blacklisted file extension detected
#         condition      = ${if match {${lc:$mime_filename}}{\N(\.ade|\.adp|\.bat|\.chm|\.cmd|\.com|\.cpl|\.exe|\.hta|\.ins|\.isp|\.jse|\.lib|\.lnk|\.mde|\.msc|\.msp|\$
#
#  accept


В файле spam-blocks.conf список айпи серверов, с которых идет постоянный спам. Также подключен - dnsbl.conf

При получении писем с серверов из списка, они дропаются, с обратным уведомлением.

Прошу помочь поправить конфиг так, что бы вместо дропа, просто увеличивалось Spam Score, например из спсика днсблок на +100, а из собственного списка на +1000. Таким образом, я предполагаю что dovecot будет помещать такие письма в папку спам, пользователей.



Последнее исправление: blqs (всего исправлений: 3)
 warn    message       = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text (dnsbl)
          log_message   = [$sender_host_address] [$sender_host_name] is in a black list (dnsbl.conf) at $dnslist_domain\n$dnslist_text (dnsbl)
          hosts         = !+whitelist
          dnslists      = ${readfile {/etc/exim/dnsbl.conf}{:}}
          set acl_m0    = ${eval:$acl_m0+2}
add_header    = X-DNSBL: listed $dnslist_domain

вот эта строчка set acl_m0 = ${eval:$acl_m0+2} увеличавает score на 2

anonymous
()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.