在 CentOS 6 上使用 postfix 和 spamassassin 包拒绝垃圾邮件 - 无需自定义用户和脚本

在 CentOS 6 上使用 postfix 和 spamassassin 包拒绝垃圾邮件 - 无需自定义用户和脚本

以下是我在 CentOS 6.5 Linux 服务器上尝试的操作:

  1. 安装了 postfix 和 spamassassin 包
  2. 配置 Postfix - 运行良好(我在这里省略详细信息)
  3. 已添加-x到 SPAMDOPTIONS 中/etc/sysconfig/spamassassin
  4. /etc/postfix/master.cf

这里:

smtp         inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=nobody argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

不幸的是,当我发送主题为

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

它仍然会通过!(主题没有被重写——尽管rewrite_header Subject [SPAM]在未经修改的/etc/mail/spamassassin/local.cf文件)。

我想知道,我错过了什么?我的/var/log/邮件日志在下面:

postfix/postfix-script[2546]: starting the Postfix mail system
postfix/master[2547]: daemon started -- version 2.6.6, configuration /etc/postfix
postfix/qmgr[2550]: D5B19807033: from=<[email protected]>, size=1843, nrcpt=1 (queue active)
postfix/qmgr[2550]: 831CA809733: from=<[email protected]>, size=41369, nrcpt=1 (queue active)
postfix/qmgr[2550]: 42B7A80A312: from=<[email protected]>, size=4399, nrcpt=1 (queue active)
postfix/qmgr[2550]: AED94809D29: from=<[email protected]>, size=28035, nrcpt=1 (queue active)
postfix/qmgr[2550]: E69AA809D3C: from=<>, size=3487, nrcpt=1 (queue active)
postfix/qmgr[2550]: 2BDE980A61B: from=<[email protected]>, size=4073, nrcpt=1 (queue active)
postfix/qmgr[2550]: 0D37280A51F: from=<[email protected]>, size=7888, nrcpt=1 (queue active)
postfix/smtp[2552]: D5B19807033: host gmail-smtp-in.l.google.com[74.125.136.27] said: 421-4.7.0 [144.76.184.154      15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. l16si23407549wjr.0 - gsmtp (in reply to end of DATA command)
postfix/smtp[2552]: D5B19807033: to=<[email protected]>, orig_to=<[email protected]>, relay=alt1.gmail-smtp-in.l.google.com[74.125.25.27]:25, delay=6325, delays=6323/0/1.2/0.61, dsn=4.7.0, status=deferred (host alt1.gmail-smtp-in.l.google.com[74.125.25.27] said: 421-4.7.0 [144.76.184.154      15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. f7si4794087pdm.22 - gsmtp (in reply to end of DATA command))
postfix/smtpd[2557]: connect from mail-ie0-f180.google.com[209.85.223.180]
postfix/smtpd[2557]: B3FFF809367: client=mail-ie0-f180.google.com[209.85.223.180]
postfix/cleanup[2561]: B3FFF809367: message-id=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>
postfix/qmgr[2550]: B3FFF809367: from=<[email protected]>, size=1767, nrcpt=1 (queue active)
spamd[2034]: spamd: connection from localhost [127.0.0.1] at port 42928
spamd[2034]: spamd: setuid to nobody succeeded
spamd[2034]: spamd: processing message <CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com> for nobody:99
postfix/smtpd[2557]: disconnect from mail-ie0-f180.google.com[209.85.223.180]
spamd[2034]: spamd: identified spam (999.9/5.0) for nobody:99 in 0.2 seconds, 1730 bytes.
spamd[2034]: spamd: result: Y 999 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,GTUBE,HTML_MESSAGE,T_TO_NO_BRKTS_FREEMAIL scantime=0.2,size=1730,user=nobody,uid=99,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=42928,mid=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>,autolearn=no
postfix/pickup[2549]: 3124F80A3DA: uid=99 from=<[email protected]>
postfix/cleanup[2561]: 3124F80A3DA: message-id=<CAADeyWgi9VjXoXoUXtTf0n4jp_WJzMd2q7C7zqkRpK7=eKhNGQ@mail.gmail.com>
postfix/pipe[2562]: B3FFF809367: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.59, delays=0.37/0.01/0/0.22, dsn=2.0.0, status=sent (delivered via spamassassin service)
postfix/qmgr[2550]: B3FFF809367: removed
spamd[2032]: prefork: child states: II
postfix/qmgr[2550]: 3124F80A3DA: from=<[email protected]>, size=2843, nrcpt=1 (queue active)

答案1

好的,基本上,您将电子邮件传送到 spamc,然后让 spamc 将输出通过电子邮件发送给收件人(嗯,实际上是重新发送给发件人,但我认为意图是重新发送给收件人)..

无意冒犯,但这太疯狂了。

如果您希望根据 SA 分数拒绝邮件,则需要一个 milter 或策略守护进程来执行此操作。Spamassassin 不会拒绝邮件,它只会对邮件进行评分。Avamisd-new 或 spamass-milter 可能适合您。

至于为什么 spamassassin 没有重写,很可能是这样的,它只是没有将修改后的电子邮件版本发送到您期望的位置。

原始 QueueID 是3124F80A3DA。Spamassassin 将其重新发送为 QueueIDB3FFF809367 退回给发件人!

查看其余的日志转储,似乎您对所有传入的垃圾邮件都执行了此操作 - 并且 Gmail 甚至会因为垃圾邮件的数量而“推迟”您的 IP。

不要重新发明轮子,以免在此过程中意外被列入黑名单。你想拒绝根据 SA 分数识别传入的垃圾邮件,使用筛选器或策略守护进程。

答案2

我的问题(可能我没有表达清楚)的重点是:如何在 CentOS 上结合 Postfix 和 Spamassassin尽量少用

这是我的解决方案,仅需 5 个步骤:

  1. yum install spamassassin

  2. chkconfig spamassassin on

  3. useradd spam(你不能省略这个步骤!)

  4. 添加/^Subject: \[SPAM\]/ DISCARD/etc/postfix/header_checks(咨询/etc/mail/spamassassin/local.cf精确匹配的字符串)

  5. 添加以下两行到/etc/postfix/master.cf

spam(注意第 2 步中新用户的使用情况):

smtp         inet n - n - - smtpd -o content_filter=spamassassin
spamassassin unix - n n - - pipe user=spam argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

最后重新启动后缀垃圾邮件刺客服务。

使用 GTUBE 主题向自己发送测试垃圾邮件:

XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

查看被丢弃的邮件/var/log/邮件日志

postfix/smtpd[2048]: connect from mail-ig0-f176.google.com[209.85.213.176]
postfix/smtpd[2048]: 333F28007C1: client=mail-ig0-f176.google.com[209.85.213.176]
postfix/cleanup[2052]: 333F28007C1: message-id=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>
postfix/qmgr[2037]: 333F28007C1: from=<[email protected]>, size=1883, nrcpt=1 (queue active)
spamd[1643]: spamd: connection from localhost [127.0.0.1] at port 53400
spamd[1643]: spamd: setuid to spam succeeded
spamd[1643]: spamd: processing message <CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com> for spam:502
postfix/smtpd[2048]: disconnect from mail-ig0-f176.google.com[209.85.213.176]
spamd[1643]: spamd: identified spam (999.9/5.0) for spam:502 in 0.1 seconds, 1846 bytes.
spamd[1643]: spamd: result: Y 999 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,GTUBE,HTML_MESSAGE scantime=0.1,size=1846,user=spam,uid=502,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=53400,mid=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>,autolearn=no
postfix/pickup[2036]: 92AE8809366: uid=502 from=<[email protected]>
postfix/cleanup[2052]: 92AE8809366: message-id=<CAADeyWiTN=Nfmd6Z6P92arctGjZcRgrRtgt3r9TAU+a-=8CGug@mail.gmail.com>
postfix/cleanup[2052]: 92AE8809366: discard: header Subject: [SPAM] XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X from local; from=<[email protected]> to=<[email protected]>
postfix/pipe[2053]: 333F28007C1: to=<[email protected]>, orig_to=<[email protected]>, relay=spamassassin, delay=0.51, delays=0.35/0.01/0/0.15, dsn=2.0.0, status=sent (delivered via spamassassin service)
postfix/qmgr[2037]: 333F28007C1: removed
spamd[1642]: prefork: child states: II

相关内容