Forum Debian Users Gang

markus78 · 2008-03-26 20:28:04

zainstalowałem Postfixa + mysql z wirtualnymi userami (wg opisu z howtoforge.com) + clamav + dspama i wszystko działa poprawnie ale Dspam wpuszcza wszystkie wiadomości. Każdy spam wchodzi na skrzynki userów. Jak go odfiltrować? W logach mam że poczta jest dostarczana bez problemów, dspam i clamav też w logach nie generuje żadnych błędów. Moje configi wyglądają tak:

/etc/dspam/dspam.conf

Kod:

Home /var/spool/dspam
StorageDriver /usr/lib/dspam/libhash_drv.so

TrustedDeliveryAgent "/usr/bin/procmail"

DeliveryHost        127.0.0.1
DeliveryPort        10026
DeliveryIdent       localhost
DeliveryProto       SMTP

OnFail error

Trust root
Trust dspam
Trust mail
Trust mailnull 
Trust smmsp
Trust daemon

TrainingMode teft
TestConditionalTraining on

Algorithm graham burton

PValue graham

Preference "spamAction=tag"
Preference "signatureLocation=message"
Preference "showFactors=on"
Preference "spamAction=tag"
Preference "spamSubject=SPAM"

AllowOverride trainingMode
AllowOverride spamAction spamSubject
AllowOverride statisticalSedation
AllowOverride enableBNR
AllowOverride enableWhitelist
AllowOverride signatureLocation
AllowOverride showFactors
AllowOverride optIn optOut
AllowOverride whitelistThreshold

HashRecMax 98317
HashAutoExtend on
HashMaxExtents 0
HashExtentSize 49157
HashMaxSeek 100
HashConnectionCache 10

Notifications off

PurgeSignatures 14         
PurgeNeutral  90 
PurgeUnused  90 
PurgeHapaxes 30  
PurgeHits1S 15
PurgeHits1I 15

LocalMX 127.0.0.1

SystemLog on
UserLog   on

Opt out 

TrackSources spam virus

ParseToHeaders on
ChangeModeOnParse on
ChangeUserOnParse off

ClamAVPort    3310
ClamAVHost    127.0.0.1
ClamAVResponse    reject

ServerPID              /var/run/dspam.pid
ServerMode auto
ServerPass.Relay1    "secret"
ServerParameters    "--deliver=innocent"
ServerIdent        "localhost.localdomain"
ServerDomainSocketPath  "/var/spool/postfix/var/run/dspam.sock"
ClientIdent    "secret@Relay1"
ProcessorBias on
Include /etc/dspam/dspam.d/

/etc/dspam/dspam.d/mysql.conf:

Kod:

MySQLServer localhost
MySQLPort     3306
MySQLUser userdobazy
MySQLPass haslodobazy
MySQLDb    db_dspam

MySQLVirtualTable          dspam_virtual_uids
MySQLVirtualUIDField       uid
MySQLVirtualUsernameField  username

/etc/clamav/clamd.conf:

Kod:

TCPSocket 3310
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveMaxRecursion 5
ArchiveMaxFiles 1000
ArchiveMaxFileSize 10M
ArchiveMaxCompressionRatio 250
ArchiveLimitMemoryUsage false
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
StreamMaxLength 10M
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
TemporaryDirectory /tmp
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
MailFollowURLs false
ArchiveBlockMax false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
MailMaxRecursion 64
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0

natomiast w nagłówku tej poczty spamu która wchodzi na skrzynki mam wpisy:

Kod:

X-DSPAM-Result: Innocent
X-DSPAM-Processed: Wed Mar 26 06:53:29 2008
X-DSPAM-Confidence: 0.9899
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 47e9e4d930329592316553

a w treści maila jest w stopce:
!DSPAM:47e9e4d930329592316553!

baza MySQL db_dspam jest pusta - może coś trzeba do niej dograć jakies definicje, a może coś mam w configach źle?
pozdr. Marcin

markus78 · 2008-03-26 21:18:51

może trzeba go nauczyć, ale nie wiem jak to zrobić?

Forum Debian Users Gang

Ogłoszenie

#1 2008-03-26 20:28:04

markus78 - Użytkownik

dspm i filtrowanie poczty

Kod:

Kod:

Kod:

Kod:

#2 2008-03-26 21:18:51

markus78 - Użytkownik

Re: dspm i filtrowanie poczty

Stopka forum