Exim + Spamassassin. Есть вопросик.

[Satyr]

Всем привет!

Стоит

Код: Выделить всё

exim-4.69

и

Код: Выделить всё

spamassassin -V
SpamAssassin version 3.2.5
  running on Perl version 5.8.8

Так вот всё вроде работает нормально, за исключением того, что прорывается немного спама, причём из заголовков видно, что письмо не проверялось асасином.

Например:

Код: Выделить всё

Envelope-to: ivanov@domain.ru
Delivery-date: Fri, 24 Oct 2008 13:40:54 +0400
Received: from [121.247.127.243] (helo=mail02.wxs.nl)
        by mx.domain.ru with esmtp (Exim 4.69 (FreeBSD))
        (envelope-from <rjono@emcal.de>)
        id 1KtJA3-0005Kn-Jr
        for ivanov@damain.ru; Fri, 24 Oct 2008 13:40:54 +0400
Received: from [192.168.21.15] ([192.168.21.15]) by 121.247.127.243 with Microsoft SMTPSVC(6.0.3790.1830)
  6 Jan 2002 15:40:45 +0400
From: =?windows-1251?B?yOPu8Pw=?= <rjono@emcal.de>
To: =?windows-1251?B?wuDr5e3y6O0=?= <ivanov@domain.ru>
Subject: =?windows-1251?B?zuH78eog7+7s5fnl7ejpIOgg8vDg7fHv7vDy7fv1IPHw5eTx8uIg4g==?=
        =?windows-1251?B?IPDg7Org9SDw4PHx6+Xk7uLg7ej/IPPj7uvu4u3u4+4g5OXr4A==?=
Date: 6 Jan 2002 15:40:45 +0400
MIME-Version: 1.0
Content-Type: text/plain;
        charset="windows-1251"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MimeOLE: Produced By Microsoft Exchange V6.5
X-SpamTest-Version: SMTP-Filter Version 3.0.0 [0274], KAS30/Release
X-SpamTest-Info: Not protected
X-Spam: Not detected

или

Код: Выделить всё

Envelope-to: petrov@domain.ru
Delivery-date: Fri, 24 Oct 2008 16:34:37 +0400
Received: from [90.150.43.160] (helo=user)
        by mx.domain.ru with esmtp (Exim 4.69 (FreeBSD))
        (envelope-from <linleibbrandtmet@leibbrandt.de>)
        id 1KtLsA-0005so-N4; Fri, 24 Oct 2008 16:34:37 +0400
Received: from [90.150.43.160] by mx00.schlund.de; Fri, 24 Oct 2008 17:51:07 +0500
From: "Support" <linleibbrandtmet@leibbrandt.de>
To: <petrov@domain.ru>
Subject: =?koi8-r?B?1NkgxM8g08nIINDP0i4gxNLP3snb2CDXINfBXs7Oz8o=?=
Date: Fri, 24 Oct 2008 17:51:07 +0500
MIME-Version: 1.0
Content-Type: text/plain;
        charset="koi8-r"
Content-Transfer-Encoding: 8bit
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
Thread-Index: Aca6QN43K0RJKTF5JEL3X57CB2371S==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Message-ID: <01c93601$17447780$a02b965a@linleibbrandtmet>

при этом в логах:

Код: Выделить всё

2008-10-24 13:40:54 1KtJA3-0005Kn-Jr <= rjono@emcal.de H=(mail02.wxs.nl) [121.247.127.243] I=[xx.yy.zz.ttt]:25 P=esmtp S=1238 from <rjono@emcal.de> for ivanov@domain.ru
2008-10-24 13:40:54  1KtJA3-0005Kn-Jr => ivanov <ivanov@domain.ru> R=virtual_localuser T=local_delivery
2008-10-24 13:40:54 1KtJA3-0005Kn-Jr => copy <system-filter> R=virtual_localuser T=local_delivery
2008-10-24 13:40:54 1KtJA3-0005Kn-Jr => ivanov@domain.ru R=exchange_router T=remote_smtp H=yyy.hhh.ttt.ddd [yyy.hhh.ttt.ddd] C="250 2.6.0 <DC2FRaqbC8wSA1XvpFV00000114@domail.local> Queued mail for delivery"
2008-10-24 13:40:54 1KtJA3-0005Kn-Jr Completed

Подскажите, почему эти письма не были отданы асасину?

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[Alex Keda]

конфиг, однако надо....
телепаты впали в зимнюю спячку...

[Satyr]

Сорри что пропал вот конвиг экзима

Код: Выделить всё

TEERGRUBE = 60s
timezone = Europe/Moscow
hide mysql_servers = localhost/exim/user/password
primary_hostname = mx.domain.ru

domainlist local_domains = ${lookup mysql{SELECT domain FROM domains \
                        WHERE domain='${domain}' AND \
                        (type='LOCAL' OR type='VIRTUAL')}}
domainlist relay_to_domains = ${lookup mysql{SELECT domain FROM domains \
hostlist   relay_from_hosts = localhost

acl_smtp_rcpt = acl_check_rcpt
acl_smtp_data = acl_check_data


av_scanner = clamd:/var/run/clamav/clamd
spamd_address = 127.0.0.1 783

qualify_domain = domain.ru
exim_user = mailnull
exim_group = mailnull
never_users = root

host_lookup = *
rfc1413_hosts = *
rfc1413_query_timeout = 5s
ignore_bounce_errors_after = 2d
timeout_frozen_after = 1d
message_size_limit = 10M
smtp_accept_max = 500
smtp_accept_max_per_connection = 10
smtp_accept_max_per_host = 10
split_spool_directory = true
remote_max_parallel = 30


log_selector = \
    +all_parents \
    +connection_reject \
    +incoming_interface \
    +lost_incoming_connection \
    +received_sender \
    +received_recipients \
    +smtp_confirmation \
    +smtp_syntax_error \
    +smtp_protocol_error \
    -queue_run

system_filter = /usr/local/etc/exim/copy_mail.conf


begin acl

acl_check_rcpt:

 accept  hosts = :
 accept  authenticated = *

  drop    domains       = +local_domains
          local_parts   = ^[.] : ^.*[@%!/|]

  drop    domains       = !+local_domains
          local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

  drop    message       = HELO/EHLO required by SMTP RFC
          condition     = ${if eq{$sender_helo_name}{}{yes}{no}}

  drop    message        = Don't send your IP in HELLO message!
          hosts         =  *:!+relay_from_hosts
          condition     = ${if eq{$sender_helo_name}\
                          {$sender_host_address}{true}{false}}

  drop    condition     = ${if eq{$sender_helo_name}\
                          {$interface_address}{yes}{no}}
          hosts         = !127.0.0.1 : !localhost : *
          message       = "Go Away!"

  drop    condition     = ${if match{$sender_helo_name}\
                          {\N^\d+$\N}{yes}{no}}
          hosts         = !127.0.0.1:!localhost:*
          message       = "No Domain name where only digits!"

  drop    message       = Go Away
          condition     = ${if match{$sender_host_name} \
                          {bezeqint\\.net|net\\.il|dialup|dsl|pool|peer|dhcp} \
                          {yes}{no}}
  drop    message       = message from \
  $sender_host_address rejected - see http://njabl.org/
          log_message   = found in $dnslist_domain
          dnslists      = dnsbl.njabl.org
  drop    message       = rejected because \
  $sender_host_address for bad WHOIS info, see http://www.rfc-ignorant.org/
          log_message   = found in $dnslist_domain
          dnslists      = ipwhois.rfc-ignorant.org
  drop    message       = rejected because $sender_host_address \
  is in a black list at $dnslist_domain\n$dnslist_text
          log_message   = found in $dnslist_domain
          dnslists      = dialups.mail-abuse.org
  drop    message       = rejected because $sender_host_address \
  is in a black list at $dnslist_domain\n$dnslist_text
          log_message   = found in $dnslist_domain
          dnslists      = list.dsbl.org
  drop    message       = Spam blocked see: \
  http://www.spamcop.net/w3m?action=checkblock&ip=$sender_host_address
          log_message   = found in $dnslist_domain
          dnslists      = bl.spamcop.net
  drop    message       = rejected, $sender_host_address \
  Open Proxy, see: $dnslist_domain\n$dnslist_text
          log_message   = found in $dnslist_domain
          dnslists      = dnsbl.void.ru

 accept  domains       = +local_domains
          endpass
          message       = unknown user
          verify        = recipient
  accept  domains       = +relay_to_domains
          endpass
          message       = unrouteable address
          verify        = recipient

  accept  hosts         = +relay_from_hosts



acl_check_data:

   deny    malware    = *
           message    = This message contains a virus ($malware_name).

 warn  message = X-Spam-Score: $spam_score ($spam_bar)
        hosts   = !+relay_from_hosts
        spam    = mailnull

  warn  message = X-Spam-Report: $spam_report
        hosts   = !+relay_from_hosts
        spam    = mailnull

  warn  message = Subject: ***SPAM*** $h_Subject:
        hosts   = !+relay_from_hosts
        spam    = mailnull

  deny  message = This message scored $spam_score spam points.
        spam    = mailnull
        hosts   = !+relay_from_hosts
        condition = ${if >{$spam_score_int}{51}{1}{0}}
  accept




begin routers


exchange_router:
        driver          =       "manualroute"
        domains         =       ${lookup mysql{SELECT domain from domains WHERE domain='${domain}'}}
        local_parts     =       ${lookup mysql{SELECT login from users WHERE login='${local_part}' AND login<>'copy' AND domain='${domain}'}}
        transport       =       remote_smtp
        route_list      =       * xxx.yyy.zzz.qqqq
        unseen
dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

system_aliases:
  driver = redirect
  allow_fail
  allow_defer
  data = ${lookup mysql{SELECT recipients FROM aliases \
         WHERE local_part='${local_part}' AND domain='${domain}'}}
virtual_localuser:
  driver = accept
  domains = ${lookup mysql{SELECT domain from domains WHERE domain='${domain}'}}
  local_parts = ${lookup mysql{SELECT login from users \
                WHERE login='${local_part}' AND domain='${domain}'}}
  transport = local_delivery



begin transports

remote_smtp:
  driver = smtp

local_delivery:
  driver = appendfile
  check_string = ""
  create_directory
  delivery_date_add
  directory = /var/mail/$domain/$local_part
  directory_mode = 770
  envelope_to_add
  group = mailnull
  maildir_format
  maildir_tag = ,S=$message_size
  message_prefix = ""
  message_suffix = ""
  mode = 0600


address_pipe:
  driver = pipe
  return_output
address_file:
  driver = appendfile
  delivery_date_add
  envelope_to_add
  return_path_add


address_reply:
  driver = autoreply



begin retry

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h

begin authenticators


auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup mysql{SELECT login FROM users \
                        WHERE login = '${quote_mysql:${local_part:$2}}' \
                        AND domain = '${quote_mysql:${domain:$2}}' \
                        AND decrypt = '${quote_mysql:$3}' \
                        AND status = '1'}{yes}{no}}
  server_prompts = :
server_set_id = $2

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup mysql{SELECT login FROM users \
                        WHERE login = '${quote_mysql:${local_part:$1}}' \
                        AND domain = '${quote_mysql:${domain:$1}}' \
                        AND decrypt = '${quote_mysql:$2}' \
                        AND status = '1'}{yes}{no}}
  server_prompts = Username:: : Password::
server_set_id = $1

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup mysql{SELECT decrypt FROM users \
                        WHERE login = '${quote_mysql:${local_part:$1}}' \
                        AND domain = '${quote_mysql:${domain:$1}}' \
                        AND status = '1'}{$value}fail}
server_set_id = $1

[Laa]

Покажите вывод

Код: Выделить всё

ps axww|grep spamd

[Satyr]

Код: Выделить всё

 ps axww|grep spamd
58630  ??  I      0:21.44 spamd child (perl5.8.8)
59325  ??  Ss    12:52.47 /usr/local/bin/spamd -d (perl5.8.8)
60664  ??  I      0:01.67 spamd child (perl5.8.8)
61040  p0  S+     0:00.00 grep spamd

[Laa]

Попробуйте добавить флаг:

Код: Выделить всё

-m32

[Satyr]

Laa, флаг добавил, но не могли бы вы пояснить из-за чего такое может быть? Практически весь спам удачно отсекается, но даже если что -то и проскакивает, то с пометками ассасина в заголовках, а малая часть просто тупо проходит напрямую без проверки.

[Laa]

По умолчанию спамассассин запускает не совсем достаточно чилдренов.
Этот флаг увеличивает их число.
Но лучше не доводить до проверок спамассассином, а рубить до него, лучше рубить не по одному критерию а по набору критериев. Опсь, ушел в сторону...

[Satyr]

не помогло.

[KaAlAn]

Код: Выделить всё

         warn  message = X-Spam-Score: $spam_score ($spam_bar)
        hosts   = !+relay_from_hosts
        spam    = mailnull

если условие (spam = mailnull) == false то "message =" не пишется. Надо условие :true.