URL: https://linuxfr.org/forums/linux-debian-ubuntu/posts/anti-spam-rspam-dovecot-avec-sieve-postfix Title: Anti-Spam : Rspam + Dovecot (avec Sieve) + Postfix Authors: electro575 Date: 2022年11月15日T14:47:20+01:00 License: CC By-SA Tags: Score: 1 Bonjour à tous, Sous debian Bullseye, Pour mon infrastructure serveur mail, j'utilise postfix et dovecot. Le but est de perfectionner/modifier/revoir le système d'anti-spam que j'ai pu mettre en place. Aujourd'hui, les mails que je mets en apprentissage anti-spam me parviennent encore en boite de réception. J'aimerais savoir ou faut-il que j'agisse pour remédier à cela dans la configuration suivante. Rspam me permet l'auto apprentissage des spams via la base de mails dovecot (avec Sieve). J'ai mis en oeuvre cette configuration spécifique avec le lien ci-dessous. https://doc.dovecot.org/configuration_manual/howto/antispam_with_sieve/ 1-L'apprentissage des spams =========================== Lorsque je bascule des mails dans le dossier indésirable, rspam réagit avec les logs suivant. J'ai juste un doute sur la dernière ligne, mais à priori c'est que l'adresse email a déjà été traité pour classification. rspamd_task_process: skip learning: is skipped for bayes classifier: already in class spam; probability 100.00% ``` #1988(controller) ; csession; rspamd_controller_check_password: allow unauthorized connection from a unix socket #1988(controller) ; csession; rspamd_message_parse: loaded message; id: ; queue-id: ; size: 21411; checksum: #1988(controller) ; csession; rspamd_mime_part_detect_language: detected part language: fr #1988(controller) ; csession; rspamd_task_process: skip learning: is skipped for bayes classifier: already in class spam; probability 100.00% ``` A coté de cela, j'ai une obscolescence coté module "ip_score". Comment savoir si Rspam l'utilise ? ``` ip_score module is deprecated in honor of reputation module! ``` Le score est un critère déterminant dans le choix du traitement de chaque email -> spam ou non ! 2-Vérification d'un mail entrant ================================ Voici un exemple de log provenant de Rspam d'un email entrant. ``` 14:02:16 #1983(rspamd_proxy) <4a1e7a>; proxy; proxy_accept_socket: accepted milter connection from /var/spool/postfix/run/rspamd/milter.sock port 0 14:02:26 #1983(rspamd_proxy) <4a1e7a>; milter; rspamd_milter_process_command: got connection from XXX.XXX.XX.XX:XXXXX 14:02:26 #1983(rspamd_proxy) <4a1e7a>; proxy; rspamd_mime_part_get_cte: detected missing CTE for part as: 7bit 14:02:26 #1983(rspamd_proxy) <4a1e7a>; proxy; rspamd_message_parse: loaded message; id: ; queue-id: <72c42642593>; size: 1337; checksum: 14:02:26 #1983(rspamd_proxy) <4a1e7a>; proxy; lua_task_insert_result_common: symbol insertion issue: unknown symbol SENDER_REP_HAM; trace: [1]:{/usr/share/rspamd/plugins/reputation.lua:80 - add_symbol_score [Lua]}; [2]:{/usr/share/rspamd/plugins/reputation.lua:430 - ipstats_check [Lua]}; [3]:{/usr/share/rspamd/plugins/reputation.lua:459 - continuation_cb [Lua]}; [4]:{/usr/share/rspamd/plugins/reputation.lua:929 - callback [Lua]}; [5]:{/usr/share/rspamd/lualib/lua_redis.lua:1296 - callback [Lua]}; [6]:{/usr/share/rspamd/lualib/lua_redis.lua:917 - [Lua]}; 14:02:26 #1983(rspamd_proxy) <4a1e7a>; proxy; dkim_module_key_handler: stored DKIM key for mailo._domainkey.netcourrier.com in LRU cache for 900 seconds, 12/2000 elements in the cache 14:02:26 #1983(rspamd_proxy) <4a1e7a>; lua; arc.lua:699: cannot read key from /var/lib/rspamd/arc/mondomain.fr.arc.key: Aucun fichier ou dossier de ce type 14:02:27 #1983(rspamd_proxy) <4a1e7a>; proxy; rspamd_symcache_finalize_item: slow rule: MX_INVALID(251): 1012.99 ms; enable slow timer delay 14:02:27 #1983(rspamd_proxy) <4a1e7a>; bayes; bayes_classify: no tokens found in bayes database (35 total tokens, 3 text tokens), ignore stats 14:02:27 #1983(rspamd_proxy) <4a1e7a>; lua; greylist.lua:318: Score too low - skip greylisting 14:02:27 #1983(rspamd_proxy) <4a1e7a>; lua; neural.lua:311: skip ham sample to keep spam/ham balance; probability 0.48275862068965514; 60 spam and 115 ham vectors stored 14:02:27 #1983(rspamd_proxy) <4a1e7a>; proxy; rspamd_task_write_log: id: , qid: <72c42642593>, ip: XXX.XXX.XX.XX, from: , (default: F (no action): [0.00/15.00] [DMARC_POLICY_ALLOW(-0.50){netcourrier.com;none;},MID_RHS_WWW(0.50){},MX_INVALID(0.50){},R_DKIM_ALLOW(-0.20){netcourrier.com:s=mailo;},R_SPF_ALLOW(-0.20){+ip4:XXX.XXX.XX.XX/24;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ARC_NA(0.00){},ASN(0.00){asn:8304, ipnet:XXX.XXX.XX.0/19, country:FR;},DKIM_TRACE(0.00){netcourrier.com:+;},FREEMAIL_ENVFROM(0.00){netcourrier.com;},FREEMAIL_FROM(0.00){netcourrier.com;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},HAS_X_PRIO_THREE(0.00){3;},MIME_TRACE(0.00){0:+;1:+;2:~;},NEURAL_HAM(-0.00){-1.000;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},SENDER_REP_HAM(0.00){asn: 8304(0.00), country: FR(-0.00), ip: XXX.XXX.XX.XX(0.00);},TO_DN_ALL(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 1337, time: 1257.116ms real, 1257.116ms virtual, dns req: 14, digest: , rcpts: , mime_rcpts: 14:02:27 #1983(rspamd_proxy) <4a1e7a>; proxy; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 3 regexps matched, 174 regexps total, 78 regexps cached, 0B scanned using pcre, 765B scanned total 14:02:28 #1983(rspamd_proxy) <03130b>; proxy; proxy_milter_finish_handler: finished milter connection ``` 3-Postfix ========= Voici la configuration du fichier main.cf de postfix qui fait intervenir rspam en tant que milter. ``` #Rspam milter postfix smtpd_milters = unix:/run/rspamd/milter.sock non_smtpd_milters = unix:/run/rspamd/milter.sock milter_protocol = 6 milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} # if rspamd is down, don't reject mail milter_default_action = accept ``` Log postfix à réception du mail. ``` 14:02:26 postfix/smtpd[590832]: warning: 15.54.182.213.list.dsbl.org: RBL lookup error: Host or domain name not found. Name service error for name=15.54.182.213.list.dsbl.org type=A: Host not found, try again 14:02:26 postfix/cleanup[590842]: warning: /etc/postfix/main.cf, line 77: overriding earlier entry: message_size_limit=10240000 14:02:26 postfix/smtpd[590832]: 72C42642593: client=msg-4.mailo.com[213.182.54.15] 14:02:26 postfix/cleanup[590842]: 72C42642593: message-id= 14:02:27 postfix/qmgr[1892]: 72C42642593: from=, size=1573, nrcpt=1 (queue active) 14:02:27 postfix/local[590844]: warning: /etc/postfix/main.cf, line 77: overriding earlier entry: message_size_limit=10240000 14:02:27 postfix/local[590844]: warning: database /etc/aliases.db is older than source file /etc/aliases 14:02:27 postfix/local[590844]: 72C42642593: to=, relay=local, delay=12, delays=12/0.01/0/0.01, dsn=2.0.0, status=sent (delivered to maildir) 14:02:27 postfix/qmgr[1892]: 72C42642593: removed 14:02:28 postfix/smtpd[590832]: disconnect from msg-4.mailo.com[213.182.54.15] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 ``` Le fichier Postfix master.cf est un peu complexe pour moi. Ce qui me surprend, c'est que je ne vois pas de ligne faisant appel à rspam dans les logs postfix. Merci pour votre retour d'expérience.