Nie jesteś zalogowany.
Jeśli nie posiadasz konta, zarejestruj je już teraz! Pozwoli Ci ono w pełni korzystać z naszego serwisu. Spamerom dziękujemy!
Ogłoszenie
Prosimy o pomoc dla małej Julki — przekaż 1% podatku na Fundacji Dzieciom zdazyć z Pomocą.
Więcej informacji na dug.net.pl/pomagamy/.
#1 2008-03-26 20:28:04
markus78 - 
Użytkownik
- markus78
- Użytkownik
- Zarejestrowany: 2006-08-08
dspm i filtrowanie poczty
zainstalowałem Postfixa + mysql z wirtualnymi userami (wg opisu z howtoforge.com) + clamav + dspama i wszystko działa poprawnie ale Dspam wpuszcza wszystkie wiadomości. Każdy spam wchodzi na skrzynki userów. Jak go odfiltrować? W logach mam że poczta jest dostarczana bez problemów, dspam i clamav też w logach nie generuje żadnych błędów. Moje configi wyglądają tak:
/etc/dspam/dspam.conf
Kod:
Home /var/spool/dspam StorageDriver /usr/lib/dspam/libhash_drv.so TrustedDeliveryAgent "/usr/bin/procmail" DeliveryHost 127.0.0.1 DeliveryPort 10026 DeliveryIdent localhost DeliveryProto SMTP OnFail error Trust root Trust dspam Trust mail Trust mailnull Trust smmsp Trust daemon TrainingMode teft TestConditionalTraining on Algorithm graham burton PValue graham Preference "spamAction=tag" Preference "signatureLocation=message" Preference "showFactors=on" Preference "spamAction=tag" Preference "spamSubject=SPAM" AllowOverride trainingMode AllowOverride spamAction spamSubject AllowOverride statisticalSedation AllowOverride enableBNR AllowOverride enableWhitelist AllowOverride signatureLocation AllowOverride showFactors AllowOverride optIn optOut AllowOverride whitelistThreshold HashRecMax 98317 HashAutoExtend on HashMaxExtents 0 HashExtentSize 49157 HashMaxSeek 100 HashConnectionCache 10 Notifications off PurgeSignatures 14 PurgeNeutral 90 PurgeUnused 90 PurgeHapaxes 30 PurgeHits1S 15 PurgeHits1I 15 LocalMX 127.0.0.1 SystemLog on UserLog on Opt out TrackSources spam virus ParseToHeaders on ChangeModeOnParse on ChangeUserOnParse off ClamAVPort 3310 ClamAVHost 127.0.0.1 ClamAVResponse reject ServerPID /var/run/dspam.pid ServerMode auto ServerPass.Relay1 "secret" ServerParameters "--deliver=innocent" ServerIdent "localhost.localdomain" ServerDomainSocketPath "/var/spool/postfix/var/run/dspam.sock" ClientIdent "secret@Relay1" ProcessorBias on Include /etc/dspam/dspam.d/
/etc/dspam/dspam.d/mysql.conf:
Kod:
MySQLServer localhost MySQLPort 3306 MySQLUser userdobazy MySQLPass haslodobazy MySQLDb db_dspam MySQLVirtualTable dspam_virtual_uids MySQLVirtualUIDField uid MySQLVirtualUsernameField username
/etc/clamav/clamd.conf:
Kod:
TCPSocket 3310 User clamav AllowSupplementaryGroups true ScanMail true ScanArchive true ArchiveMaxRecursion 5 ArchiveMaxFiles 1000 ArchiveMaxFileSize 10M ArchiveMaxCompressionRatio 250 ArchiveLimitMemoryUsage false ArchiveBlockEncrypted false MaxDirectoryRecursion 15 FollowDirectorySymlinks false FollowFileSymlinks false ReadTimeout 180 MaxThreads 12 MaxConnectionQueueLength 15 StreamMaxLength 10M LogSyslog false LogFacility LOG_LOCAL6 LogClean false LogVerbose false PidFile /var/run/clamav/clamd.pid DatabaseDirectory /var/lib/clamav TemporaryDirectory /tmp SelfCheck 3600 Foreground false Debug false ScanPE true ScanOLE2 true ScanHTML true DetectBrokenExecutables false MailFollowURLs false ArchiveBlockMax false ExitOnOOM false LeaveTemporaryFiles false AlgorithmicDetection true ScanELF true IdleTimeout 30 MailMaxRecursion 64 LogFile /var/log/clamav/clamav.log LogTime true LogFileUnlock false LogFileMaxSize 0
natomiast w nagłówku tej poczty spamu która wchodzi na skrzynki mam wpisy:
Kod:
X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 26 06:53:29 2008 X-DSPAM-Confidence: 0.9899 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 47e9e4d930329592316553
a w treści maila jest w stopce:
!DSPAM:47e9e4d930329592316553!
baza MySQL db_dspam jest pusta - może coś trzeba do niej dograć jakies definicje, a może coś mam w configach źle?
pozdr. Marcin
Offline
#2 2008-03-26 21:18:51
markus78 - Użytkownik
- markus78
- Użytkownik
- Zarejestrowany: 2006-08-08
Re: dspm i filtrowanie poczty
może trzeba go nauczyć, ale nie wiem jak to zrobić?
Offline
Informacje debugowania
| Time (s) | Query |
|---|---|
| 0.00009 | SET CHARSET latin2 |
| 0.00004 | SET NAMES latin2 |
| 0.00115 | SELECT u.*, g.*, o.logged FROM punbb_users AS u INNER JOIN punbb_groups AS g ON u.group_id=g.g_id LEFT JOIN punbb_online AS o ON o.ident='18.119.113.79' WHERE u.id=1 |
| 0.00069 | REPLACE INTO punbb_online (user_id, ident, logged) VALUES(1, '18.119.113.79', 1732662867) |
| 0.00048 | SELECT * FROM punbb_online WHERE logged<1732662567 |
| 0.00080 | DELETE FROM punbb_online WHERE ident='18.189.194.44' |
| 0.00248 | DELETE FROM punbb_online WHERE ident='3.12.34.150' |
| 0.00069 | DELETE FROM punbb_online WHERE ident='3.149.232.87' |
| 0.00066 | DELETE FROM punbb_online WHERE ident='85.208.96.195' |
| 0.00059 | SELECT topic_id FROM punbb_posts WHERE id=86770 |
| 0.00060 | SELECT id FROM punbb_posts WHERE topic_id=11005 ORDER BY posted |
| 0.00087 | SELECT t.subject, t.closed, t.num_replies, t.sticky, f.id AS forum_id, f.forum_name, f.moderators, fp.post_replies, 0 FROM punbb_topics AS t INNER JOIN punbb_forums AS f ON f.id=t.forum_id LEFT JOIN punbb_forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id=3) WHERE (fp.read_forum IS NULL OR fp.read_forum=1) AND t.id=11005 AND t.moved_to IS NULL |
| 0.00006 | SELECT search_for, replace_with FROM punbb_censoring |
| 0.00073 | SELECT u.email, u.title, u.url, u.location, u.use_avatar, u.signature, u.email_setting, u.num_posts, u.registered, u.admin_note, p.id, p.poster AS username, p.poster_id, p.poster_ip, p.poster_email, p.message, p.hide_smilies, p.posted, p.edited, p.edited_by, g.g_id, g.g_user_title, o.user_id AS is_online FROM punbb_posts AS p INNER JOIN punbb_users AS u ON u.id=p.poster_id INNER JOIN punbb_groups AS g ON g.g_id=u.group_id LEFT JOIN punbb_online AS o ON (o.user_id=u.id AND o.user_id!=1 AND o.idle=0) WHERE p.topic_id=11005 ORDER BY p.id LIMIT 0,25 |
| 0.00084 | UPDATE punbb_topics SET num_views=num_views+1 WHERE id=11005 |
| Total query time: 0.01077 s | |