On 11/01/2013 08:45 AM, Tim Whitaker wrote:
Hi everybody... I've been running qmail toaster on a fresh CentOS 5.9
install for about a month now and all has been well except for one thing...
spam. I have googled as much as I could to try and figure out what my
problem might be and I've made some changes but still some really annoying
spam is coming through with file attachments and such. My problem is I
can't figure out how to find any logs to tell me if SpamAssassin is
actually working. I know the service is running. In there spirit of
giving too much information, here's a bunch of stuff:
cat /etc/tcprules.d/tcp.smtp
127.:allow,RELAYCLIENT="",DKSIGN="/var/qmail/control/domainkeys/%/private"
:allow,BADMIMETYPE="",BADLOADERTYPE="M",CHKUSER_RCPTLIMIT="50",CHKUSER_WRONGRCPTLIMIT="10",QMAILQUEUE="/var/qmail/bin/simscan",DKSIGN="/var/qmail/control/domainkeys/%/private"
cat /var/qmail/control/simcontrol
:clam=yes,spam=yes,spam_hits=12,attach=.mp3:.src:.bat:.pif
qmailctl stat
authlib: up (pid 16643) 49008 seconds
clamd: up (pid 16614) 49008 seconds
imap4: down 49008 seconds
imap4-ssl: down 49008 seconds
pop3: up (pid 16603) 49008 seconds
pop3-ssl: up (pid 16665) 49008 seconds
send: up (pid 16626) 49008 seconds
smtp: up (pid 16635) 49008 seconds
spamd: up (pid 16622) 49008 seconds
submission: up (pid 16685) 49007 seconds
authlib/log: up (pid 16645) 49008 seconds
clamd/log: up (pid 16616) 49008 seconds
imap4/log: down 49008 seconds
imap4-ssl/log: down 49008 seconds
pop3/log: up (pid 16605) 49008 seconds
pop3-ssl/log: up (pid 16671) 49008 seconds
send/log: up (pid 16610) 49008 seconds
smtp/log: up (pid 16640) 49008 seconds
spamd/log: up (pid 16631) 49008 seconds
submission/log: up (pid 16661) 49008 seconds
SpamAssassin logs to /var/log/qmail/spamd.
An important component of SpamAssassin is the bayesian analysis of
messages. I don't remember if this is enabled by default. To enable
it, put this in /etc/mail/spamassassin/local.cf:
use_bayes 1
Bayesian analysis won't work until it has trained on at least 200 ham
messages and 200 spam messages. Training can be done manually using a
body of samples you've collected, or it can be done automatically by
looking at messages as they pass through the system during normal
operation. To enable autolearning, put this in
/etc/mail/spamassassin/local.cf:
bayes_auto_learn 1
More information about SpamAssassin can be found in the QmailToaster wiki:
http://wiki.qmailtoaster.com/index.php/Spamassassin
And, of course, at the SpamAssassin site:
http://spamassassin.apache.org/
Definitely run Spamdyke. It greatly reduces the load on the system by
blocking large numbers of obvious spam before they get to the more
resource-intensive Toaster components such as ClamAV and SpamAssassin.
Spamdyke can be installed using scripts in QmailToaster-Plus:
http://qtp.qmailtoaster.com/trac/wiki/Features#qtp-install-spamdyke
I also recommend SaneSecurity signatures for ClamAV. These allow ClamAV
to catch spam as well as viruses and malware. QmailToaster-Plus includes
an install script for SaneSecurity:
http://qtp.qmailtoaster.com/trac/wiki/Features#qtp-install-sanesecurity
I've been using the SaneSecurity Foxhole signatures to catch archive
attachments (.zip .rar etc.) that contain executables. More info:
http://sanesecurity.com/foxhole-databases/
You can also block all file attachments with specific extensions by
adding the extension to the attach= clause in
/var/qmail/control/simcontrol. More info:
http://wiki.qmailtoaster.com/index.php/Simscan
Brent Gardner
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
