<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
	<title type="html"><![CDATA[Linux Forum &mdash; amavis + spamassassin + clamav]]></title>
	<link rel="self" href="https://linuxforum.ru/extern.php?action=feed&amp;tid=24243&amp;type=atom" />
	<updated>2012-09-12T06:40:47Z</updated>
	<generator>PunBB</generator>
	<id>https://linuxforum.ru/viewtopic.php?id=24243</id>
		<entry>
			<title type="html"><![CDATA[Re: amavis + spamassassin + clamav]]></title>
			<link rel="alternate" href="https://linuxforum.ru/viewtopic.php?pid=298148#p298148" />
			<content type="html"><![CDATA[<p>В общем снес amavis <br />Связал postfix c spamassassin + clamav + clamsmtp<br />в main.cf добавил<br /></p><div class="codebox"><pre><code>content_filter = scan:127.0.0.1:10025
receive_override_options = no_address_mappings</code></pre></div><p>в master.cf<br /></p><div class="codebox"><pre><code>scan    unix    -       -       n       -       16      smtp
   -o smtp_send_xforward_command=yes

127.0.0.1:10026 inet    n       -       n       -       16      smtpd
  -o content_filter=
  -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
  -o smtpd_helo_restrictions=
  -o smtpd_client_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o mynetworks_style=host
  -o smtpd_authorized_xforward_hosts=127.0.0.0/8

spamassassin    unix    -       n       n       -       -       pipe
    user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}</code></pre></div><p>clamd.conf<br /></p><div class="codebox"><pre><code>LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup clamav
LocalSocketMode 666
# TemporaryDirectory is not set to its default /tmp here to make overriding
# the default with environment variables TMPDIR/TMP/TEMP possible
User clamav
AllowSupplementaryGroups true
ScanMail true
ScanArchive true
ArchiveBlockEncrypted false
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PidFile /var/run/clamav/clamd.pid
DatabaseDirectory /var/lib/clamav
SelfCheck 3600
Foreground false
Debug false
ScanPE true
ScanOLE2 true
ScanHTML true
DetectBrokenExecutables false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
DetectPUA false
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
ExtendedDetectionInfo true
OLE2BlockMacros false
StreamMaxLength 25M
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000
OfficialDatabaseOnly false
CrossFilesystems true</code></pre></div><p>clamsmtpd.conf<br /></p><div class="codebox"><pre><code>OutAddress: 10026
TimeOut: 180
KeepAlives: 0
XClient: on
Listen: 127.0.0.1:10025
ClamAddress: /var/run/clamav/clamd.ctl
Header: X-AV-Checked: ClamAV using ClamSMTP
TempDirectory: /var/spool/clamsmtp
PidFile: /var/run/clamsmtp/clamsmtpd.pid
Action: drop
Quarantine: on
User: clamsmtp</code></pre></div><p>/etc/spamassassin/local.cf<br /></p><div class="codebox"><pre><code>required_hits 5
rewrite_header Subject ****SPAM****
report_safe 0
use_bayes 1

bayes_path /etc/mail/spamassassin/bayes
bayes_file_mode 0666
bayes_learn_to_journal 1

bayes_min_ham_num 50
bayes_min_spam_num 50

score SUBJ_FULL_OF_8BITS 0.00
score HTML_COMMENT_8BITS 0.01
score HEADER_8BITS 0.00
score TO_NO_USER 0.01
score FORGED_MUA_OUTLOOK 0.5
score X_AUTH_WARNING 0.01
score SUBJ_HAS_UNIQ_ID 9.99
score HTTP_USERNAME_USED 9.99
score FORGED_YAHOO_RCVD 9.99
score FORGED_JUNO_RCVD 16
score UNWANTED_LANGUAGE_BODY 1.02
score MLM 5.55
score RCVD_NUMERIC_HELO 4.95

ok_locales en ru

trusted_networks 192.168.0.0/24</code></pre></div><p>в логах пишет<br /></p><div class="codebox"><pre><code>Sep 12 12:00:21 srv2 postfix/smtpd[16561]: setting up TLS connection from unknown[141.136.119.254]
Sep 12 12:00:22 srv2 postfix/smtpd[16561]: Anonymous TLS connection established from unknown[141.136.119.254]: TLSv1 with cipher AES128-SHA (128/128 bits)
Sep 12 12:00:22 srv2 postfix/smtpd[16561]: 0413140E1605: client=unknown[141.136.119.254], sasl_method=LOGIN, sasl_username=test@rosmicrofinans.ru
Sep 12 12:00:22 srv2 postfix/cleanup[16565]: 0413140E1605: message-id=&lt;00b101cd90bc$9fe68af0$dfb3a0d0$@rosmicrofinans.ru&gt;
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 0413140E1605: from=&lt;test@rosmicrofinans.ru&gt;, size=2631, nrcpt=1 (queue active)
Sep 12 12:00:22 srv2 postfix/pickup[16537]: 28E8840E1616: uid=1001 from=&lt;test@rosmicrofinans.ru&gt;
Sep 12 12:00:22 srv2 postfix/pipe[16549]: 0413140E1605: to=&lt;v.moiseev@1microfinance.ru&gt;, relay=spamassassin, delay=0.16, delays=0.06/0/0/0.1, dsn=2.0.0, status=sent (delivered via spamassassin service)
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 0413140E1605: removed
Sep 12 12:00:22 srv2 postfix/cleanup[16548]: 28E8840E1616: message-id=&lt;00b101cd90bc$9fe68af0$dfb3a0d0$@rosmicrofinans.ru&gt;
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 28E8840E1616: from=&lt;test@rosmicrofinans.ru&gt;, size=2996, nrcpt=1 (queue active)
Sep 12 12:00:22 srv2 clamsmtpd: 100005: accepted connection from: 127.0.0.1
Sep 12 12:00:22 srv2 postfix/smtpd[16555]: connect from localhost[127.0.0.1]
Sep 12 12:00:22 srv2 postfix/smtpd[16555]: NOQUEUE: reject: RCPT from localhost[127.0.0.1]: 554 5.7.1 &lt;v.moiseev@1microfinance.ru&gt;: Recipient address rejected: Access denied; from=&lt;test@rosmicrofinans.ru&gt; to=&lt;v.moiseev@1microfinance.ru&gt; proto=ESMTP helo=&lt;mail.rosmicrofinans.ru&gt;
Sep 12 12:00:22 srv2 postfix/smtp[16553]: 28E8840E1616: to=&lt;v.moiseev@1microfinance.ru&gt;, relay=127.0.0.1[127.0.0.1]:10025, delay=0.17, delays=0.09/0/0.03/0.04, dsn=5.7.1, status=bounced (host 127.0.0.1[127.0.0.1] said: 554 5.7.1 &lt;v.moiseev@1microfinance.ru&gt;: Recipient address rejected: Access denied (in reply to RCPT TO command))
Sep 12 12:00:22 srv2 postfix/smtpd[16555]: disconnect from localhost[127.0.0.1]
Sep 12 12:00:22 srv2 postfix/cleanup[16548]: 45F7140E1615: message-id=&lt;20120912080022.45F7140E1615@mail.rosmicrofinans.ru&gt;
Sep 12 12:00:22 srv2 postfix/bounce[16556]: 28E8840E1616: sender non-delivery notification: 45F7140E1615
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 45F7140E1615: from=&lt;&gt;, size=5037, nrcpt=1 (queue active)
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 28E8840E1616: removed
Sep 12 12:00:22 srv2 postfix/pipe[16570]: 45F7140E1615: to=&lt;test@rosmicrofinans.ru&gt;, relay=dovecot, delay=0.13, delays=0.04/0/0/0.08, dsn=2.0.0, status=sent (delivered via dovecot service)
Sep 12 12:00:22 srv2 postfix/qmgr[16538]: 45F7140E1615: removed
Sep 12 12:00:24 srv2 postfix/smtpd[16561]: disconnect from unknown[141.136.119.254]</code></pre></div><p>И возвращается письмо<br /></p><div class="codebox"><pre><code>This is the mail system at host mail.rosmicrofinans.ru.
I&#039;m sorry to have to inform you that your message could not be delivered to one or more recipients. It&#039;s attached below.
For further assistance, please send mail to postmaster.
If you do so, please include this problem report. You can delete your own text from the attached returned message.

                   The mail system

&lt;v.moiseev@1microfinance.ru&gt;: host 127.0.0.1[127.0.0.1] said: 554 5.7.1
    &lt;v.moiseev@1microfinance.ru&gt;: Recipient address rejected: Access denied (in
    reply to RCPT TO command)</code></pre></div><p>как с этим быть?</p>]]></content>
			<author>
				<name><![CDATA[kom-pik]]></name>
				<uri>https://linuxforum.ru/profile.php?id=16698</uri>
			</author>
			<updated>2012-09-12T06:40:47Z</updated>
			<id>https://linuxforum.ru/viewtopic.php?pid=298148#p298148</id>
		</entry>
		<entry>
			<title type="html"><![CDATA[amavis + spamassassin + clamav]]></title>
			<link rel="alternate" href="https://linuxforum.ru/viewtopic.php?pid=298054#p298054" />
			<content type="html"><![CDATA[<p>Пытаюсь эту связку к postfix&#039;у прикрутить, почта не приходит и не уходит, в логах пишет<br /></p><div class="codebox"><pre><code>Sep 11 12:08:56 srv2 postfix/smtpd[3600]: Anonymous TLS connection established from unknown[141.136.119.254]: TLSv1 with cipher AES128-SHA (128/128 bits)
Sep 11 12:08:56 srv2 postfix/smtpd[3600]: 09E6440E1564: client=unknown[141.136.119.254], sasl_method=LOGIN, sasl_username=test@rosmicrofinans.ru
Sep 11 12:08:56 srv2 postfix/cleanup[3603]: 09E6440E1564: message-id=&lt;007901cd8ff4$a981ca20$fc855e60$@rosmicrofinans.ru&gt;
Sep 11 12:08:56 srv2 postfix/qmgr[3589]: 09E6440E1564: from=&lt;test@rosmicrofinans.ru&gt;, size=2526, nrcpt=1 (queue active)
Sep 11 12:08:58 srv2 postfix/smtpd[3600]: disconnect from unknown[141.136.119.254]
Sep 11 12:09:21 srv2 amavis[1322]: (01322-04) (!)rw_loop: leaving rw loop, no progress, last event (select) 35.035 s ago
Sep 11 12:09:21 srv2 amavis[1322]: (01322-04) (!)FWD via SMTP: &lt;v.moiseev@1microfinance.ru&gt; -&gt; &lt;test@rosmicrofinans.ru&gt;, 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting:  at (eval 113) line 596.): id=01322-04
Sep 11 12:09:21 srv2 amavis[1322]: (01322-04) Blocked MTA-BLOCKED, [95.108.253.142] [141.136.119.254] &lt;v.moiseev@1microfinance.ru&gt; -&gt; &lt;test@rosmicrofinans.ru&gt;, Message-ID: &lt;006a01cd8ff4$a2d25d20$e8771760$@1microfinance.ru&gt;, mail_id: No+PaL8b5xWN, Hits: -0.7, size: 19265, 35835 ms
Sep 11 12:09:21 srv2 postfix/smtp[3596]: 8455E40E0A64: to=&lt;test@rosmicrofinans.ru&gt;, relay=127.0.0.1[127.0.0.1]:10024, delay=36, delays=0.11/0.01/0/36, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 From MTA([127.0.0.1]:10025) during fwd-connect (Negative greeting:  at (eval 113) line 596.): id=01322-04 (in reply to end of DATA command))
Sep 11 12:09:26 srv2 amavis[1322]: (01322-04) (!)rw_loop: leaving rw loop, no progress, last event (select) 5.005 s ago</code></pre></div><p>в main.cf добавил<br /></p><div class="codebox"><pre><code>content_filter = smtp-amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings</code></pre></div><p>в master.cf<br /></p><div class="codebox"><pre><code>smtp-amavis     unix    -       -       n       -       2       smtp
  -o smtp_data_done_timeout=1200
  -o smtp_send_xforward_command=yes
  -o disable_dns_lookups=yes -o max_use=20

127.0.0.1:10025 inet    n       -       -       -       -       smtpd
  -o content_filter=
  -o local_recipient_maps=
  -o relay_recipient_maps=
  -o smtpd_restriction_classes=
  -o smtpd_delay_reject=no
  -o smtpd_client_restrictions=permit_mynetworks,reject
  -o smtpd_helo_restrictions=
  -o smtpd_sender_restrictions=
  -o smtpd_recipient_restrictions=permit_mynetworks,reject
  -o smtpd_data_restrictions=reject_unauth_pipelining
  -o smtpd_end_of_data_restrictions=
  -o mynetworks=127.0.0.0/8
  -o smtpd_error_sleep_time=0
  -o smtpd_soft_error_limit=1001
  -o smtpd_hard_error_limit=1000
  -o smtpd_client_connection_count_limit=0
  -o smtpd_client_connection_rate_limit=0
  -o receive_override_options=no_header_body_checks,no_ unknown_recipient_checks
  -o local_header_rewrite_clients=</code></pre></div><p>/etc/amavis/conf.d/50-user<br /></p><div class="codebox"><pre><code>$pax=&#039;pax&#039;;

@lookup_sql_dsn = ( [&#039;DBI:mysql:database=server;host=127.0.0.1;port =3306&#039;, &#039;user&#039;, &#039;passwd&#039;]);
$sql_select_policy = &#039;SELECT name FROM virtual_domains WHERE CONCAT(&quot;@&quot;,name) IN (%k)&#039;;</code></pre></div><p>/etc/amavis/conf.d/21-ubuntu_defaults<br /></p><div class="codebox"><pre><code>$enable_dkim_verification = 1;
# Don&#039;t be verbose about sending mail:
@whitelist_sender_acl = qw( .$mydomain );
$final_virus_destiny      = D_DISCARD; # (defaults to D_BOUNCE)
$final_banned_destiny     = D_DISCARD;  # (defaults to D_BOUNCE)
$final_spam_destiny       = D_DISCARD;  # (defaults to D_REJECT)
$final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested

$virus_admin = undef;
$spam_admin = undef;</code></pre></div><p>Куда рыть подскажите?</p>]]></content>
			<author>
				<name><![CDATA[kom-pik]]></name>
				<uri>https://linuxforum.ru/profile.php?id=16698</uri>
			</author>
			<updated>2012-09-11T08:16:28Z</updated>
			<id>https://linuxforum.ru/viewtopic.php?pid=298054#p298054</id>
		</entry>
</feed>
