Contenu | Rechercher | Menus

Annonce

Si vous avez des soucis pour rester connecté, déconnectez-vous puis reconnectez-vous depuis ce lien en cochant la case
Me connecter automatiquement lors de mes prochaines visites.

À propos de l'équipe du forum.

#1 Le 31/01/2008, à 22:17

link182

Problème SPAM avec squirrelmail

Bonsoir,

j'utilise postfix + amavis + squirrelmail pour gérer mes mails et fitltrer les spams.
Je n'arrive pas a voir dans les header sous squirrelmail les tags x-spam-level ou x-spam-flag afin de filtrer les Spams

Pourtant amavis/squirrelmail font bien leur travail (Passed SPAMMY - /var/log/mail.log)

Jan 31 21:58:28 sd-12897 postfix/cleanup[18917]: 684F32A4194: message-id=<123844.80503.qm@web26304.mail.ukl.yahoo.com>
Jan 31 21:58:28 sd-12897 postfix/qmgr[3645]: 684F32A4194: from=<xxxxxx@yahoo.fr>, size=1929, nrcpt=1 (queue active)
Jan 31 21:58:28 sd-12897 amavis[16708]: (16708-09) Passed SPAMMY, [217.146.176.15] [88.164.208.169] <xxxxxx@yahoo.fr> -> <webmaster@touteslesmiss.com>, Message-ID: <123844.80503.qm@web26304.mail.ukl.yahoo.com>, mail_id: 0a-OoxxJ5IWd, Hits: 1.05, queued_as: 684F32A4194, 23164 ms
Jan 31 21:58:28 sd-12897 postfix/smtp[18918]: 365FE2A4193: to=<webmaster@touteslesmiss.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=38, delays=15/0.01/0.01/23, dsn=2.6.0, status=sent (250 2.6.0 Ok, id=16708-09, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 684F32A4194)
Jan 31 21:58:28 sd-12897 postfix/smtpd[18927]: disconnect from localhost[127.0.0.1]
Jan 31 21:58:28 sd-12897 postfix/qmgr[3645]: 365FE2A4193: removed
Jan 31 21:58:28 sd-12897 postfix/virtual[18928]: 684F32A4194: to=<webmaster@touteslesmiss.com>, relay=virtual, delay=0.23, delays=0.05/0.16/0/0.02, dsn=2.0.0, status=sent (delivered to maildir)
Jan 31 21:58:28 sd-12897 postfix/qmgr[3645]: 684F32A4194: removed

Merci pour votre aide.

Hors ligne

#2 Le 01/02/2008, à 07:21

toniotonio

Re : Problème SPAM avec squirrelmail

fais voir la conf d'amavisd


Tutoriaux Postfix sur www.starbridge.org/spip
Messagerie Dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com

Hors ligne

#3 Le 02/02/2008, à 10:38

link182

Re : Problème SPAM avec squirrelmail

Voici la configuration d'amavis (plusieurs fichiers de confs dans /etc/amavis/conf./)

15-content_filter_mode :

use strict;

# You can modify this file to re-enable SPAM checking through spamassassin
# and to re-enable antivirus checking.

#
# Default antivirus checking mode
# Uncomment the two lines below to enable it back
#

#@bypass_virus_checks_maps = (
#   \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);


#
# Default SPAM checking mode
# Uncomment the two lines below to enable it back
#

20-debian_defaults :

use strict;

# ADMINSTRATORS:
# Debian suggests that any changes you need to do that should never
# be "updated" by the Debian package should be made in another file,
# overriding the settings in this file.
#
# The package will *not* overwrite your settings, but by keeping
# them separate, you will make the task of merging changes on these
# configuration files much simpler...

#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
#       a list of all variables with their defaults;
#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
#       a traditional-style commented file
#   [note: the above files were not converted to Debian settings!]
#
#   for more details see documentation in /usr/share/doc/amavisd-new
#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html

$QUARANTINEDIR = "$MYHOME/virusmails";

$log_recip_templ = undef;    # disable by-recipient level-0 log entries
$DO_SYSLOG = 1;              # log via syslogd (preferred)
$syslog_ident = 'amavis';    # syslog ident tag, prepended to all messages
$syslog_facility = 'mail';
$syslog_priority = 'debug';  # switch to info to drop debug output, etc

$enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1

$inet_socket_port = 10024;   # default listenting socket

$sa_spam_subject_tag = '***SPAM*** ';
#$sa_tag_level_deflt  = 0.5;  # add spam info headers if at, or above that level
#$sa_tag2_level_deflt = 1.31; # add 'spam detected' headers at that level
#$sa_kill_level_deflt = 6.31; # triggers spam evasive actions
$sa_tag_level_deflt  = -9999.9;
$sa_tag2_level_deflt = 0.3;
$sa_kill_level_deflt = 9999.9;

$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent

$sa_mail_body_size_limit = 200*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 0;    # only tests which do not require internet access?

# Quota limits to avoid bombs (like 42.zip)

$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA =      100*1024;  # bytes
$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes

# You should:
#   Use D_DISCARD to discard data (viruses)
#   Use D_BOUNCE to generate local bounces by amavisd-new
#   Use D_REJECT to generate local or remote bounces by the calling MTA
#   Use D_PASS to deliver the message
#
# Whatever you do, *NEVER* use D_REJECT if you have other MTAs *forwarding*
# mail to your account.  Use D_BOUNCE instead, otherwise you are delegating
# the bounce work to your friendly forwarders, which might not like it at all.
#
# On dual-MTA setups, one can often D_REJECT, as this just makes your own
# MTA generate the bounce message.  Test it first.
#
# Bouncing viruses is stupid, always discard them after you are sure the AV
# is working correctly.  Bouncing real SPAM is also useless, if you cannot
# D_REJECT it (and don't D_REJECT mail coming from your forwarders!).

$final_virus_destiny      = D_DISCARD;  # (data not lost, see virus quarantine)
$final_banned_destiny     = D_BOUNCE;   # D_REJECT when front-end MTA
$final_spam_destiny       = D_BOUNCE;
$final_bad_header_destiny = D_PASS;     # False-positive prone (for spam)

$virus_admin = "postmaster\@$mydomain"; # due to D_DISCARD default

# Leave empty (undef) to add no header
$X_HEADER_LINE = "Debian $myproduct_name at $mydomain";

# REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS

#
# DO NOT SEND VIRUS NOTIFICATIONS TO OUTSIDE OF YOUR DOMAIN. EVER.
#
# These days, almost all viruses fake the envelope sender and mail headers.
# Therefore, "virus notifications" became nothing but undesired, aggravating
# SPAM.  This holds true even inside one's domain.  We disable them all by
# default, except for the EICAR test pattern.
#

@viruses_that_fake_sender_maps = (new_RE(
  [qr'\bEICAR\b'i => 0],            # av test pattern name
  [qr/.*/ => 1],  # true for everything else
));

@keep_decoded_original_maps = (new_RE(
# qr'^MAIL$',   # retain full original message for virus checking (can be slow)
  qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
  qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
# qr'^Zip archive data',     # don't trust Archive::Zip
));


# for $banned_namepath_re, a new-style of banned table, see amavisd.conf-sample
$banned_filename_re = new_RE(
# qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components

  # block certain double extensions anywhere in the base name
  qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,

  qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Windows Class ID CLSID, strict

  qr'^application/x-msdownload$'i,                  # block these MIME types
  qr'^application/x-msdos-program$'i,
  qr'^application/hta$'i,

# qr'^application/x-msmetafile$'i,      # Windows Metafile MIME type
# qr'^\.wmf$',                          # Windows Metafile file(1) type

# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types

# [ qr'^\.(Z|gz|bz2)$'           => 0 ],  # allow any in Unix-compressed
# [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives
# [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within such archives

  qr'.\.(exe|vbs|pif|scr|bat|cmd|com|cpl)$'i, # banned extension - basic
# qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
#        inf|ins|isp|js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|
#        ops|pcd|pif|prg|reg|scr|sct|shb|shs|vb|vbe|vbs|
#        wmf|wsc|wsf|wsh)$'ix,  # banned ext - long

# qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.

  qr'^\.(exe-ms)$',                       # banned file(1) types
# qr'^\.(exe|lha|tnef|cab|dll)$',         # banned file(1) types
);
# See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
# and http://www.cknow.com/vtutor/vtextensions.htm


# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING

@score_sender_maps = ({ # a by-recipient hash lookup table,
                        # results from all matching recipient tables are summed

# ## per-recipient personal tables  (NOTE: positive: black, negative: white)
# 'user1@example.com'  => [{'bla-mobile.press@example.com' => 10.0}],
# 'user3@example.com'  => [{'.ebay.com'                 => -3.0}],
# 'user4@example.com'  => [{'cleargreen@cleargreen.com' => -7.0,
#                           '.cleargreen.com'           => -5.0}],

  ## site-wide opinions about senders (the '.' matches any recipient)
  '.' => [  # the _first_ matching sender determines the score boost
 new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
    [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
    [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
    [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
    [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
  [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
    [qr'^(your_friend|greatoffers)@'i                                => 5.0],
    [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
   ),

#  read_hash("/var/amavis/sender_scores_sitewide"),

   { # a hash-type lookup table (associative array)
     'nobody@cert.org'                        => -3.0,
     'cert-advisory@us-cert.gov'              => -3.0,
     'owner-alert@iss.net'                    => -3.0,
     'slashdot@slashdot.org'                  => -3.0,
     'securityfocus.com'                      => -3.0,
     'ntbugtraq@listserv.ntbugtraq.com'       => -3.0,
     'security-alerts@linuxsecurity.com'      => -3.0,
     'mailman-announce-admin@python.org'      => -3.0,
     'amavis-user-admin@lists.sourceforge.net'=> -3.0,
     'amavis-user-bounces@lists.sourceforge.net' => -3.0,
     'spamassassin.apache.org'                => -3.0,
     'notification-return@lists.sophos.com'   => -3.0,
     'owner-postfix-users@postfix.org'        => -3.0,
     'owner-postfix-announce@postfix.org'     => -3.0,
     'owner-sendmail-announce@lists.sendmail.org'   => -3.0,
     'sendmail-announce-request@lists.sendmail.org' => -3.0,
     'donotreply@sendmail.org'                => -3.0,
     'ca+envelope@sendmail.org'               => -3.0,
     'noreply@freshmeat.net'                  => -3.0,
     'owner-technews@postel.acm.org'          => -3.0,
     'ietf-123-owner@loki.ietf.org'           => -3.0,
     'cvs-commits-list-admin@gnome.org'       => -3.0,
     'rt-users-admin@lists.fsck.com'          => -3.0,
     'clp-request@comp.nus.edu.sg'            => -3.0,
     'surveys-errors@lists.nua.ie'            => -3.0,
     'emailnews@genomeweb.com'                => -5.0,
     'yahoo-dev-null@yahoo-inc.com'           => -3.0,
     'returns.groups.yahoo.com'               => -3.0,
     'clusternews@linuxnetworx.com'           => -3.0,
     lc('lvs-users-admin@LinuxVirtualServer.org')    => -3.0,
     lc('owner-textbreakingnews@CNNIMAIL12.CNN.COM') => -5.0,

     # soft-blacklisting (positive score)
     'sender@example.net'                     =>  3.0,
     '.example.net'                           =>  1.0,

   },
  ],  # end of site-wide tables
});

1;  # insure a defined return

01-debian_defaults

use strict;

# ADMINSTRATORS:
# Debian suggests that any changes you need to do that should never
# be "updated" by the Debian package should be made in another file,
# overriding the settings in this file.
#
# The package will *not* overwrite your settings, but by keeping
# them separate, you will make the task of merging changes on these
# configuration files much simpler...

#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-default for
#       a list of all variables with their defaults;
#   see /usr/share/doc/amavisd-new/examples/amavisd.conf-sample for
#       a traditional-style commented file
#   [note: the above files were not converted to Debian settings!]
#
#   for more details see documentation in /usr/share/doc/amavisd-new
#   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html


# SETTINGS RARELY MODIFIED BY THE LOCAL ADMIN

$ENV{PATH} = $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
$file   = 'file';
$gzip   = 'gzip';
$bzip2  = 'bzip2';
$lzop   = 'lzop';
$rpm2cpio   = ['rpm2cpio.pl','rpm2cpio'];
$cabextract = 'cabextract';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze   = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc        = ['nomarch', 'arc'];
$unarj      = ['arj', 'unarj'];
$unrar      = ['rar', 'unrar'];
$zoo    = 'zoo';
$lha    = 'lha';
$pax    = 'pax';
$cpio   = 'cpio';
$ar     = 'ar';
$ripole = 'ripole';
$dspam  = 'dspam';

1;  # insure a defined return

en esperant que cela puisse aider.

Hors ligne

#4 Le 02/02/2008, à 11:01

toniotonio

Re : Problème SPAM avec squirrelmail

je n'aime pas la conf eclatée du package debian car on ne s'y retrouve pas.

dans ce que tu me donnes ici je ne trouve  pas des parametres indispensables:

$mydomain = 'domain.com';   
$myhostname = 'host.domain.com';
@mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
                   10.0.0.0/24 );

le plus important dans ton cas etant mydomain qui va determiner quand tagguer justement les messages. (quand le mail a pour destination mydomain)

soit tu as un autres fichier de conf qui precise ces parametres, soit il faut que tu les ajoutes.


autre point sans rapport avec ton pb:  ton tag2 level est bcp trop bas.
4.3 est un bonne valeur


Tutoriaux Postfix sur www.starbridge.org/spip
Messagerie Dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com

Hors ligne

#5 Le 03/02/2008, à 13:24

link182

Re : Problème SPAM avec squirrelmail

j'ai ca dans 05-domain-id /

use strict;

# $mydomain is used just for convenience in the config files and it is not
# used internally by amavisd-new except in the default X_HEADER_LINE (which
# Debian overrides by default anyway).

chomp($mydomain = `head -n 1 /etc/mailname`);

# amavisd-new needs to know which email domains are to be considered local
# to the administrative domain.  Only emails to "local" domains are subject
# to certain functionality, such as the addition of spam tags.
#
# Default local domains to $mydomain and all subdomains.  Remember to
# override or redefine this if $mydomain is changed later in the config
# sequence.

@local_domains_acl = ( ".$mydomain" );

1;  # insure a defined return
  GNU nano 2.0.2                                      Fichierà‚ : 05-node_id                                                                                  
use strict;

# $myhostname is used by amavisd-new for node identification, and it is
# important to get it right (e.g. for ESMTP EHLO, loop detection, and so on).

chomp($myhostname = `hostname --fqdn`);
1;  # insure a defined return

Hors ligne

#6 Le 03/02/2008, à 13:28

link182

Re : Problème SPAM avec squirrelmail

J'ai mis le tag2 level expres si bas afin de tester la detection de SPAM.
La detection marche parfaitement, mais je ne vois aucun tag dans Squirrelmail (headers du mail).

Je ne sais pas si cela vient d'Amavis qui ne tagge pas ou alors une option particuliere dans Squirrelmail pour voir ces fameux tags ?

Hors ligne

#7 Le 03/02/2008, à 20:44

toniotonio

Re : Problème SPAM avec squirrelmail

d'apres cette conf Amavisd prend son domain depuis le /etc/mailname

il faut que le domaine de destination du mail soit le meme que celui indiqué dans ce fichier


Tutoriaux Postfix sur www.starbridge.org/spip
Messagerie Dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com

Hors ligne

#8 Le 03/02/2008, à 21:50

link182

Re : Problème SPAM avec squirrelmail

Ok, merci pour ta réponse.

Le  problème c'est que quand je tape head -n 1 /etc/mailname dans la console cela me retourne ma machine dedibox : sd-12897.dedibox.fr

En revanche j'ai plusieurs noms de domaine sur mon serveur, et je gère des compte virtuels avec postfix et MySQL. Comment faire pour dire à  Amavis de prendre l'ensemble de mes noms de domaine ?

Merci

Hors ligne

#9 Le 03/02/2008, à 22:33

toniotonio

Re : Problème SPAM avec squirrelmail

c'est le parametre @local_domains_maps:

par exemple:

@local_domains_maps = ( [".$mydomain", '.domain.org', '.toto.com' ] );

Tutoriaux Postfix sur www.starbridge.org/spip
Messagerie Dédiée, Relais Mail Antispam/Antivirus, Infogérance 24/7: http://www.eole-its.com

Hors ligne

#10 Le 03/02/2008, à 23:01

link182

Re : Problème SPAM avec squirrelmail

Merci, cela marche en ajoutant mes ndd.

Hors ligne