我最近一直在我们的邮件服务器上对付垃圾邮件问题。 特别是有一个帐户正在接收垃圾邮件。 SpamAssassin的记忆使用是我们的担忧之一。
我所做的是在Exim中启用RBL。 我现在看到很多基于各种RBL的Exim日志中的拒绝通知,这是很好的。
但是,当我运行Eximstats时,这些数字看起来与启用RBL之前的数字相同。 我假设,因为电子邮件仍被拒绝之前以某种方式login。 这是怎么回事,还是我错过了别的?
有谁知道这些邮件在被SpamAssassin处理之前是否被拒绝? 还是有人知道我怎么能find? 有没有一个标准的方式来产生SpamAssassin统计,类似于Eximstats,以便我可以比较数字?
感谢您的时间和任何build议。
编辑: 这是我的Eximconfiguration文件的ACL部分
###################################################################### # ACLs # ###################################################################### begin acl # ACL that is used after the RCPT command check_recipient: # to block certain wellknown exploits, Deny for local domains if # local parts begin with a dot or contain @ % ! / | deny domains = +local_domains local_parts = ^[.] : ^.*[@%!/|] # to restrict port 587 to authenticated users only # see also daemon_smtp_ports above accept hosts = +auth_relay_hosts condition = ${if eq {$interface_port}{587} {yes}{no}} endpass message = relay not permitted, authentication required authenticated = * # allow local users to send outgoing messages using slashes # and vertical bars in their local parts. # Block outgoing local parts that begin with a dot, slash, or vertical # bar but allows them within the local part. # The sequence \..\ is barred. The usage of @ % and ! is barred as # before. The motivation is to prevent your users (or their virii) # from mounting certain kinds of attacks on remote sites. deny domains = !+local_domains local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./ # local source whitelist # accept if the source is local SMTP (ie not over TCP/IP). # Test for this by testing for an empty sending host field. accept hosts = : # sender domains whitelist # accept if sender domain is in whitelist accept sender_domains = +whitelist_domains # sender hosts whitelist # accept if sender host is in whitelist accept hosts = +whitelist_hosts accept hosts = +whitelist_hosts_ip # envelope senders whitelist # accept if envelope sender is in whitelist accept senders = +whitelist_senders # accept mail to postmaster in any local domain, regardless of source accept local_parts = postmaster domains = +local_domains # accept mail to abuse in any local domain, regardless of source accept local_parts = abuse domains = +local_domains # accept mail to hostmaster in any local domain, regardless of source accept local_parts = hostmaster domains =+local_domains # OPTIONAL MODIFICATIONS: # If the page you're using to notify senders of blocked email of how # to get their address unblocked will use a web form to send you email so # you'll know to unblock those senders, then you may leave these lines # commented out. However, if you'll be telling your senders of blocked # email to send an email to [email protected], then you should # replace "errors" with the left side of the email address you'll be # using, and "example.com" with the right side of the email address and # then uncomment the second two lines, leaving the first one commented. # Doing this will mean anyone can send email to this specific address, # even if they're at a blocked domain, and even if your domain is using # blocklists. # accept mail to [email protected], regardless of source # accept local_parts = errors # domains = example.com # deny so-called "legal" spammers" deny message = Email blocked by LBL - to unblock see http://www.example.com/ # only for domains that do want to be tested against RBLs domains = +use_rbl_domains sender_domains = +blacklist_domains # deny using hostname in bad_sender_hosts blacklist deny message = Email blocked by BSHL - to unblock see http://www.example.com/ # only for domains that do want to be tested against RBLs domains = +use_rbl_domains hosts = +bad_sender_hosts # deny using IP in bad_sender_hosts blacklist deny message = Email blocked by BSHL - to unblock see http://www.example.com/ # only for domains that do want to be tested against RBLs domains = +use_rbl_domains hosts = +bad_sender_hosts_ip # deny using email address in blacklist_senders deny message = Email blocked by BSAL - to unblock see http://www.example.com/ domains = +use_rbl_domains senders = +blacklist_senders # By default we do NOT require sender verification. # Sender verification denies unless sender address can be verified: # If you want to require sender verification, ie, that the sending # address is routable and mail can be delivered to it, then # uncomment the next line. If you do not want to require sender # verification, leave the line commented out #require verify = sender # deny using .spamhaus deny message = Email blocked by SPAMHAUS - to unblock see http://www.example.com/ # only for domains that do want to be tested against RBLs domains = +use_rbl_domains dnslists = sbl.spamhaus.org # deny using ordb # deny message = Email blocked by ORDB - to unblock see http://www.example.com/ # # only for domains that do want to be tested against RBLs # domains = +use_rbl_domains # dnslists = relays.ordb.org # deny using sorbs smtp list deny message = Email blocked by SORBS - to unblock see http://www.example.com/ # only for domains that do want to be tested against RBLs domains = +use_rbl_domains dnslists = dnsbl.sorbs.net=127.0.0.5 # Next deny stuff from more "fuzzy" blacklists # but do bypass all checking for whitelisted host names # and for authenticated users # deny using spamcop deny message = Email blocked by SPAMCOP - to unblock see http://www.example.com/ hosts = !+relay_hosts domains = +use_rbl_domains !authenticated = * dnslists = bl.spamcop.net # deny using njabl deny message = Email blocked by NJABL - to unblock see http://www.example.com/ hosts = !+relay_hosts domains = +use_rbl_domains !authenticated = * dnslists = dnsbl.njabl.org # deny using cbl deny message = Email blocked by CBL - to unblock see http://www.example.com/ hosts = !+relay_hosts domains = +use_rbl_domains !authenticated = * dnslists = cbl.abuseat.org # deny using all other sorbs ip-based blocklist besides smtp list deny message = Email blocked by SORBS - to unblock see http://www.example.com/ hosts = !+relay_hosts domains = +use_rbl_domains !authenticated = * dnslists = dnsbl.sorbs.net!=127.0.0.6 # deny using sorbs name based list deny message = Email blocked by SORBS - to unblock see http://www.example.com/ domains =+use_rbl_domains # rhsbl list is name based dnslists = rhsbl.sorbs.net/$sender_address_domain # accept if address is in a local domain as long as recipient can be verified accept domains = +local_domains endpass message = "Unknown User" verify = recipient # accept if address is in a domain for which we relay as long as recipient # can be verified accept domains = +relay_domains endpass verify=recipient # accept if message comes for a host for which we are an outgoing relay # recipient verification is omitted because many MUA clients don't cope # well with SMTP error responses. If you are actually relaying from MTAs # then you should probably add recipient verify here accept hosts = +relay_hosts accept hosts = +auth_relay_hosts endpass message = authentication required authenticated = * deny message = relay not permitted # default at end of acl causes a "deny", but line below will give # an explicit error message: deny message = relay not permitted # ACL that is used after the DATA command check_message: accept
SpamAssasin(通常)从DATA ACL和RCPT TO ACL中的RBL调用 – 在DATA之前。
在RCTP中,RBL将Exim拒绝:在configuration节中
deny message = <msg> <additional conditions> dnslists = <RBL service address>
但你有空的数据ACL(下面) – 是所有的ACLconfiguration?
# ACL that is used after the DATA command check_message: accept
如果在ACL中没有“spam =”行,我想你会使用exim-sa。
在Exim 文档第41.3节中查看其他(推荐)调用SA的方法。
检查/var/log/syslog中的spamd输出; 至less在我们的configuration中,SpamAssassin将logging每个已经检查的消息ID和syslog中的相应结果。
我所做的是在Exim中启用RBL。 我现在看到很多基于各种RBL的Exim日志中的拒绝通知,这是很好的。
不,这不对 :/
如果您仅仅因为将发送MTA列在单个黑名单而拒绝邮件,则会丢失合法邮件,这在我看来是不可接受的。
我公司运行两个邮件中继转发大约60万用户的邮件; 其中几个帐户每周都会被黑客入侵,并将开始发送垃圾邮件。 我们监控我们的日志以尽快识别这些账户,然后我们禁用它们,但是我们的服务器有时最终会在一到两个黑名单上,这是不可避免的。 因此,我认为仅仅因为发送MTA被列入黑名单而拒绝邮件是一个严重的错误。
我们所有〜800台服务器都使用SpamAssassin来识别垃圾邮件,而且他们都不会直接拒绝可疑的垃圾邮件。 相反,垃圾邮件通过筛选脚本被分类到垃圾邮件文件夹中,以便用户可以自己决定。 一个黑名单通常只会导致更高的SpamAssassin分数,但只要邮件没有其他错误,它就会正常传送。