Différences

Ci-dessous, les différences entre deux révisions de la page.

--- informatique:reseau:messagerie:amavis [2010/02/17 15:14] – Reprise ancien Wiki bn8
+++ informatique:reseau:messagerie:amavis [2015/01/23 13:51] (Version actuelle) – [Mettre en place DKIM] bn8
@@ Ligne 1: / Ligne 1: @@
-**Exemple de fichier de configuration : //50-user//**
+====== Exemple de fichier de configuration : 50-user ======
-  use strict;
+<code>use strict;
-  #
+#
-  # Place your configuration directives here.  They will override those in
+# Place your configuration directives here.  They will override those in
-  # earlier files.
+# earlier files.
-  #
+#
-  # See /usr/share/doc/amavisd-new/ for documentation and examples of
+# See /usr/share/doc/amavisd-new/ for documentation and examples of
-  # the directives you can use in this file
+# the directives you can use in this file
-  #
+#
-  # GENERAL
+# GENERAL
-  $MYHOME = '/var/lib/amavis';   # (default is '/var/amavis')
+$MYHOME = '/var/lib/amavis';
-  $mydomain = 'test.com';      # (no useful default)
+$mydomain = 'exemple.com';
-  #$myhostname = //;
+$myhostname = 'exemple.com';
-  $daemon_user  = 'amavis';       # (no default (undef))
+$max_servers = 4;
-  $daemon_group = 'amavis';       # (no default (undef))
+$max_requests = 20;
-  $TEMPBASE = $MYHOME;           # (must be set if other config vars use is)
+$child_timeout = 5*60;
-  #$helpers_home = $MYHOME;      # (defaults to $MYHOME)
+read_hash(\%local_domains, '/etc/amavis/local_domains');
-  $pid_file  = "/var/run/amavis/amavisd.pid";  # (default: "$MYHOME/amavisd.pid")
+@mynetworks = qw( 127.0.0.0/8 );
-  $lock_file = "/var/run/amavis/amavisd.lock"; # (default: "$MYHOME/amavisd.lock")
+@mynetworks_maps = (\@mynetworks);
-  $ENV{TMPDIR} = $TEMPBASE;       # wise to set TMPDIR, but not obligatory
-  $max_servers  =  2;   # number of pre-forked children          (default 2)
+# LOGGING AND DEBUGGING
-  $max_requests = 10;   # retire a child after that many accepts (default 10)
+$DO_SYSLOG = 1;
-  $child_timeout=5*60;  # abort child if it does not complete each task in n sec
-                        # (default: 8*60 seconds)
+# MTA INTERFACE - INPUT
-  read_hash(\%local_domains, '/etc/amavis/local_domains');
+$inet_socket_port = 10024;
-  #...
+$inet_socket_bind = '127.0.0.1';
+@inet_acl = qw(127.0.0.1 [::1]);
-  @local_domains_acl = ( ".test.com" );
+$insert_received_line = 0;
+$unix_socketname = undef;
-  # LOGGING AND DEBUGGING
-  $DO_SYSLOG = 1;                 # (defaults to false)
+# MTA INTERFACE - OUTPUT
-  #$SYSLOG_LEVEL = 'user.info';     # (facility.priority, default 'mail.info')
+# MAIL FORWARDING
-  #NOTE: levels are not strictly observed and are somewhat arbitrary
+$forward_method = 'smtp:[127.0.0.1]:10025';
-  # 0: startup/exit/failure messages, viruses detected
-  # 1: args passed from client, some more interesting messages
+# QUARANTINE
-  # 2: virus scanner output, timing
+$QUARANTINEDIR = "$MYHOME/virusmails";
-  # 3: server, client
-  # 4: decompose parts
+$virus_quarantine_method = 'local:virus-%m';
-  # 5: more debug details
+$spam_quarantine_method = 'local:spam-%m';
-  $log_level = 0;         # (defaults to 0)
+$banned_files_quarantine_method = 'local:banned-%m';
+$bad_header_quarantine_method = 'local:badh-%m';
-  # MTA INTERFACE - INPUT
-  $inet_socket_port = 10024;        # accept SMTP on this local TCP port
+$virus_quarantine_to = "virus\@$mydomain;
-  $inet_socket_bind = '127.0.0.1';  # limit socket bind to loopback interface
+$banned_quarantine_to     = undef;
-  @inet_acl = qw( 127.0.0.1 [::1]);      # allow SMTP access only from localhost IP
+$bad_header_quarantine_to = undef;
-  $insert_received_line = 1;
+$spam_quarantine_to       = "spam\@$mydomain";
-  $unix_socketname = undef;         # disable listening on a unix socket
+# NOTIFICATIONS
-  # MTA INTERFACE - OUTPUT
+$notify_method = $forward_method;
+$mailfrom_notify_admin     = "postmaster\@$mydomain";
-  # Mail Forwarding
+$mailfrom_notify_recip     = "postmaster\@$mydomain";
-  $forward_method = 'smtp:[127.0.0.1]:10025';  # where to forward checked mail
+$mailfrom_notify_spamadmin = "postmaster\@$mydomain";
+$warnvirussender = undef;
+$warnvirusrecip = undef;
-  # NOTIFICATIONS
+$virus_admin = undef;
-  $notify_method = $forward_method;          # where to submit notifications
+$warnbannedsender = undef;
-  #$mailfrom_notify_admin     = "virusalert\@$mydomain";
+$warnbadhsender = undef;
-  #$mailfrom_notify_recip     = "virusalert\@$mydomain";
+$warnbannedrecip = undef;
-  #$mailfrom_notify_spamadmin = "spam.police\@$mydomain";
+$warnspamsender = undef;
-  $warn_offsite = undef;    # (defaults to false (undef), i.e. only notify locals)
+$warn_offsite = 1;
-  # BAD HEADER
+# ADDING ADDRESS EXTENSIONS TO RECIPIENTS - 'plus addressing'
-  $final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested
-  $bad_header_quarantine_to = undef;
+# MAIL DECODING
-  $warnbadhsender = undef;    # (defaults to false (undef))
+# BAD HEADER
-  # ANTI-VIRUS AND INVALID/FORBIDDEN CONTENTS CONTROLS
+$final_bad_header_destiny = D_PASS;
-  @bypass_virus_checks_maps = (
-     \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
+# ANTI-VIRUS AND INVALID/FORBIDDEN CONTENTS CONTROLS
-  @bypass_virus_checks_acl =  map ( {'!'.$_} keys(%local_domains));
+@bypass_virus_checks_maps = (
-  push(@bypass_virus_checks_acl,'.');
+   \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re);
+@bypass_virus_checks_acl =  map ( {'!'.$_} keys(%local_domains));
-  $final_virus_destiny      = D_BOUNCE; # (defaults to D_BOUNCE)
+push(@bypass_virus_checks_acl,'.');
-  $virus_quarantine_to  = 'virus@test.com';
+$final_virus_destiny      = D_DISCARD;
-  $first_infected_stops_scan = 1;  # default is false, all scanners are called
+$first_infected_stops_scan = 1;
-  $X_HEADER_TAG = 'X-Virus-Scanned';      # (default: undef)
-  $remove_existing_x_scanned_headers = undef; # leave existing X-Virus-Scanned alone
+# BANNING
-  $replace_existing_extension = 1;        # (default is false)
+$final_banned_destiny     = D_PASS;
-  $localpart_is_case_sensitive = undef;   # (default is false)
-  $warnvirussender = 1;       # (defaults to false (undef))
+# ANTI-SPAM CONTROLS
-  $warnvirusrecip = 1;        # (defaults to false (undef))
+@bypass_spam_checks_maps = (
-  $virus_admin = "postmaster\@$mydomain";         # due to D_DISCARD default
+   \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
+@bypass_spam_checks_acl =  map ( {'!'.$_} keys(%local_domains));
-  # BANNING
+push(@bypass_spam_checks_acl,'.');
-  $final_banned_destiny     = D_PASS;  # (defaults to D_BOUNCE)
+$final_spam_destiny       = D_DISCARD;
-  $banned_quarantine_to     = undef;
+$sa_local_tests_only = undef;
-  $warnbannedrecip = 1;       # (defaults to false (undef))
+$sa_auto_whitelist = undef;
-  $warnbannedsender = 1;      # (defaults to false (undef))
+$sa_tag_level_deflt  = -1000; # Ajout d'en-tetes decrivant l'etat "spam" du mail
-  #$banned_filename_re = new_RE(
+$sa_tag2_level_deflt = 5; # Modification du sujet pour cette note
-  ##  qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
+$sa_kill_level_deflt = 7; # Mise en quarantaine si > a cette note
-  #   qr'\.[^.]*\.(exe|vbs|pif|scr|bat|cmd|com|dll)$'i, # some double extensions
+$sa_dsn_cutoff_level = undef;
-  #   qr'[{}]',     # curly braces in names (serve as Class ID extensions - CLSID)
+$sa_spam_subject_tag = '***SPAM*** ';
-  ##  qr'.\.(exe|vbs|pif|scr|bat|cmd|com)$'i,           # banned extension - basic
+$sa_spam_modifies_subj = undef;
-  ##  qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|
-  ##         jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb|
+# Whitelist
-  ##         vbe|vbs|wsc|wsf|wsh)$'ix,                  # banned extension - long
+@whitelist_sender_acl = qw( .blabla.fr );
-  ##  qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i, # banned extension - WinZip vulnerab.
-  ##  qr'^\.(zip|lha|tnef|cab)$'i,                      # banned file(1) types
+# MAPPING A CONTENTS CATEGORY TO A SETTING CHOSEN
-  ##  qr'^\.exe$'i,                                     # banned file(1) types
-  ##  qr'^application/x-msdownload$'i,                  # banned MIME types
+# POLICY BANKS
-  ##  qr'^application/x-msdos-program$'i,
+$policy_bank{'MYNETS'} = {
-  #   qr'^message/partial$'i,  # rfc2046. this one is deadly for Outcrook
+       bypass_spam_checks_maps   => [1],
-  ##  qr'^message/external-body$'i, # block rfc2046
+       bypass_banned_checks_maps => [1]
-  #);
+};
-  # ANTI-SPAM CONTROLS
+#------------ Do not modify anything below this line -------------
-  @bypass_spam_checks_maps = (
+;  # insure a defined return
-     \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re);
-  @bypass_spam_checks_acl =  map ( {'!'.$_} keys(%local_domains));
+# vim: filetype=perl</code>
-  push(@bypass_spam_checks_acl,'.');
+Contenu du fichier ///etc/amavis/local_domains// :
-  $final_spam_destiny  = D_BOUNCE;  # (defaults to D_REJECT)
-  $sa_local_tests_only = undef;   # (default: false)
+  exemple.com
-  $sa_auto_whitelist = undef;   # defaults to undef
+  exmeple.org
-  $sa_tag_level_deflt  = -10000; # add spam info headers if at, or above that level
+  ...
-  $sa_tag2_level_deflt = 6; # add 'spam detected' headers at that level
-  $sa_kill_level_deflt = 12; # triggers spam evasive actions
-  $sa_dsn_cutoff_level = undef;  # spam level beyond which a DSN is not sent,
-                              # effectively turning D_BOUNCE into D_DISCARD;
-                              # undef disables this feature and is a default;
-  $sa_spam_subject_tag = '***SPAM*** ';   # (defaults to undef, disabled)
-  $sa_spam_modifies_subj = 0; # may be a ref to a lookup table, default is true
-  $remove_existing_spam_headers  = 0;     # remove existing spam headers if
-  $spam_quarantine_to = "spam\@test.com";
-  $warnspamsender = 1;        # (defaults to false (undef))
-  #------------ Do not modify anything below this line -------------
-;  # insure a defined return
-  # vim: filetype=perl
-**Signification D_PASS, D_REJECT, D_BOUNCE, D_DISCARD**
+===== Signification D_PASS, D_REJECT, D_BOUNCE, D_DISCARD =====
   * **D_PASS** :
     * Le message sera distribué aux destinataires.
@@ Ligne 148: / Ligne 133: @@
     * Le message sera stoppé et une notification SMTP (non-delivery) sera envoyé.
-**Pyzor**
+====== Configurer l'utilisation de amavis par postfix ======
+Editez le fichier ///etc/postfix/master.cf// :
+  * Modifier : <code>smtp      inet  n   -   -   -   -   smtpd</code> en :<code>smtp      inet  n   -   -   -   -   smtpd
+    -o content_filter=smtp-amavis:[127.0.0.1]:10024</code>
+  * Ajouter : <code>127.0.0.1:10025 inet n  -       -     -       -  smtpd
+    -o content_filter=
+    -o local_recipient_maps=
+    -o relay_recipient_maps=
+    -o smtpd_restriction_classes=
+    -o smtpd_client_restrictions=
+    -o smtpd_helo_restrictions=
+    -o smtpd_sender_restrictions=
+    -o smtpd_recipient_restrictions=permit_mynetworks,reject
+    -o mynetworks=127.0.0.0/8
+    -o strict_rfc821_envelopes=yes
+    -o smtpd_error_sleep_time=0
+    -o smtpd_soft_error_limit=1001
+    -o smtpd_hard_error_limit=1000
+smtp-amavis unix -      -       -     -       4  smtp
+    -o smtp_data_done_timeout=1200
+    -o smtp_send_xforward_command=yes
+    -o disable_dns_lookups=yes</code>
+====== Pyzor ======
   pyzor discover
@@ Ligne 158: / Ligne 173: @@
   * Si le //discover// pause problème. Ouvrir le fichier //~/.pyzor/servers// et mettre dans le fichier :
-.94.255.100:24441
+  public.pyzor.org:24441
+====== Razor ======
-**Razor**
   su - amavis
   razor-admin -discover
@@ Ligne 171: / Ligne 185: @@
   * Firewalling : le port 2703 TCP doit être ouvert vers l'extérieur.
-**Références :**
+====== Installation des decoders ======
+<code>apt-get install arc arj bzip2 cabextract gzip lzop p7zip pax ripole rpm2cpio unrar-free zip zoo</code>
+====== Réinitialiser le filtrage bayésien ======
+Il peut arriver après un certain temps que le filtrage bayésien d'Amavis (utilisant Spamassasin) devienne efficace qu'auparavant. Il peut alors être nécessaire de réinitialiser la base de filtrage. Pour cela :
+<code>su - amavis
+sa-learn --clear
+exit
+service amavis restart</code>
+====== Mettre en place DKIM ======
+Amavis peut s'occuper de la signature DKIM de vos mails sortant. Pour cela :
+  - Commencer par générer la clé qui sera utilisée : <code>$ su - amavis
+$ mkdir /var/lib/amavis/db/dkim
+$ /usr/sbin/amavisd-new genrsa /var/lib/amavis/db/dkim/example.com.key.pem
+Private RSA key successfully written to file "/var/lib/amavis/db/dkim/example.com.key.pem" (1024 bits, PEM format)</code>
+  - Récupérer ensuite la clé publique à mettre en place au niveau de la zone DNS : <code>$ su - amavis
+$ /usr/sbin/amavisd-new show showkeys
+; key#1, domain example.com, /var/lib/amavis/db/dkim/example.com.key.pem
+main._domainkey.example.com.	3600 TXT (
+  "v=DKIM1; p="
+  "MIGfMA0GCSqGSXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+  "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+  "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
+  "XXXXXXXXXXXXXXXXXXQAB")</code>
+  - Ajouter cet enregistrement dans votre zone DNS, sans faire de reload pour le moment
+  - Il faut ensuite activer la signature des messages dans la configuration d'avamis. Pour cela dans le fichier ///etc/amavis/conf.d/50-user//, ajouter :
+    - En global : <code>$enable_dkim_verification = 1;
+dkim_key("example.com", "main", "/var/lib/amavis/db/dkim/example.com.key.pem");
+@dkim_signature_options_bysender_maps = ( { "." => { ttl => 21*24*3600, c => "relaxed/simple" } } );</code>
+    - Dans la //policy_bank// gérant les mails sortant : <code>enable_dkim_signing => 1,</code>
+  - Redémarrer Amavis pour prendre en compte la modification et faite le reload de votre zone DNS
+  - Vous pouvez vérifier que votre zone à bien été configuré : <code>$ su - amavis
+$ /usr/sbin/amavisd-new testkeys
+TESTING#1: main._domainkey.example.com           => pass</code>
+====== Références ======
   * http://support.radicalspam.org/public/wiki/doc/amavis
   * http://irp.nain-t.net/doku.php/200messagerie:020postfix2:060_amavis