amavisd配置文件详解
2013-6-7 admin Amavisd Spamassass
版权所有:《DSPAM中文站》 => 《amavisd配置文件详解》
本文地址:http://blog.dspam.org.cn/post-42.html
除非注明,文章均为 《DSPAM中文站》 原创,欢迎转载!转载请注明本文地址,谢谢。
转自:http://blog.dspam.org.cn/post-42.html
amavisd.conf 配置文件详解:
配置文件基于amavisd-new-2.8,如果使用其他版本的amavisd-new,请参照其他版本的amavisd.conf 配置文件。
# @bypass_virus_checks_maps = (1);
控制是否启用病毒扫描;
# @bypass_spam_checks_maps = (1);
控制是否启用SPAM扫描;
# $bypass_decode_parts = 1;
控制是否启用对加密归档文件解码;
$max_servers = 2;
amavisd进程数,根据你的主机配置设置大小;
$daemon_user = 'vscan';
运行amavisd的用户;
$daemon_group = 'vscan';
运行amavisd的组;
$mydomain = 'example.com';
设置邮件域名;
# $MYHOME = '/var/amavis';
设置工作目录;
$TEMPBASE = "$MYHOME/tmp";
设置临时目录;
$ENV{TMPDIR} = $TEMPBASE;
设置临时目录的环境变量;
$QUARANTINEDIR = '/var/virusmails';
设置隔离目录;
# $quarantine_subdir_levels = 1;
隔离目录是否使用hash,使用0或者1
# $release_format = 'resend';
隔离区邮件释放格式
# $report_format = 'arf';
Email报告格式
# $daemon_chroot_dir = $MYHOME;
amavisd daemon的chroot目录
# $db_home = "$MYHOME/db";
缓存和DB文件存储目录
# $helpers_home = "$MYHOME/var";
SpamAssassin工作目录
# $lock_file = "$MYHOME/var/amavisd.lock";
lock文件路径
# $pid_file = "$MYHOME/var/amavisd.pid";
pid文件路径
$log_level = 0;
调试日志基本
$log_recip_templ = undef;
收件人日志级别
$do_syslog = 1;
日志是否由syslogd控制
$syslog_facility = 'mail';
日志写入mail日志
$enable_db = 1;
启用BDB支持
# $enable_zmq = 1;
启用ZeroMQ支持
$nanny_details_level = 2;
显示更详细的进程状态
$enable_dkim_verification = 1;
启用 DKIM 签名验证
$enable_dkim_signing = 1;
加载 DKIM 签名的代码
@local_domains_maps = ( [".$mydomain"] );
将虚拟域加到 "@local_domains_maps"中,amavisd调用SpamAssassin检查完邮件后会加入标记,每个域都需要引号,域之间用逗号分隔;
@mynetworks = qw( 127.0.0.0/8 );
定义SMTP客户端IP访问列表
$unix_socketname = "$MYHOME/amavisd.sock";
定义socket路径
$inet_socket_port = 10024;
定义amavisd侦听端口,可以指定多个,格式如“[10024,10026]”
$policy_bank{'MYNETS'} = { #定义来自@mynetworks的邮件策略,可以对@mynetworks列表的IP不做处理。
originating => 1,
os_fingerprint_method => undef,
};
$interface_policy{'10026'} = 'ORIGINATING';
$policy_bank{'ORIGINATING'} = {
};
定义一个专用TCP端口,对一部分特定用户不做处理
$sa_tag_level_deflt = 2.0;
高于这个分数,就会在邮件头加上SPAM标识
$sa_tag2_level_deflt = 6.2;
高于这个分数,允许改写邮件标题,加上SPAM标识
$sa_kill_level_deflt = 6.9;
高于这个分数,直接將邮件备份后删除
$sa_dsn_cutoff_level = 10;
高于这个分数,將不会发送DSN(delivery status notification)信息
$sa_crediblefrom_dsn_cutoff_level = 18;
同上,对应一个可能有效的“From”,真正发件人产生的反弹邮件,可能是误报
# $sa_quarantine_cutoff_level = 25;
高于这个分数,邮件不会放入隔离区
$penpals_bonus_score = 8;
当发件人被通知以前收到过这个邮件系统的本地用户的邮件的话,那这个邮件被作为垃圾邮件的系数或者分数就会降低,设置“0”或者“undef”禁止
$penpals_threshold_high = $sa_kill_level_deflt;
同$sa_kill_level_deflt
$bounce_killer_score = 100;
高于这个分数,丢弃反弹邮件
$sa_mail_body_size_limit = 400*1024;
超过400*1024的邮件就不经过SpamAssassin扫描,包括附件大小,单位"bytes"。
$sa_local_tests_only = 0;
禁止SA访问internet
# @lookup_sql_dsn =
# @storage_sql_dsn = @lookup_sql_dsn;
# $timestamp_fmt_mysql = 1;
使用MySQL存储数据,一般用不到
$virus_admin = "virusalert\@$mydomain";
$mailfrom_notify_admin = "virusalert\@$mydomain";
$mailfrom_notify_recip = "virusalert\@$mydomain";
$mailfrom_notify_spamadmin = "spam.police\@$mydomain";
$mailfrom_to_quarantine = '';
检测到病毒或者垃圾邮件时,发通知到哪个邮件地址
@addr_extension_virus_maps = ('virus');
@addr_extension_banned_maps = ('banned');
@addr_extension_spam_maps = ('spam');
@addr_extension_bad_header_maps = ('badh');
# $recipient_delimiter = '+'; # undef disables address extensions altogether
地址扩展,配置样例如下:
$recipient_delimiter = '+';
@addr_extension_spam_maps = ('spam');
$sa_tag2_level_deflt = 6.7 ; # score above which spam extension is added
$sa_kill_level_deflt = 15; # block higher score entirely
$final_spam_destiny=D_DISCARD; # junk all above kill level
或者选择性地提供扩展字符串对某些用户或子域:
@addr_extension_spam_maps = (
{ '.sub1.example.com' => 'spam', # an entire subdomain
'[email protected]' => 'spam', # a particular user
'[email protected]' => 'malware', # another user wants a different ext.
'.' => '' } # all the rest do not receive an extension
);
使用地址扩展,postfix的main.cf文件也要启用“recipient_delimiter=+”
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
设置path的环境变量
$MAXLEVELS = 14;
最多扫描压缩包的多少层
$MAXFILES = 1500;
最多扫描压缩包内多少个文件
$MIN_EXPANSION_QUOTA = 100*1024;
最小邮件限额,包括附件,单位bytes
$MAX_EXPANSION_QUOTA = 300*1024*1024;
最大邮件限额,包括附件,单位bytes
$MIN_EXPANSION_FACTOR = 1;
$MAX_EXPANSION_FACTOR = 500;
防御邮件×××,解码邮件时的最小和最大倍数,达到这值以后,会结束解码,公式如下:
quota = ($MIN_EXPANSION_QUOTA, $mail_size*$MIN_EXPANSION_FACTOR)
quota = ($MAX_EXPANSION_QUOTA, $mail_size*$MAX_EXPANSION_FACTOR)
$sa_spam_subject_tag = '***Spam*** ';
对邮件标题添加'***Spam*** '标记
$defang_virus = 1;
警告收件人,邮件感染了病毒
$defang_banned = 1;
警告收件人,邮件包含被禁止的名字
为去除坏头(标题),只能打开某些次要类别的内容;
$defang_by_ccat{CC_BADH.",3"} = 1;
标题中含有“MUL”或“CR”
$defang_by_ccat{CC_BADH.",5"} = 1;
标题大于998个字符
$defang_by_ccat{CC_BADH.",6"} = 1;
标题字段语法错误
# $myhostname = 'host.example.com';
设置邮件主机的域名
$notify_method = 'smtp:[127.0.0.1]:10025';
$forward_method = 'smtp:[127.0.0.1]:10025';
提交通知和转发邮件侦听的地址和端口
# $final_virus_destiny = D_DISCARD;
检测到病毒邮件时的动作
# $final_banned_destiny = D_DISCARD;
检测到受禁止内容邮件时的动作
# $final_spam_destiny = D_PASS;
检测到垃圾邮件时的动作
# $final_bad_header_destiny = D_PASS;
检测到含有坏邮件标题的邮件时的动作
##默认有以下几种动作:
D_PASS: 无论邮件是否有问题,都会将信件发给收件人
D_DISCARD: 邮件将被丢弃,并且不会告知收件人及发件人
D_BOUNCE: 邮件不会发送给收件人,但会通知发件人邮件没有被投递
D_REJECT: 邮件不会被投递给收件人,但会通知发件人邮件被拒绝
注意:除了 D_PASS,其它参数都会导致邮件最终不被投递到用户邮箱里
# $bad_header_quarantine_method = undef;
隔离区的文件名存放格式
如:
$virus_quarantine_method = 'local:virus-%i-%n.gz';
$spam_quarantine_method = 'local:spam-%i-%n.gz';
$banned_files_quarantine_method = 'local:banned-%i-%n.gz';
$bad_header_quarantine_method = 'local:badh-%i-%n.gz';
# $os_fingerprint_method = 'p0f:*:2345'; # to query p0f-analyzer.pl
让amavisd发送查询到p0f,格式如:
$os_fingerprint_method = 'p0f:127.0.0.1:2345';
@keep_decoded_original_maps = (new_RE(
qr'^MAIL$', # retain full original message for virus checking
qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
# qr'^Zip archive data', # don't trust Archive::Zip
));
保留完整原始邮件,进行病毒检查
$banned_filename_re = new_RE(
[ qr'^\.(rpm|cpio|tar|zip|rar)$' => 0 ],
),
附件过滤设置
对于一些特定用户指定评分
# read_hash("/var/amavis/sender_scores_sitewide"),
{
'[email protected]' => -3.0,
'[email protected]' => 3.0,
},
read_hash(\%whitelist_sender, '/var/amavis/.spamassassin/whitelist');
read_hash(\%blacklist_sender, '/var/amavis/.spamassassin/blacklist');
黑白名单设置,格式如下:
[email protected]
*@example.net
注意:以上两个文件 whitelist 和 blacklist 要手动建立,并且所属用户需为amavisd配置文件的用户
@decoders = (
);
×××列表
病毒扫描部分:
@av_scanners = (
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.sock"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
#备注:在 @av_scanners 部分中,可以只保留 ClamAV 相关的内容,其它的都注释掉。
# 在 @av_scanners_backup 备用的扫描软件,可以注释,因为clamscan的开销比clamdscan大
#@av_scanners_backup = (
# ### http://www.clamav.net/ - backs up clamd or Mail::ClamAV
# ['ClamAV-clamscan', 'clamscan',
# "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
# [0], qr/:.*\sFOUND$/m, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
#);