Amavisd no modifica las cabeceras de mensajes spam
Buenas, a ver si me podeis ayudar. Tengo un servidor de correo al cual
le hemos instalado amavis para llevar el filtro de antivirus y spam,
antivirus con clamav que funciona perfectamente y spam con spamassassin
que en principio detecta los spam pero hay una pequeña (o grande segun
se mire) pega y es que no me modifica la cabecera del correo una vez que
lo ha marcado como spam (vamos que no lo marca). Se que lo ha detecta
como spam porque en el log asi lo dice, además le hemos indicado que
envie un correo al admin_spam y lo envia.
He revisado varios mans de bulma y otros que he conseguido por google y
en principio con la conf que tenemos deberia rular.
Mando mis ficheros de configuracion....
amavis.conf
$MYHOME = '/var/lib/amavis'; # (default is '/var/amavis')
$daemon_user = 'amavis'; # (no default (undef))
$daemon_group = 'amavis'; # (no default (undef))
$TEMPBASE = $MYHOME; # (must be set if other config vars use is)
$pid_file = "/var/run/amavis/amavisd.pid"; # (default:
"$MYHOME/amavisd.pid")
$lock_file = "/var/run/amavis/amavisd.lock"; # (default:
"$MYHOME/amavisd.lock")
$ENV{TMPDIR} = $TEMPBASE; # wise to set TMPDIR, but not obligatory
$mydomain = 'midominio.com';
$DO_SYSLOG = 1; # (defaults to false)
$inet_socket_port = 10024; # accept SMTP on this local TCP port
$forward_method = 'smtp:127.0.0.1:10025'; # where to forward checked mail
$notify_method = $forward_method; # where to submit notifications
$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not
enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not
enforced)
$MIN_EXPANSION_FACTOR = 5; # times original mail size (must be
specified)
$MAX_EXPANSION_FACTOR = 500; # times original mail size (must be
specified)
#####Avisar al que envia el mensaje con virus
$warnbannedsender = 1;
$warnbadhsender = 1;
#####Avisar al que envia el mensaje con virus
# Turn on SpamAssassin debugging (output to STDERR, use with 'amavisd
debug')
$sa_debug = 1; # defaults to false
$final_spam_destiny = D_PASS;
$sa_spam_subject_tag = '***SPAM*** ';
#$sa_spam_modifies_subj = [qw( . )]; # Modifica el subject para todos
los usuarios
$sa_tag_level_deflt = 4.0; # add spam info headers if at, or above that
level
$sa_tag2_level_deflt = 6.3; # add 'spam detected' headers at that level
$sa_kill_level_deflt = $sa_tag2_level_deflt; # triggers spam evasive actions
#$sa_kill_level_deflt = $sa_tag_level_deflt;
$virus_quarantine_to = "cuarentenavirus\@$mydomain";
$spam_admin = "cuarentenavirus\@$mydomain";
#$sa_spam_modifies_subj = 1; # may be a ref to a lookup table, default
is true
$remove_existing_spam_headers = 0;
$sa_local_tests_only = 0; # (default: false)
#$SYSLOG_LEVEL = 'mail.info';
$log_level = 2;
$banned_filename_re = new_RE(
qr'^UNDECIPHERABLE$',
qr'\.[^.]*\.(exe|vbs|pif|scr|bat|cmd|com|dll)$'i,
qr'[{}]',
qr'.\.(exe|vbs|pif|scr|bat|cmd|com)$'i,
qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb|vbe|vbs|wsc|wsf|wsh)$'ix,
qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,
qr'^\.(zip|lha|tnef|cab)$'i,
qr'^\.exe$'i,
qr'^application/x-msdownload$'i,
qr'^application/x-msdos-program$'i,
qr'^message/partial$'i, qr'^message/external-body$'i,
);
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
# Specify one string or a search list of strings (first match wins).
# The string (or: each string in a list) may be an absolute path,
# or just a program name, to be located via $path;
# Empty string or undef (=default) disables the use of that external
program.
# Optionally command arguments may be specified - only the first substring
# up to the whitespace is used for file searching.
$file = 'file'; # file(1) utility; use 3.41 or later to avoid
vulnerability
$gzip = 'gzip';
$bzip2 = 'bzip2';
$lzop = 'lzop';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc = ['nomarch', 'arc'];
$unarj = ['arj', 'unarj']; # both can extract, arj is recommended
$unrar = ['rar', 'unrar']; # both can extract, same options
$zoo = 'zoo';
$lha = 'lha';
$cpio = 'cpio'; # comment out if cpio does not support GNU options
#@bypass_virus_checks_acl = qw( . ); # uncomment to DISABLE anti-virus code
### Virus scanners
# Add X-Virus-Scanned line to mail? (default: undef)
$X_HEADER_TAG = 'X-Virus-Scanned';
$remove_existing_x_scanned_headers = 0; # leave existing X-Virus-Scanned
alone
# Don't notify sender when these viruses are found because they spoof From:
$viruses_that_fake_sender_re = new_RE(
qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|fizzer|palyh|peido|holar'i,
qr'tanatos|lentin|bridex|mimail|trojan\.dropper|dumaru|parite|spaces'i,
qr'dloader|galil|gibe|swen|netwatch|bics|sbrowse|sco|mydoom'i,
[qr'^(EICAR\.COM|Joke\.|Junk\.)'i => 0],
[qr'^(WM97|OF97|W95/CIH-|JS/Fort)'i => 0],
);
@av_scanners_backup = (
# http://www.clamav.net/
['Clam Antivirus-clamd',
\&ask_daemon, ["CONTSCAN {}\n", '/var/amavisd/clamd.sock'],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
@av_scanners = (
# http://www.clamav.net/
['Clam Antivirus - clamscan', 'clamscan',
'--stdout --disable-summary -r {}', [0], [1],
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
default/spamassassin
# /etc/default/spamassassin
# Duncan Findlay
# WARNING: please read README.spamd before using.
# There may be security risks.
# Change to one to enable spamd
ENABLED=1
# Options
# See man spamd for possible options. The -d option is automatically added.
# NOTE: version 3.0.x has switched to a "preforking" model, so you
# need to make sure --max-children is not set to anything higher than
# 5, unless you know what you're doing.
#OPTIONS="--create-prefs --max-children 5 --helper-home-dir"
OPTIONS="-c -m 10 -a -H"
# Pid file
# Where should spamd write its PID to file? If you use the -u or
# --username option above, this needs to be writable by that user.
# Otherwise, the init script will not be able to shut spamd down.
PIDFILE="/var/run/spamd.pid"
# Set nice level of spamd
#NICE="--nicelevel 15"
spamassassin/local.cf
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
###########################################################################
#
# rewrite_header Subject *****SPAM*****
# report_safe 1
# trusted_networks 212.17.35.
# lock_method flock
Gracias
Un saludo
Daniel Garcia
Reply to: