J'ai installe un serveur de filtre spamassassin, pour mon serveur exchange. Le relaying se apsse bien, l'entete est bien modifie par spamassassin, certains messages meme, a juste titre sont considérés comme du spam!
Cependant, je trouve quil a toujours beaucoup de mal a identifier certains spams, meme apres l'installation (reussie?) de rules du jour.
Je me demande si mon installation est correcte.....
voici mon fichier local.cf
- Code: Tout sélectionner
# Generated by http://www.yrex.com/spam/spamconfig.php (version 1.50)
# How many hits before a message is considered spam.
required_score 5.0
# Change the subject of suspected spam
rewrite_header subject [ SPAM ]
# Encapsulate spam in an attachment (0=no, 1=yes, 2=safe)
report_safe 1
# Enable the Bayes system
use_bayes 1
# Enable Bayes auto-learning
bayes_auto_learn 1
# Enable or disable network checks
skip_rbl_checks 0
use_razor2 1
use_dcc 1
use_pyzor 1
mon fichier de config rulesdujour
- Code: Tout sélectionner
SA_DIR="/etc/mail/spamassassin"
MAIL_ADRESS="administrateur@domain.fr"
SA_RESTART="/etc/init.d/spamassassin restart"
SA_LINT="spamassassin --lint"
TMPDIR="${SA_DIR}/RulesDuJour"
SINGLE_EMAIL_ONLY=true
TRUSTED_RULESETS="TRIPWIRE ANTIDRUG SARE_EVILNUMBERS0 SARE_EVILNUMBERS1 \
SARE_EVILNUMBERS2 RANDOMVAL BOGUSVIRUS \
SARE_ADULT SARE_FRAUD SARE_FRAUD_PRE25X SARE_BML SARE_BML_PRE25X \
SARE_RATWARE SARE_SPOOF SARE_BAYES_POISON_NXM SARE_OEM SARE_RANDOM \
SARE_HEADER SARE_HEADER0 SARE_HEADER1 SARE_HEADER2 SARE_HEADER3 \
SARE_HEADER_ENG SARE_HEADER_X264_X30 SARE_HEADER_X30 SARE_HTML \
SARE_HTML0 SARE_HTML1 SARE_HTML2 SARE_HTML3 SARE_HTML4 SARE_HTML_ENG \
SARE_HTML_PRE300 SARE_SPECIFIC SARE_OBFU SARE_OBFU0 SARE_OBFU1 SARE_OBFU2 \
SARE_OBFU3 SARE_REDIRECT SARE_REDIRECT_POST300 SARE_SPAMCOP_TOP200 \
SARE_GENLSUBJ SARE_GENLSUBJ0 SARE_GENLSUBJ1 SARE_GENLSUBJ2 \
SARE_GENLSUBJ3 \
SARE_GENLSUBJ_X30 \
SARE_GENLSUBJ_ENG \
SARE_HIGHRISK \
SARE_UNSUB \
SARE_URI0 \
SARE_URI1 \
SARE_URI2 \
SARE_URI3 \
SARE_URI_ENG \
SARE_WHITELIST \
SARE_WHITELIST_PRE30"
le listage des fichiers dans mon /usr/share/spamassassin :
- Code: Tout sélectionner
10_misc.cf 70_sare_header.cf
20_anti_ratware.cf 70_sare_header_eng.cf
20_body_tests.cf 70_sare_header_x264_x30.cf
20_compensate.cf 70_sare_header_x30.cf
20_dnsbl_tests.cf 70_sare_highrisk.cf
20_drugs.cf 70_sare_html0.cf
20_fake_helo_tests.cf 70_sare_html1.cf
20_head_tests.cf 70_sare_html2.cf
20_html_tests.cf 70_sare_html3.cf
20_meta_tests.cf 70_sare_html4.cf
20_phrases.cf 70_sare_html.cf
20_porn.cf 70_sare_html_eng.cf
20_ratware.cf 70_sare_html_x30.cf
20_uri_tests.cf 70_sare_obfu0.cf
23_bayes.cf 70_sare_obfu1.cf
25_body_tests_es.cf 70_sare_obfu2.cf
25_hashcash.cf 70_sare_obfu3.cf
25_spf.cf 70_sare_obfu.cf
25_uribl.cf 70_sare_oem.cf
30_text_de.cf 70_sare_random.cf
30_text_fr.cf 70_sare_specific.cf
30_text_nl.cf 70_sare_spoof.cf
30_text_pl.cf 70_sare_unsub.cf
50_scores.cf 70_sare_uri0.cf
60_whitelist.cf 70_sare_uri1.cf
65_debian.cf 70_sare_uri3.cf
70_sare_adult.cf 70_sare_uri_eng.cf
70_sare_bayes_poison_nxm.cf 70_sare_whitelist.cf
70_sare_evilnum0.cf 70_sare_whitelist_pre30.cf
70_sare_evilnum1.cf 70_sc_top200.cf
70_sare_evilnum2.cf 71_sare_bml_pre25x.cf
70_sare_genlsubj0.cf 71_sare_redirect_pre3.0.0.cf
70_sare_genlsubj1.cf 72_sare_bml_post25x.cf
70_sare_genlsubj2.cf 72_sare_redirect_post3.0.0.cf
70_sare_genlsubj3.cf 99_FVGT_Tripwire.cf
70_sare_genlsubj.cf 99_sare_fraud_post25x.cf
70_sare_genlsubj_eng.cf 99_sare_fraud_pre25x.cf
70_sare_genlsubj_x30.cf
70_sare_header0.cf languages
70_sare_header1.cf triplets.txt
70_sare_header2.cf user_prefs.template
70_sare_header3.cf
enfin, ce que je trouve inquietant, mon execution de rules_du_jour :
- Code: Tout sélectionner
exec: wget -N http://sandgnat.com/rdj/rules_du_jour > /etc/mail/spamassassin/RulesDuJour/wget.log 2>&1
wget_output: --10:39:43-- http://sandgnat.com/rdj/rules_du_jour
=> `rules_du_jour'
Résolution de sandgnat.com... 208.42.148.125
Connexion vers sandgnat.com[208.42.148.125]:80...connecté.
requête HTTP transmise, en attente de la réponse...200 OK
Longueur: 63,479 [application/octet-stream]
Le fichier du serveur n'est pas plus récent que le fichier local « rules_du_jour » -- pas de récupération.
Performing preliminary lint (sanity check; does the CURRENT config lint?).
No files updated; No restart required.
Rules Du Jour Run Summary:RulesDuJour Run Summary on Tux:
***NOTICE***: spamassassin --lint failed. This means that you have an error somwhere in your SpamAssassin configuration. To determine what the problem is, please run 'spamassassin --lint' from a shell and notice the error messages it prints. For more (debug) information, add the -D switch to the command. Usually the problem will be found in local.cf, user_prefs, or some custom rulelset found in /etc/mail/spamassassin. Here are the errors that 'spamassassin --lint' reported:
warning: description for REMOVE_PAGE is over 50 chars
warning: description exists for non-existent rule DNS_FROM_RFCI_DSN
warning: description for MAILTO_TO_SPAM_ADDR is over 50 chars
warning: description exists for non-existent rule RCVD_IN_OPM_WINGATE
warning: description for SOME_BREAKTHROUGH is over 50 chars
warning: description for RATWARE_EGROUPS is over 50 chars
warning: description for RATWARE_OE_MALFORMED is over 50 chars
warning: description for EXCUSE_3 is over 50 chars
warning: description for BANKRUPTCY is over 50 chars
warning: description for BILL_1618 is over 50 chars
warning: description for FULL_REFUND is over 50 chars
warning: description for FROM_NO_USER is over 50 chars
warning: description for CANNOT_BE_SPAM is over 50 chars
warning: description for PLING_QUERY is over 50 chars
warning: description for MISSING_MIMEOLE is over 50 chars
warning: description for RCVD_IN_BSP_TRUSTED is over 50 chars
warning: description for CELL_PHONE_IMPROVE is over 50 chars
warning: description for FORGED_TELESP_RCVD is over 50 chars
warning: description exists for non-existent rule RCVD_IN_OPM_SOCKS
warning: description for TO_ADDRESS_EQ_REAL is over 50 chars
warning: description for FROM_NO_LOWER is over 50 chars
warning: description for OBSCURED_EMAIL is over 50 chars
warning: description for HTML_FONT_FACE_CAPS is over 50 chars
warning: description for WE_HONOR_ALL is over 50 chars
warning: description for RESISTANCE_IS_FUTILE is over 50 chars
warning: description for MIME_BOUND_DIGITS_7 is over 50 chars
warning: description for BAYES_50 is over 50 chars
warning: description for MIME_HTML_ONLY is over 50 chars
warning: description for DATE_IN_FUTURE_24_48 is over 50 chars
warning: description for PORN_16 is over 50 chars
warning: description for ROUND_THE_WORLD_LOCAL is over 50 chars
warning: description for OBFUSCATING_COMMENT is over 50 chars
warning: description for SUSPICIOUS_RECIPS is over 50 chars
warning: description for FROM_ALL_NUMS is over 50 chars
warning: description for HIDE_WIN_STATUS is over 50 chars
warning: description for RCVD_IN_MAPS_RSS is over 50 chars
warning: description for MONEY_BACK is over 50 chars
warning: description for MIME_SUSPECT_NAME is over 50 chars
warning: description for SUBJ_HAS_UNIQ_ID is over 50 chars
warning: description for RCVD_IN_MAPS_RBL is over 50 chars
warning: description for EXCUSE_12 is over 50 chars
warning: description for MILLION_USD is over 50 chars
warning: description for ROUND_THE_WORLD is over 50 chars
warning: description for MIME_HEADER_CTYPE_ONLY is over 50 chars
warning: description for SUBJ_YOUR_DEBT is over 50 chars
warning: description for REMOVE_POSTAL is over 50 chars
warning: description for EXCUSE_6 is over 50 chars
warning: description for BODY_ENHANCEMENT is over 50 chars
warning: description for FROM_AND_TO_SAME is over 50 chars
warning: description for FORGED_MUA_IMS is over 50 chars
warning: description for RAZOR2_CF_RANGE_51_100 is over 50 chars
warning: description for RCVD_IN_DSBL is over 50 chars
warning: description for BAYES_99 is over 50 chars
warning: description for RATWARE_HASH_2 is over 50 chars
warning: description for FORGED_AOL_RCVD is over 50 chars
warning: description for YOU_WON is over 50 chars
warning: description for FROM_HAS_ULINE_NUMS is over 50 chars
warning: description for HTML_IMAGE_ONLY_08 is over 50 chars
warning: description for FORGED_MUA_OUTLOOK is over 50 chars
warning: description for EXCUSE_7 is over 50 chars
warning: description for FREE_ACCESS is over 50 chars
warning: description for MARKETING_PARTNERS is over 50 chars
warning: description for DATE_IN_FUTURE_03_06 is over 50 chars
warning: description for NO_PURCHASE is over 50 chars
warning: description for HTML_FONT_INVISIBLE is over 50 chars
warning: description for RCVD_IN_MAPS_NML is over 50 chars
warning: description for BAYES_95 is over 50 chars
warning: description for FORGED_MUA_MOZILLA is over 50 chars
warning: description for EXCUSE_23 is over 50 chars
warning: description for COPY_ACCURATELY is over 50 chars
warning: description for FROM_WEBMAIL_END_NUMS6 is over 50 chars
warning: description for SUBJ_ILLEGAL_CHARS is over 50 chars
warning: description for UNDISC_RECIPS is over 50 chars
warning: description for DATE_IN_FUTURE_48_96 is over 50 chars
warning: description for X_MSMAIL_PRIORITY_HIGH is over 50 chars
warning: description for FORGED_MUA_OIMO is over 50 chars
warning: description for GAPPY_SUBJECT is over 50 chars
warning: description for URI_IS_POUND is over 50 chars
warning: description for MULTI_FORGED is over 50 chars
warning: description for MICRO_CAP_WARNING is over 50 chars
warning: description for MAILTO_TO_REMOVE is over 50 chars
warning: description for FREE_PREVIEW is over 50 chars
warning: description exists for non-existent rule HTML_IMAGE_ONLY_02
warning: description for HTML_IMAGE_ONLY_04 is over 50 chars
warning: description for BAYES_20 is over 50 chars
warning: description for RATWARE_HASH_2_V2 is over 50 chars
warning: description for MIME_BOUND_RKFINDY is over 50 chars
warning: description for DATE_IN_FUTURE_12_24 is over 50 chars
warning: description for BEST_PORN is over 50 chars
warning: description for BAYES_00 is over 50 chars
warning: description for TO_NO_USER is over 50 chars
warning: description for UNCLAIMED_MONEY is over 50 chars
warning: description for HTML_WEB_BUGS is over 50 chars
warning: description for DATE_IN_PAST_24_48 is over 50 chars
warning: description for BARGAIN_URL is over 50 chars
warning: description for EXCUSE_REMOVE is over 50 chars
warning: description for RAZOR2_CHECK is over 50 chars
warning: description for HEAD_ILLEGAL_CHARS is over 50 chars
warning: description for RICH is over 50 chars
warning: description for BAYES_05 is over 50 chars
warning: description for NO_DNS_FOR_FROM is over 50 chars
warning: description for NO_REAL_NAME is over 50 chars
warning: description for WHY_WAIT is over 50 chars
warning: description for INVALID_DATE_TZ_ABSURD is over 50 chars
warning: description for HABEAS_INFRINGER is over 50 chars
warning: description for TO_EMPTY is over 50 chars
warning: description for HTML_IMAGE_ONLY_12 is over 50 chars
warning: description for DATE_IN_PAST_48_96 is over 50 chars
warning: description for HTML_IMAGE_ONLY_10 is over 50 chars
warning: description exists for non-existent rule HTML_IMAGE_ONLY_10
warning: description exists for non-existent rule RCVD_IN_OPM_HTTP
warning: description for WITH_LC_SMTP is over 50 chars
warning: description for PREST_NON_ACCREDITED is over 50 chars
warning: description for BEEN_TURNED_DOWN is over 50 chars
warning: description exists for non-existent rule RCVD_IN_OPM_HTTP_POST
warning: description for MIME_BOUND_MANY_HEX is over 50 chars
warning: description for US_DOLLARS_3 is over 50 chars
warning: description for BE_BOSS is over 50 chars
warning: description for FREE_QUOTE_INSTANT is over 50 chars
warning: description for SELECTED_YOU is over 50 chars
warning: description for NIGERIAN_SUBJECT2 is over 50 chars
warning: description for HTML_EVENT_UNSAFE is over 50 chars
warning: description for MAILTO_SUBJ_REMOVE is over 50 chars
warning: description for EXCUSE_4 is over 50 chars
warning: description for RCVD_IN_MAPS_DUL is over 50 chars
warning: description for PORN_15 is over 50 chars
warning: description for DATE_IN_FUTURE_96_XX is over 50 chars
warning: description for DCC_CHECK is over 50 chars
warning: description for FORGED_MUA_EUDORA is over 50 chars
warning: description for BAYES_60 is over 50 chars
warning: description for FORGED_QUALCOMM_TAGS is over 50 chars
warning: description for NONEXISTENT_CHARSET is over 50 chars
warning: description for LOTS_OF_STUFF is over 50 chars
warning: description for DATE_IN_FUTURE_06_12 is over 50 chars
warning: description exists for non-existent rule HTML_WITH_BGCOLOR
warning: description for BAYES_40 is over 50 chars
warning: description for DATE_IN_PAST_12_24 is over 50 chars
warning: description for START_NOW_CAPS is over 50 chars
warning: description for BODY_ENHANCEMENT2 is over 50 chars
warning: description for FORGED_JUNO_RCVD is over 50 chars
warning: description for PRIORITY_NO_NAME is over 50 chars
warning: description for RCVD_FAKE_HELO_DOTCOM is over 50 chars
warning: description exists for non-existent rule RCVD_IN_OPM_ROUTER
warning: description for EXCUSE_19 is over 50 chars
warning: description for FROM_NUM_AT_WEBMAIL is over 50 chars
warning: description for ADDR_NUMS_AT_BIGSITE is over 50 chars
warning: description for GUARANTEED_100_PERCENT is over 50 chars
warning: description for DATE_IN_PAST_03_06 is over 50 chars
warning: description for UNWANTED_LANGUAGE_BODY is over 50 chars
warning: description for SUBJ_AS_SEEN is over 50 chars
warning: description for USERPASS is over 50 chars
warning: description for MIME_BOUND_NEXTPART is over 50 chars
warning: description for MIME_BASE64_BLANKS is over 50 chars
warning: description for FREE_SAMPLE is over 50 chars
warning: description for SORTED_RECIPS is over 50 chars
warning: description for RCVD_IN_BSP_OTHER is over 50 chars
warning: description for DATE_IN_PAST_96_XX is over 50 chars
warning: description for FORGED_EUDORAMAIL_RCVD is over 50 chars
warning: description for FAKED_UNDISC_RECIPS is over 50 chars
warning: description for DATE_IN_PAST_06_12 is over 50 chars
warning: description for BAYES_80 is over 50 chars
warning: description for SEDUCTION is over 50 chars
warning: description for AOL_USERS_LINK is over 50 chars
warning: description for NO_OBLIGATION is over 50 chars
warning: description for HTML_IMAGE_ONLY_06 is over 50 chars
warning: description exists for non-existent rule HTML_IMAGE_ONLY_06
warning: description for EXCUSE_10 is over 50 chars
warning: description for SUBJ_BUY is over 50 chars
warning: description for RATWARE_JPFREE is over 50 chars
warning: description for EXCUSE_24 is over 50 chars
lint: 170 issues detected. please rerun with debug enabled for more information.
margre tout mes ajouts, certains mails comme je disais ne sont pas bloques alors qu'il ne sont assez explicite
Hi
VALnUM $1 , 25
VnAGRA $3 , 35
AMBnEN
CnALIS $3 , 75
+ un lien vers le site qui vends ces choses.
Je m'en remet donc a vous, si vous voulez d'autres précisions...
Merci pour votre aide.
Vincent
[/code]
