Andesi - forum

Bonjour,

Je suis sur le point de configurer un serveur mail (postfix-amavis-spamassassin) sous debian etch.
Tout semble etre OK (le systeme delivre bien les messages qui lui sont parvenus et arrete les virus) sauf au niveau du traitement des spam. A mon avis, spamassassin n'est pas invoque lors du traitement des messages.

J'ai suivi le tuto qui se trouve sur sur http://www.espace.fr.to/howto/postfix-c … mavis.html pour la mise en place.

Voici le contenu du fichier main.cf
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
program_directory = /usr/lib/postfix
setgid_group = postdrop

# appending .domain is the MUA's job.
append_dot_mydomain = yes

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# Uncomment the next line to generate delayed mail warnings
#delay_warning_time = 4h

myhostname = mail.cotona.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
#mydestination = mail.cotona.com, localhost.cotona.com, , localhost, cotona.com
mydestination = cotona.com,mail.cotona.com
relayhost =
relayhost = relay.malagasy.com
mynetworks = 127.0.0.0/8, 200.0.0.0/24
#mailbox_command = /usr/bin/procmail -a "$EXTENSION"
mailbox_command =
mailbox_size_limit = 0
recipient_delimiter = +
#======================
mail_owner = postfix
queue_directory = /var/spool/postfix
virtual_mailbox_base = /data/mail
virtual_minimum_uid = 500
virtual_mailbox_maps = mysql:/etc/postfix/sql/vmailbox
virtual_maps = mysql:/etc/postfix/sql/virtual
transport_maps = mysql:/etc/postfix/sql/transport
virtual_uid_maps = static:500
virtual_gid_maps = static:500
local_recipient_maps = unix:passwd.byname $alias_maps $virtual_mailbox_maps
fallback_transport = virtual
#virtual_mailbox_limit_maps = mysql:/etc/postfix/sql/vmailsize
#message_size_limit = 10000000
disable_dns_lookups = no
virtual_mailbox_limit = 50000000
smtp_connect_timeout = 0s
disable_vrfy_command = yes
maximal_queue_lifetime = 3d
smtpd_sender_restrictions = hash:/etc/postfix/access
maps_rbl_domains =
            zombie.dnsbl.sorbs.net,
            relays.ordb.org,
            opm.blitzed.org,
            list.dsbl.org,
            sbl-xbl.spamhaus.org,
        bl.spamcop.net,
            blackholes.easynet.nl
#smtpd_client_restrictions = check_client_access hash:/etc/postfix/access,reject_maps_rbl
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/access,reject_invalid_hostname,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unknown_sender_domain,reject_unknown_recipient_domain,reject_unauth_pipelining,permit_mynetworks,reject_unauth_destination,reject_maps_rbl,permit
content_filter = smtp-amavis:[127.0.0.1]:10024
relay_domains =$mydestination

#virtual_mailbox_domains = /etc/postfix/sql/transport
#la derniere valeur de message_size_limit etait de 0
#la taille actuelle permise est de 10Mo (entete+message+fichier attaché)
message_size_limit = 12485760

Voici le contenu du fichier master.cf

# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet    n    -    -    -    -    smtpd
#628      inet    n    -    -    -    -    qmqpd
pickup      fifo    n    -    -    60    1    pickup
cleanup      unix    n    -    -    -    0    cleanup
qmgr      fifo    n    -    -    300    1    qmgr
#qmgr      fifo    n    -    -    300    1    nqmgr
rewrite      unix    -    -    -    -    -    trivial-rewrite
bounce      unix    -    -    -    -    0    bounce
defer      unix    -    -    -    -    0    bounce
flush      unix    n    -    -    1000?    0    flush
proxymap  unix    -    -    n    -    -    proxymap
smtp      unix    -    -    -    -    -    smtp
relay      unix    -    -    -    -    -    smtp
#    -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix    n    -    -    -    -    showq
error     unix    -    -    -    -    -    error
local      unix    -    n    n    -    -    local
virtual      unix    -    n    n    -    -    virtual
lmtp      unix    -    -    n    -    -    lmtp

maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
#
# The Cyrus deliver program has changed incompatibly, multiple times.
cyrus      unix    -    n    n    -    -    pipe
  flags=R user=cyrus argv=/usr/sbin/cyrdeliver -e -m ${extension} ${user}
# Cyrus 2.1.5 (Amos Gouaux)
#cyrus     unix  -       n       n       -       -       pipe
#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
uucp      unix    -    n    n    -    -    pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -d -t$nexthop -f$sender $recipient
scalemail-backend unix    -    n    n    -    2    pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}

# only used by postfix-tls
#tlsmgr      fifo    -    -    n    300    1    tlsmgr
#smtps      inet    n    -    n    -    -    smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#587      inet    n    -    n    -    -    smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
# only used by postfix-tls
#smtps    inet  n       -       n       -       -       smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes
#587      inet  n       -       n       -       -       smtpd -o smtpd_enforce_tls=yes -o smtpd_sasl_auth_enable=yes
127.0.0.1:10025 inet n - n - - smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o smtpd_helo_restrictions=
        -o smtpd_client_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8

smtp-amavis unix - - n - 10 smtp
        -o smtp_data_done_timeout=1200
        -o disable_dns_lookups=yes
                                   
Voici le contenu du fichier amavisd.conf

use strict;

$MYHOME = '/var/lib/amavis';   # (default is '/var/amavis')

$mydomain = 'mail.cotona.com';      # (no useful default)

$daemon_user  = 'amavis';    # (no default (undef))
$daemon_group = 'amavis';    # (no default (undef))

$TEMPBASE = $MYHOME;           # (must be set if other config vars use is)

$pid_file  = "/var/run/amavis/amavisd.pid";  # (default: "$MYHOME/amavisd.pid")
$lock_file = "/var/run/amavis/amavisd.lock"; # (default: "$MYHOME/amavisd.lock")

$ENV{TMPDIR} = $TEMPBASE;       # wise, but usually not necessary

$forward_method = 'smtp:127.0.0.1:10025';  # where to forward checked mail
$notify_method = $forward_method;          # where to submit notifications

$max_servers  =  5;   # number of pre-forked children          (default 2)
$max_requests = 20;   # retire a child after that many accepts (default 10)

$child_timeout=5*60;  # abort child if it does not complete each task in n sec

read_hash(\%local_domains, '/etc/amavis/localdomain.txt');

$relayhost_is_client = 0;         # (defaults to false)

$insert_received_line = 1;        # behave like MTA: insert 'Received:' header
                      # (does not apply to sendmail/milter)
                      # (default is true (1) )

$unix_socketname = undef;         # disable listening on a unix socket
                                  # (default is undef, i.e. disabled)

$inet_socket_port = 10024;        # accept SMTP on this local TCP port
                                  # (default is undef, i.e. disabled)

$inet_socket_bind = '127.0.0.1';  # limit socket bind to loopback interface
                                  # (default is '127.0.0.1')
@inet_acl = qw( 127.0.0.1 );      # allow SMTP access only from localhost IP
                                  # (default is qw( 127.0.0.1 ) )

$DO_SYSLOG = 1;                 # (defaults to false)

$LOGFILE = "/var/log/amavis.log";  # (defaults to empty, no log)

$log_templ = '[? %#V |[? %#F |[?%#D|Not-Delivered|Passed]|BANNED name/type (%F)]|INFECTED (%V)], #
[?%o|(?)|<%o>] -> [<%R>|,][? %i ||, quarantine %i], Message-ID: %m, Hits: %c';

read_l10n_templates('en_US', '/etc/amavis');

$final_virus_destiny      = D_DISCARD;  # (defaults to D_BOUNCE)
$final_banned_destiny     = D_BOUNCE;  # (defaults to D_BOUNCE)
$final_spam_destiny       = D_REJECT;  # (defaults to D_REJECT)
$final_bad_header_destiny = D_PASS;  # (defaults to D_PASS), D_BOUNCE suggested

$warnvirussender = 0;    # (defaults to false (undef))

$warnspamsender = 0;    # (defaults to false (undef))

$viruses_that_fake_sender_re = new_RE(
  qr'nimda|hybris|klez|bugbear|yaha|braid|sobig|sco||fizzer|palyh|peido|holar'i,
  qr'tanatos|lentin|bridex|mimail|trojan\.dropper'i,
  qr'swen|gibe|mimail'i,
);

$virus_admin = '[email protected]';

$spam_admin = '[email protected]';

$mailfrom_notify_admin     = '[email protected]';
$mailfrom_notify_recip     = '[email protected]';

$hdrfrom_notify_sender = "<postmaster\@$mydomain>";

$mailfrom_to_quarantine = undef; # original sender if undef, or set explicitly
                                 # (default is undef)

$QUARANTINEDIR = '/var/lib/amavis/virusmails';

$virus_quarantine_method = "local:virus-%i-%n";    # default
$spam_quarantine_method  = "local:spam-%b-%i-%n";  # default

$virus_quarantine_method = "bsmtp:$QUARANTINEDIR/virus-%i-%n.bsmtp";
$spam_quarantine_method  = "bsmtp:$QUARANTINEDIR/spam-%b-%i-%n.bsmtp";

$virus_quarantine_to  = 'virus-quarantine';    # traditional local quarantine

$X_HEADER_TAG = 'X-Virus-Scanned';    # (default: undef)

$X_HEADER_LINE = "by $myversion (Debian) at $mydomain";

$remove_existing_x_scanned_headers= 1; # remove existing headers
                    # (defaults to false)

$remove_existing_spam_headers  = 1;     # remove existing spam headers if

$keep_decoded_original_re = new_RE(
  qr'^(ASCII|text|uuencoded|xxencoded|binhex)'i,
);

$banned_filename_re = new_RE(
   qr'\.[a-zA-Z][a-zA-Z0-9]{0,3}\.(vbs|pif|scr|bat|com|exe|dll)$'i, # double extension
   qr'.\.(exe|vbs|pif|scr|bat|com)$'i,               # banned extension - basic
   qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046
);

$sql_select_white_black_list = undef;  # undef disables SQL white/blacklisting

$recipient_delimiter = '+';        # (default is '+')

$replace_existing_extension = 1;    # (default is false)

$localpart_is_case_sensitive = 0;    # (default is false)

$blacklist_sender_re = new_RE(
    qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou|greatcasino)@'i,
    qr'^(investments|lose_weight_today|market.alert|money2you|MyGreenCard)@'i,
    qr'^(new\.tld\.registry|opt-out|opt-in|optin|saveonl|smoking2002k)@'i,
    qr'^(specialoffer|specialoffers|stockalert|stopsnoring|wantsome)@'i,
    qr'^(workathome|yesitsfree|your_friend|greatoffers)@'i,
    qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i,
);

map { $whitelist_sender{lc($_)}=1 } (qw(
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
  [email protected]
));

$MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes  (default undef, not enforced)
$MIN_EXPANSION_FACTOR =   5;  # times original mail size  (must be specified)
$MAX_EXPANSION_FACTOR = 500;  # times original mail size  (must be specified)

$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';

$file   = 'file';   # file(1) utility; use 3.41 or later to avoid vulnerability

$gzip   = 'gzip';
$bzip2  = 'bzip2';
$lzop   = 'lzop';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze   = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc        = ['nomarch', 'arc'];
$unarj      = ['arj', 'unarj'];  # both can extract, same options
$unrar      = ['rar', 'unrar'];  # both can extract, same options
$zoo    = 'zoo';
$lha    = 'lha';
$cpio   = 'cpio';   # comment out if cpio does not support GNU options

$sa_timeout = 300;       # default is 120 seconds

$sa_mail_body_size_limit = 64*1024;  # don't waste time on SA is mail is larger
                # (less than 1% of spam is > 64k)
                # default: undef, no limitations

$sa_tag_level_deflt  = 5.0; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 8.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 14.0;

$sa_spam_subject_tag = '***SPAM*** ';    # (defaults to undef, disables)
                 # (only seen when spam is not to be rejected
                 # and recipient is in local_domains*)

$sa_spam_modifies_subj = 1; # may be a ref to a lookup table, default is true

@av_scanners = (
  ['Clam Antivirus-clamd',
    \&ask_daemon, ["CONTSCAN {}\n", '/var/run/clamd.ctl'],
    qr/\bOK$/, qr/\bFOUND$/,
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

  ['KasperskyLab AntiViral Toolkit Pro (AVP)', ['avp','kavscanner'],
    '-* -P -B -Y -O- {}', [0,3,8], [2,4],    # any use for -A -K   ?
    qr/infected: (.+)/,
    sub {chdir('/opt/AVP') or die "Can't chdir to AVP: $!"},
    sub {chdir($TEMPBASE) or die "Can't chdir back to $TEMPBASE $!"},
  ],

  ['KasperskyLab AVPDaemonClient',
    [ '/opt/AVP/kavdaemon',       'kavdaemon',
      '/opt/AVP/AvpDaemonClient', 'AvpDaemonClient',
      '/opt/AVP/AvpTeamDream',    'AvpTeamDream',
      '/opt/AVP/avpdc', 'avpdc' ],
    '{}', [0,8], [3,4,5,6], qr/infected: ([^\r\n]+)/ ],

  ['H+BEDV AntiVir or CentralCommand Vexira Antivirus',
    ['antivir','vexira'],
    '--allfiles -noboot -nombr -rs -s -z {}', [0], qr/ALERT:|VIRUS:/,
    qr/(?x)^\s* (?: ALERT: \s* (?: \[ | [^']* ' ) |
         (?i) VIRUS:\ .*?\ virus\ '?) ( [^\]\s']+ )/ ],

  ['Command AntiVirus for Linux', 'csav',
    '-all -archive -packed {}', [50], [51,52,53],
    qr/Infection: (.+)/ ],

  ['Symantec CarrierScan via Symantec CommandLineScanner',
    ['cscmdline','savsecls'],
    '-a scan -i 1 -v -s 127.0.0.1:7777 {}',
    qr/Files Infected: 0/, qr/^Infected: /,
    qr/Info:\s+(.+)/ ],

  ['DrWeb Antivirus for Linux/FreeBSD/Solaris', 'drweb',
    '-al -ar -fm -go -ha -ml -ni -ot -sd -up {}',
    [0], [1], sub {('no-name')} ],

  ['F-Secure Antivirus', 'fsav',
    '--dumb --archive {}', [0], [3,8],
    qr/infection: (.+)/ ],

  ['CAI InoculateIT', 'inocucmd',
    '-sec -nex {}', [0], [100],
    qr/was infected by virus (.+)/ ],

  ['MkS_Vir for Linux (beta)', ['mks32','mks'],
    '-s {}/*', [0], [1,2],    # any use for options: -a -c  ?
    qr/--[ \t]*(.+)/ ],

  ['ESET Software NOD32', 'nod32',
    '-all -subdir+ {}', [0], [1,2],
    qr/^.+? - (.+?)\s*(?:backdoor|joke|trojan|virus|worm)/ ],

  ['ESET Software NOD32 - Client/Server Version', 'nod32cli',
    '-a -r -d recurse --heur standard {}', [0], [10,11],
    qr/^\S+\s+infected:\s+(.+)/ ],

  ['Norman Virus Control v5 / Linux', 'nvccmd',
    '-c -l:0 -s -u {}', [0], [1],
    qr/(?i).* virus in .* -> \'(.+)\'/ ],

  ['Panda Antivirus for Linux', ['pavcl'],
    '-aut -aex -heu -cmp -nbr -nor -nso -eng {}',
    qr/Number of files infected[ \.]*: 0(?!\d)/,
    qr/Number of files infected[ \.]*: 0*[1-9]/,
    qr/Found virus :\s*(\S+)/ ],

  ['NAI McAfee AntiVirus (uvscan)', 'uvscan',
    '--secure -rv --summary --noboot {}', [0], [13],
    qr/(?x) Found (?:
        \ the\ (.+)\ (?:virus|trojan)  |
        \ (?:virus|trojan)\ or\ variant\ ([^ ]+)  |
        :\ (.+)\ NOT\ a\ virus)/,
  ],

  ['VirusBuster', ['vbuster', 'vbengcl'],
    "{} -ss -i '*' -log=$MYHOME/vbuster.log", [0], [1],
    qr/: '(.*)' - Virus/ ],

  [' AVG Anti-Virus',
  \&ask_daemon, ["SCAN {}n",'127.0.0.1:55555'],
  qr/^200/, qr/^403/,
  qr/^403 .*: (.+)/ ],

  ['CyberSoft VFind', 'vfind',
    '--vexit {}', [0], [23], qr/##==>>>> VIRUS ID: CVDL (.+)/,
  ],

  ['Ikarus AntiVirus for Linux', 'ikarus',
    '{}', [0], [40], qr/Signature (.+) found/ ],

  ['BitDefender', 'bdc',
    '--all --arc {}', qr/^Infected files *:0(?!\d)/,
    qr/^(?:Infected files|Identified viruses|Suspect files) *:0*[1-9]/,
    qr/(?:suspected|infected): (.*)\033/ ],
);

@av_scanners_backup = (

  ['Clam Antivirus - clamscan', 'clamscan',
    '--stdout --disable-summary -r {}', [0], [1],
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],

  ['FRISK F-Prot Antivirus', ['f-prot','f-prot.sh'],
    '-dumb -archive -packed {}', [0,8], [3,6],
    qr/Infection: (.+)/ ],

  ['Trend Micro FileScanner', ['/etc/iscan/vscan','vscan'],
    '-a {}', [0], qr/Found virus/, qr/Found virus (.+) in/ ],

);
1;  # insure a defined return

Le test du fonctionnement de spamassassin consiste a envoyer un mail contenant la chaine :
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

Enfin, le resultat du cmd ps -edf|grep spam donne

root      2271     1  0 11:31 ?        00:00:00 /usr/sbin/spamd -m 10 -H -d --pidfile=/var/run/spamd.pid
root      2696  2271  0 11:31 ?        00:00:00 spamd child
root      2697  2271  0 11:31 ?        00:00:00 spamd child
root      2799  2698  0 12:59 tty2     00:00:00 grep spam

Ma question est : Qu'est ce qui cloche dans mes config ? Est-ce qu'il y a des parametres que je n'ai pas bien positionne ?

Avec mes remerciements anticipes