もともとウェブサーバーになる予定のVPSがありますが、スタンドアロンサーバーとしての送受信など、最小限のメール機能も展開する必要があります。
現在の設定は次のとおりです。
あなたが見たように...
重要なステートメント:すべてが正常に機能します。私はごく少量のスパムを受け取り、誤検知を受け取ることはほとんどなく、悪いメールのほとんどはポリシーに基づいた重みで阻止されます。私がサービス全体で感じる唯一の「問題」は、全体として少し多くのメモリを使用します。
私はすでにspamassassinのモジュールをカットしました(以下を参照)が、メモリフットプリントをできるだけ低くする方法についてのアドバイスを本当に聞きたいです:SpamAssassinが本当に必要とするプラグインとその他私の現在のpostfixとpolicyd-weightの設定に関しては、あまり役に立たない?
SpamAssassinルールもsa-compileでコンパイルされます(sa-updateはcronから週に1回実行され、コンパイルはその直後に実行されます)
これらは重要な可能性のある現在の構成の一部です。さらに必要な場合は教えてください。
postfix/master.cf
(パーツのみ)
dovecot unix - n n - - pipe
flags=DRhu user=vmail:vmail argv=/usr/bin/spamc -e /usr/lib/dovecot/deliver -d ${recipient} -f {sender}
postfix/main.cf
(パーツのみ)
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
reject_invalid_hostname,
permit
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_unauth_pipelining,
reject_unauth_destination,
check_policy_service inet:127.0.0.1:12525,
permit
policyd-weight.conf
(パーツのみ)
$REJECTMSG = "550 Mail appeared to be SPAM or forged. Ask your Mail/DNS-Administrator to correct HELO and DNS MX settings or to get removed from DNSBLs";
$REJECTLEVEL = 4;
$DEFER_STRING = 'IN_SPAMCOP= BOGUS_MX=';
$DEFER_ACTION = '450';
$DEFER_LEVEL = 5;
$DNSERRMSG = '450 No DNS entries for your MTA, HELO and Domain. Contact YOUR administrator';
# 1: ON, 0: OFF (default)
# If ON request that ALL clients are only checked against RBLs
$dnsbl_checks_only = 0;
# 1: ON (default), 0: OFF
# When set to ON it logs only RBLs which affect scoring (positive or negative)
$LOG_BAD_RBL_ONLY = 1;
## DNSBL settings
@dnsbl_score = (
# Host, hit, miss, log name
'dnsbl.ahbl.org', 3, -1, 'dnsbl.ahbl.org',
'dnsbl.njabl.org', 3, -1, 'dnsbl.njabl.org',
'dnsbl.sorbs.net', 3, -1, 'dnsbl.sorbs.net',
'bl.spamcop.net', 3, -1, 'bl.spamcop.net',
'zen.spamhaus.org', 3, -1, 'zen.spamhaus.org',
'pbl.spamhaus.org', 3, -1, 'pbl.spamhaus.org',
'cbl.abuseat.org', 3, -1, 'cbl.abuseat.org',
'list.dsbl.org', 3, -1, 'list.dsbl.org',
);
# If Client IP is listed in MORE DNSBLS than this var, it gets REJECTed immediately
$MAXDNSBLHITS = 3;
# alternatively, if the score of DNSBLs is ABOVE this level, reject immediately
$MAXDNSBLSCORE = 9;
$MAXDNSBLMSG = '550 Az levelezoszerveruk IP cime tul sok spamlistan talahato, kerjuk ellenorizze! / Your MTA is listed in too many DNSBLs; please check.';
## RHSBL settings
@rhsbl_score = (
'multi.surbl.org', 4, 0, 'multi.surbl.org',
'rhsbl.ahbl.org', 4, 0, 'rhsbl.ahbl.org',
'dsn.rfc-ignorant.org', 4, 0, 'dsn.rfc-ignorant.org',
# 'postmaster.rfc-ignorant.org', 0.1, 0, 'postmaster.rfc-ignorant.org',
# 'abuse.rfc-ignorant.org', 0.1, 0, 'abuse.rfc-ignorant.org'
);
# skip a RBL if this RBL had this many continuous errors
$BL_ERROR_SKIP = 2;
# skip a RBL for that many times
$BL_SKIP_RELEASE = 10;
## cache stuff
# must be a directory (add trailing slash)
$LOCKPATH = '/var/run/policyd-weight/';
# socket path for the cache daemon.
$SPATH = $LOCKPATH.'/polw.sock';
# how many seconds the cache may be idle before starting maintenance routines
#NOTE: standard maintenance jobs happen regardless of this setting.
$MAXIDLECACHE = 60;
# after this number of requests do following maintenance jobs: checking for config changes
$MAINTENANCE_LEVEL = 5;
# negative (i.e. SPAM) result cache settings ##################################
# set to 0 to disable caching for spam results. To this level the cache will be cleaned.
$CACHESIZE = 2000;
# at this number of entries cleanup takes place
$CACHEMAXSIZE = 4000;
$CACHEREJECTMSG = '550 temporarily blocked because of previous errors';
# after NTTL retries the cache entry is deleted
$NTTL = 1;
# client MUST NOT retry within this seconds in order to decrease TTL counter
$NTIME = 30;
# positve (i.,e. HAM) result cache settings ###################################
# set to 0 to disable caching of HAM. To this number of entries the cache will be cleaned
$POSCACHESIZE = 1000;
# at this number of entries cleanup takes place
$POSCACHEMAXSIZE = 2000;
$POSCACHEMSG = 'using cached result';
#after PTTL requests the HAM entry must succeed one time the RBL checks again
$PTTL = 60;
# after $PTIME in HAM Cache the client must pass one time the RBL checks again.
#Values must be nonfractal. Accepted time-units: s, m, h, d
$PTIME = '3h';
# The client must pass this time the RBL checks in order to be listed as hard-HAM
# After this time the client will pass immediately for PTTL within PTIME
$TEMP_PTIME = '1d';
## DNS settings
# Retries for ONE DNS-Lookup
$DNS_RETRIES = 1;
# Retry-interval for ONE DNS-Lookup
$DNS_RETRY_IVAL = 5;
# max error count for unresponded queries in a complete policy query
$MAXDNSERR = 3;
$MAXDNSERRMSG = 'passed - too many local DNS-errors';
# persistent udp connection for DNS queries.
#broken in Net::DNS version 0.51. Works with Net::DNS 0.53; DEFAULT: off
$PUDP= 0;
# Force the usage of Net::DNS for RBL lookups.
# Normally policyd-weight tries to use a faster RBL lookup routine instead of Net::DNS
$USE_NET_DNS = 0;
# A list of space separated NS IPs
# This overrides resolv.conf settings
# Example: $NS = '1.2.3.4 1.2.3.5';
# DEFAULT: empty
$NS = '';
# timeout for receiving from cache instance
$IPC_TIMEOUT = 2;
# If set to 1 policyd-weight closes connections to smtpd clients in order to avoid too many
#established connections to one policyd-weight child
$TRY_BALANCE = 0;
# scores for checks, WARNING: they may manipulate eachother
# or be factors for other scores.
# HIT score, MISS Score
@client_ip_eq_helo_score = (1.5, -1.25 );
@helo_score = (1.5, -2 );
@helo_score = (0, -2 );
@helo_from_mx_eq_ip_score= (1.5, -3.1 );
@helo_numeric_score= (2.5, 0 );
@from_match_regex_verified_helo= (1,-2 );
@from_match_regex_unverified_helo = (1.6, -1.5 );
@from_match_regex_failed_helo = (2.5, 0 );
@helo_seems_dialup = (1.5, 0 );
@failed_helo_seems_dialup= (2, 0 );
@helo_ip_in_client_subnet= (0,-1.2 );
@helo_ip_in_cl16_subnet = (0,-0.41 );
#@client_seems_dialup_score = (3.75, 0 );
@client_seems_dialup_score = (0, 0 );
@from_multiparted = (1.09, 0 );
@from_anon= (1.17, 0 );
@bogus_mx_score = (2.1, 0 );
@random_sender_score = (0.25, 0 );
@rhsbl_penalty_score = (3.1, 0 );
@enforce_dyndns_score = (3, 0 );
spamassassin/init.pre
(。preファイルをまとめました)
loadplugin Mail::SpamAssassin::Plugin::Hashcash
loadplugin Mail::SpamAssassin::Plugin::SPF
loadplugin Mail::SpamAssassin::Plugin::Pyzor
loadplugin Mail::SpamAssassin::Plugin::Razor2
loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
loadplugin Mail::SpamAssassin::Plugin::ReplaceTags
loadplugin Mail::SpamAssassin::Plugin::Check
loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
loadplugin Mail::SpamAssassin::Plugin::URIDetail
loadplugin Mail::SpamAssassin::Plugin::Bayes
loadplugin Mail::SpamAssassin::Plugin::BodyEval
loadplugin Mail::SpamAssassin::Plugin::DNSEval
loadplugin Mail::SpamAssassin::Plugin::HTMLEval
loadplugin Mail::SpamAssassin::Plugin::HeaderEval
loadplugin Mail::SpamAssassin::Plugin::MIMEEval
loadplugin Mail::SpamAssassin::Plugin::RelayEval
loadplugin Mail::SpamAssassin::Plugin::URIEval
loadplugin Mail::SpamAssassin::Plugin::WLBLEval
loadplugin Mail::SpamAssassin::Plugin::VBounce
loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
spamassassin/local.cf
(パーツ)
use_bayes 1
bayes_auto_learn 1
bayes_store_module Mail::SpamAssassin::BayesStore::MySQL
bayes_sql_dsn DBI:mysql:db:127.0.0.1:3306
bayes_sql_username user
bayes_sql_password pass
bayes_ignore_header X-Bogosity
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status
### User settings
user_scores_dsn DBI:mysql:db:127.0.0.1:3306
user_scores_sql_password user
user_scores_sql_username pass
user_scores_sql_custom_query SELECT preference, value FROM _TABLE_ WHERE username = _USERNAME_ OR username = '$GLOBAL' OR username = CONCAT('%',_DOMAIN_) ORDER BY username ASC
# for better speed
score DNS_FROM_AHBL_RHSBL 0
score __RFC_IGNORANT_ENVFROM 0
score DNS_FROM_RFC_DSN 0
score DNS_FROM_RFC_BOGUSMX 0
score __DNS_FROM_RFC_POST 0
score __DNS_FROM_RFC_ABUSE 0
score __DNS_FROM_RFC_WHOIS 0
アダプターがポリシードウェイトと構成済みのポストフィックスポストスクリーンを削除するようにアドバイスしたように、これによりRAMの使用量から約-15〜20 MBになり、作業が大幅に高速化されました。フルキャパシティーで動作するかどうかはわかりませんが、それは有望なようです。
Postfix 2.8+にアップグレードして、 postscreen ;をデプロイすることをお勧めします。これは、ゾンビ/ DNSBLトリアージサーバーとして特別に設計されており、複数のブラックリストを高速で処理します。
また、完全に重み付けされたブラック/ホワイトリストのスコアリング、明示的なホワイトリストなども提供します。
2番目の質問に関しては、 spamass-milter ;を確認することをお勧めします。インラインミルターは、外部プロセスよりもはるかに効率的です。