Newsgroup: it.comp.os.linux.sys
Titolo: backscatter


to: 
x...@bitit.it
 
 
was considered unsolicited bulk e-mail (UBE).
 
Our internal reference code for your message is 21329-01/nP11mQylh05u
 
The message carried your return address, so it was either a genuine mail
from you, or a sender address was faked and your e-mail address abused
by third party, in which case we apologize for undesired notification.
 
We do try to minimize backscatter for more prominent cases of UBE and
for infected mail, but for less obvious cases some balance between
losing genuine mail and sending undesired backscatter is sought,
and there can be some collateral damage on either side.
 
First upstream SMTP client IP address: [182.187.66.223] 
Received from: 182.187.66.223 < x
 
 
 

 
Il 16/01/2018 16:34, Enrico Maria Chellini ha scritto:
 >
 > mi trovo in coda un monte di backscatter, come posso fare a ridurlo?
 > Enrico
 >
 
exim? postfix? come gestisci la parte milter? forse ti conviene dare 
qualche dettaglio in più.
Ciao,

 ha scritto:

è si!!  giusto
 
ho una centos 6.x 
con postfix amavisd spamassassins clamd clamd.amavisd  procmail
pannello webmin con virtualmin
 
Enrico
 

 
 
allora questo è parte di quello che  quello che ho in amavisd.conf
-----
$sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above
that level
 
$sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.9;  # triggers spam evasive actions (e.g.
blocks mail)
 
$sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
$sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely
valid From # $sa_quarantine_cutoff_level = 25; # spam level beyond
which quarantine is off $penpals_bonus_score = 8;    # (no effect
without a @storage_sql_dsn database) $penpals_threshold_high =
$sa_kill_level_deflt;  # don't waste time on hi spam
$bounce_killer_score = 100;  # spam score points to add for joe-jobbed
bounces
 
$sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail
is larger $sa_local_tests_only = 0;    # only tests which do not
require internet access?
 
# @lookup_sql_dsn =
#   ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1',
'passwd1'], #     ['DBI:mysql:database=mail;host=host2', 'username2',
'password2'], #     ["DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite",
'', ''] ); # @storage_sql_dsn = @lookup_sql_dsn;  # none, same, or
separate database
 
# $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is
TIMESTAMP; #   defaults to 0, which is good for non-MySQL or if
msgs.time_iso is CHAR(16)
 
$virus_admin               = undef;                    # notifications
recip.
 
$mailfrom_notify_admin     = undef;                    # notifications
sender $mailfrom_notify_recip     = undef;                    #
notifications sender $mailfrom_notify_spamadmin =
undef;                    # notifications sender
$mailfrom_to_quarantine = ''; # null return path; uses original sender
if undef
 
@addr_extension_virus_maps      = ('virus');
@addr_extension_banned_maps     = ('banned');
@addr_extension_spam_maps       = ('spam');
@addr_extension_bad_header_maps = ('badh');
# $recipient_delimiter = '+';  # undef disables address extensions
altogether # when enabling addr extensions do also Postfix/
main.cf
:
recipient_delimiter=+
 
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
# $dspam = 'dspam';
 
$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not
enforced) $MAX_EXPANSION_QUOTA = 300*1024*1024;  # bytes  (default
undef, not enforced)
 
$sa_spam_subject_tag = '***Spam*** ';
$defang_virus  = 1;  # MIME-wrap passed infected mail
$defang_banned = 1;  # MIME-wrap passed mail containing banned name
# for defanging bad headers only turn on certain minor contents
categories: $defang_by_ccat{CC_BADH.",3"} = 1;  # NUL or CR character
in header $defang_by_ccat{CC_BADH.",5"} = 1;  # header line longer than
998 characters $defang_by_ccat{CC_BADH.",6"} = 1;  # header field
syntax error
 
 
# OTHER MORE COMMON SETTINGS (defaults may suffice):
 
# $myhostname = '
host.example.com
';  # must be a fully-qualified domain
name!
 
# $notify_method  = 'smtp:[127.0.0.1]:10025';
# $forward_method = 'smtp:[127.0.0.1]:10025';  # set to undef with
milter!
 
$final_virus_destiny      = D_DISCARD;
$final_banned_destiny     = D_BOUNCE;
 
$final_spam_destiny       = D_BOUNCE;   #!!!  D_DISCARD / D_REJECT
#$final_spam_destiny       = D_PASS;   #!!!  D_DISCARD / D_REJECT
$final_bad_header_destiny = D_BOUNCE;
 
----- 
 
 
se rimetto $final_spam_destiny = D_PASS;  
 
saturo le caselle, nella cartella spam, in un batti baleno, 
 
se metto D_DISCARD non dovrebbe partire il messaggio di risposta, ma si
potrebbe perdere qualche email importante.
 
almeno che non abbassi la soglia 
$sa_kill_level_deflt = 6.9;  
 
 se ho capito bene sopra questa soglia l'email vengono ignorate, giusto?
 
 

 
 
Dunque , con 
 
#$final_spam_destiny       = D_BOUNCE;   #!!!  D_DISCARD / D_REJECT
$final_spam_destiny       = D_PASS;   #!!!  D_DISCARD / D_REJECT
 
 
non ho più messaggi in conda di backscatering 
 
ma continua a passarmi un po di spam, ho le seguenti intestazioni in
una mail:
----------------------------
 
X-Virus-Scanned: amavisd-new at 
bitit.it
 
X-Spam-Flag: NO
X-Spam-Score: 5.312
X-Spam-Level: *****
X-Spam-Status: No, score=5.312 tagged_above=2 required=6.2
 tests=[BAYES_00=-1.9, DKIM_ADSP_NXDOMAIN=0.9, HTML_MESSAGE=0.001,
 RAZOR2_CF_RANGE_51_100=1.886, RAZOR2_CHECK=0.922, RCVD_IN_PSBL=2.7,
 RDNS_NONE=0.793, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01,
 URIBL_BLOCKED=0.001] autolearn=no
-------------------------------------
 
se ho capito bene non tiene conto dell'impostazione che ho dato a
spamassassins che è 3.5  ma tiene conto di quella di amavisd
required=6.2
$sa_tag2_level_deflt = 6.2;
 
quindi la dovrei abbassare per spostare quella mail con valore
5.312 in spam
 
giusto?
 
invece questa impostazione 
$sa_kill_level_deflt = 6.9;  # triggers spam evasive actions (e.g.
blocks mail)
 
non dovrebbe proprio consegnare la mail, ma non ho capito in questo
caso come si comporta, D_BOUNCE,  D_DISCARD o D_REJECT 
 
 
qualcuno ha qualche link da leggersi?
 
Enrico 
 
 

 
 
ho trovato  
https://wiki.centos.org/HowTos/Amavisd
 
""
$sa_tag_level_deflt is the level at which Amavisd-new will write spam
info headers such as X-Spam-Flag, X-Spam-Score and X-Spam-Status. If
you would always like header info to be written to all messages, set
this value to -999.
 
$sa_tag2_level_deflt sets the level at which spam is tagged in the
subject line of the message.
 
$sa_kill_level_deflt sets the level at which Amavisd-new will block the
message and quarantine it. This is useful as SpamAssassin doesn't do
this by default.
 
$sa_dsn_cutoff_level is the level at which delivery failure notices are
no longer sent to the sender. As most spam sender addresses are forged
anyway, it makes sense not to send failure notices in response to
obvious spam as you're only contributing to the problem of backscatter. 
""
qualcuno ha esperienza su quali valori è meglio utilizzare?
 
Enrico 
 

 > 
Scusate ancora, ho impostato in amavisd.conf
 
$sa_tag2_level_deflt = 5.0; 
 
e effettivamente messaggi maggiori>=5  in inbox non ci sono più
 
ma nella cartella spam ho messaggi che superano il valore di 14.
come faccio a dirgli che sopra a un determinato valore il messaggio
vada  non consegnato, cancellato ?
 
Grazie
Enrico
 
-----------------------------
X-Spam-Flag: YES
X-Spam-Score: 14.225
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.225 tagged_above=2 required=5
     tests=[BAYES_50=0.8, HTML_IMAGE_ONLY_24=1.618, HTML_MESSAGE=0.001,
     MIME_HTML_ONLY=0.723, RAZOR2_CF_RANGE_51_100=1.886,
     RAZOR2_CHECK=0.922, RCVD_IN_BL_SPAMCOP_NET=1.347,
     RCVD_IN_BRBL_LASTEXT=1.449, RCVD_IN_PSBL=2.7, RCVD_IN_RP_RNBL=1.31,
     RDNS_NONE=0.793, SPF_SOFTFAIL=0.665, T_REMOTE_IMAGE=0.01,
     URIBL_BLOCKED=0.001] autolearn=spam
 
X-Spam-Flag: YES
X-Spam-Score: 9.488
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.488 tagged_above=2 required=5
     tests=[ADVANCE_FEE_3_NEW_MONEY=2.699, BAYES_50=0.8,
     DEAR_BENEFICIARY=3.099, FREEMAIL_FORGED_REPLYTO=2.095,
     FSL_HELO_NON_FQDN_1=0.001, LOTS_OF_MONEY=0.001, RDNS_NONE=0.793]
     autolearn=no