API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Feb 20th, 2017
618
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 28.82 KB | None | 0 0
raw download clone embed print report
  1. use strict;
  2.  
  3. # a minimalistic configuration file for amavisd-new with all necessary settings
  4. #
  5. #   see amavisd.conf-default for a list of all variables with their defaults;
  6. #   for more details see documentation in INSTALL, README_FILES/*
  7. #   and at http://www.ijs.si/software/amavisd/amavisd-new-docs.html
  8.  
  9.  
  10. # COMMONLY ADJUSTED SETTINGS:
  11.  
  12. # @bypass_virus_checks_maps = (1);  # controls running of anti-virus code
  13. # @bypass_spam_checks_maps  = (1);  # controls running of anti-spam code
  14. # $bypass_decode_parts = 1;         # controls running of decoders&dearchivers
  15.  
  16. $max_servers = 2;            # num of pre-forked children (2..30 is common), -m
  17. $daemon_user  = 'amavis';    # (no default;  customary: vscan or amavis), -u
  18. $daemon_group = 'amavis';    # (no default;  customary: vscan or amavis), -g
  19.  
  20. $mydomain = "ycsab.youcantspoilababy.org";  # = 'example.com';   # a convenient default for other settings
  21.  
  22. $MYHOME = '/var/spool/amavisd';   # a convenient default for other settings, -H
  23. $TEMPBASE = "$MYHOME/tmp";   # working directory, needs to exist, -T
  24. $ENV{TMPDIR} = $TEMPBASE;    # environment variable TMPDIR, used by SA, etc.
  25. $QUARANTINEDIR = undef;      # -Q
  26. # $quarantine_subdir_levels = 1;  # add level of subdirs to disperse quarantine
  27. # $release_format = 'resend';     # 'attach', 'plain', 'resend'
  28. # $report_format  = 'arf';        # 'attach', 'plain', 'resend', 'arf'
  29.  
  30. # $daemon_chroot_dir = $MYHOME;   # chroot directory or undef, -R
  31.  
  32. $db_home   = "$MYHOME/db";        # dir for bdb nanny/cache/snmp databases, -D
  33. # $helpers_home = "$MYHOME/var";  # working directory for SpamAssassin, -S
  34. $lock_file = "/var/run/amavisd/amavisd.lock";  # -L
  35. $pid_file  = "/var/run/amavisd/amavisd.pid";   # -P
  36. #NOTE: create directories $MYHOME/tmp, $MYHOME/var, $MYHOME/db manually
  37.  
  38. $log_level = 0;              # verbosity 0..5, -d
  39. $log_recip_templ = undef;    # disable by-recipient level-0 log entries
  40. $do_syslog = 1;              # log via syslogd (preferred)
  41. $syslog_facility = 'mail';   # Syslog facility as a string
  42.            # e.g.: mail, daemon, user, local0, ... local7
  43.  
  44. $enable_db = 1;              # enable use of BerkeleyDB/libdb (SNMP and nanny)
  45. # $enable_zmq = 1;           # enable use of ZeroMQ (SNMP and nanny)
  46. $nanny_details_level = 2;    # nanny verbosity: 1: traditional, 2: detailed
  47. $enable_dkim_verification = 1;  # enable DKIM signatures verification
  48. $enable_dkim_signing = 1;    # load DKIM signing code, keys defined by dkim_key
  49.  
  50. @local_domains_maps = 1;
  51.  
  52. @mynetworks = qw( 127.0.0.0/8 [::1] [FE80::]/10 [FEC0::]/10
  53.                   10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 );
  54.  
  55. $unix_socketname = "/var/run/amavisd/amavisd.sock";  # amavisd-release or amavis-milter
  56.                # option(s) -p overrides $inet_socket_port and $unix_socketname
  57.  
  58. $inet_socket_port = [10024, 10026, 9998];
  59. # $inet_socket_port = [10024, 9998];
  60.  
  61. $policy_bank{'MYNETS'} = {   # mail originating from @mynetworks
  62.   originating => 1,  # is true in MYNETS by default, but let's make it explicit
  63.   os_fingerprint_method => undef,  # don't query p0f for internal clients
  64.   allow_disclaimers => 1, # enables disclaimer insertion if available
  65. };
  66.  
  67. # it is up to MTA to re-route mail from authenticated roaming users or
  68. # from internal hosts to a dedicated TCP port (such as 10026) for filtering
  69. $interface_policy{'10026'} = 'ORIGINATING';
  70.  
  71. $policy_bank{'ORIGINATING'} = {  # mail supposedly originating from our users
  72.   originating => 1,  # declare that mail was submitted by our smtp client
  73.   allow_disclaimers => 1,  # enables disclaimer insertion if available
  74.   # notify administrator of locally originating malware
  75.   virus_admin_maps => ["virusalert\@$mydomain"],
  76.   spam_admin_maps  => ["virusalert\@$mydomain"],
  77.   warnbadhsender   => 1,
  78.   # forward to a smtpd service providing DKIM signing service
  79.   # forward_method => 'smtp:[127.0.0.1]:10027',
  80.   # force MTA conversion to 7-bit (e.g. before DKIM signing)
  81.   smtpd_discard_ehlo_keywords => ['8BITMIME'],
  82.   # bypass_banned_checks_maps => [1],  # allow sending any file names and types
  83.   terminate_dsn_on_notify_success => 0,  # don't remove NOTIFY=SUCCESS option
  84. };
  85.  
  86. $interface_policy{'SOCK'} = 'AM.PDP-SOCK'; # only applies with $unix_socketname
  87.  
  88. # Use with amavis-release over a socket or with Petr Rehor's amavis-milter.c
  89. # (with amavis-milter.c from this package or old amavis.c client use 'AM.CL'):
  90. $policy_bank{'AM.PDP-SOCK'} = {
  91.   protocol => 'AM.PDP',
  92.   auth_required_release => 0,  # do not require secret_id for amavisd-release
  93. };
  94.  
  95. $sa_tag_level_deflt  = 2.0;  # add spam info headers if at, or above that level
  96. $sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
  97. $sa_kill_level_deflt = 6.9;  # triggers spam evasive actions (e.g. blocks mail)
  98. $sa_dsn_cutoff_level = 10;   # spam level beyond which a DSN is not sent
  99. $sa_crediblefrom_dsn_cutoff_level = 18; # likewise, but for a likely valid From
  100. # $sa_quarantine_cutoff_level = 25; # spam level beyond which quarantine is off
  101. $penpals_bonus_score = 8;    # (no effect without a @storage_sql_dsn database)
  102. $penpals_threshold_high = $sa_kill_level_deflt;  # don't waste time on hi spam
  103. $bounce_killer_score = 100;  # spam score points to add for joe-jobbed bounces
  104.  
  105. $sa_mail_body_size_limit = 400*1024; # don't waste time on SA if mail is larger
  106. $sa_local_tests_only = 0;    # only tests which do not require internet access?
  107.  
  108. # @lookup_sql_dsn =
  109. #   ( ['DBI:mysql:database=mail;host=127.0.0.1;port=3306', 'user1', 'passwd1'],
  110. #     ['DBI:mysql:database=mail;host=host2', 'username2', 'password2'],
  111. #     ["DBI:SQLite:dbname=$MYHOME/sql/mail_prefs.sqlite", '', ''] );
  112. # @storage_sql_dsn = @lookup_sql_dsn;  # none, same, or separate database
  113. # @storage_redis_dsn = ( {server=>'127.0.0.1:6379', db_id=>1} );
  114. # $redis_logging_key = 'amavis-log';
  115. # $redis_logging_queue_size_limit = 300000;  # about 250 MB / 100000
  116.  
  117. # $timestamp_fmt_mysql = 1; # if using MySQL *and* msgs.time_iso is TIMESTAMP;
  118. #   defaults to 0, which is good for non-MySQL or if msgs.time_iso is CHAR(16)
  119.  
  120. $virus_admin               = undef;                    # notifications recip.
  121.  
  122. $mailfrom_notify_admin     = undef;                    # notifications sender
  123. $mailfrom_notify_recip     = undef;                    # notifications sender
  124. $mailfrom_notify_spamadmin = undef;                    # notifications sender
  125. $mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
  126.  
  127. @addr_extension_virus_maps      = ('virus');
  128. @addr_extension_banned_maps     = ('banned');
  129. @addr_extension_spam_maps       = ('spam');
  130. @addr_extension_bad_header_maps = ('badh');
  131. # $recipient_delimiter = '+';  # undef disables address extensions altogether
  132. # when enabling addr extensions do also Postfix/main.cf: recipient_delimiter=+
  133.  
  134. $path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
  135. # $dspam = 'dspam';
  136.  
  137. $MAXLEVELS = 14;
  138. $MAXFILES = 3000;
  139. $MIN_EXPANSION_QUOTA =      100*1024;  # bytes  (default undef, not enforced)
  140. $MAX_EXPANSION_QUOTA = 500*1024*1024;  # bytes  (default undef, not enforced)
  141.  
  142. $sa_spam_subject_tag = '***Spam*** ';
  143. $defang_virus  = 1;  # MIME-wrap passed infected mail
  144. $defang_banned = 0;  # MIME-wrap passed mail containing banned name
  145. # for defanging bad headers only turn on certain minor contents categories:
  146. $defang_by_ccat{CC_BADH.",3"} = 1;  # NUL or CR character in header
  147. $defang_by_ccat{CC_BADH.",5"} = 1;  # header line longer than 998 characters
  148. $defang_by_ccat{CC_BADH.",6"} = 1;  # header field syntax error
  149.  
  150.  
  151. # OTHER MORE COMMON SETTINGS (defaults may suffice):
  152.  
  153. # $myhostname = 'host.example.com';  # must be a fully-qualified domain name!
  154.  
  155. # $notify_method  = 'smtp:[127.0.0.1]:10025';
  156. # $forward_method = 'smtp:[127.0.0.1]:10025';  # set to undef with milter!
  157.  
  158. #$final_virus_destiny      = D_DISCARD;
  159. #$final_banned_destiny     = D_BOUNCE;
  160. #$final_spam_destiny       = D_DISCARD;  #!!!  D_DISCARD / D_REJECT
  161. #$final_bad_header_destiny = D_BOUNCE;
  162. # $bad_header_quarantine_method = undef;
  163.  
  164. # $os_fingerprint_method = 'p0f:*:2345';  # to query p0f-analyzer.pl
  165.  
  166. ## hierarchy by which a final setting is chosen:
  167. ##   policy bank (based on port or IP address) -> *_by_ccat
  168. ##   *_by_ccat (based on mail contents) -> *_maps
  169. ##   *_maps (based on recipient address) -> final configuration value
  170.  
  171.  
  172. # SOME OTHER VARIABLES WORTH CONSIDERING (see amavisd.conf-default for all)
  173.  
  174. # $warnbadhsender,
  175. # $warnvirusrecip, $warnbannedrecip, $warnbadhrecip, (or @warn*recip_maps)
  176. #
  177. # @bypass_virus_checks_maps, @bypass_spam_checks_maps,
  178. # @bypass_banned_checks_maps, @bypass_header_checks_maps,
  179. #
  180. # @virus_lovers_maps, @spam_lovers_maps,
  181. # @banned_files_lovers_maps, @bad_header_lovers_maps,
  182. #
  183. # @blacklist_sender_maps, @score_sender_maps,
  184. #
  185. # $clean_quarantine_method, $virus_quarantine_to, $banned_quarantine_to,
  186. # $bad_header_quarantine_to, $spam_quarantine_to,
  187. #
  188. # $defang_bad_header, $defang_undecipherable, $defang_spam
  189.  
  190.  
  191. # REMAINING IMPORTANT VARIABLES ARE LISTED HERE BECAUSE OF LONGER ASSIGNMENTS
  192.  
  193. @keep_decoded_original_maps = (new_RE(
  194.   qr'^MAIL$',                # let virus scanner see full original message
  195.   qr'^MAIL-UNDECIPHERABLE$', # same as ^MAIL$ if mail is undecipherable
  196.   qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
  197. # qr'^Zip archive data',     # don't trust Archive::Zip
  198. ));
  199.  
  200.  
  201. $banned_filename_re = new_RE(
  202.  
  203. ### BLOCKED ANYWHERE
  204. # qr'^UNDECIPHERABLE$',  # is or contains any undecipherable components
  205.   qr'^\.(exe-ms|dll)$',                   # banned file(1) types, rudimentary
  206. # qr'^\.(exe|lha|cab|dll)$',              # banned file(1) types
  207.  
  208. ### BLOCK THE FOLLOWING, EXCEPT WITHIN UNIX ARCHIVES:
  209. # [ qr'^\.(gz|bz2)$'             => 0 ],  # allow any in gzip or bzip2
  210.   [ qr'^\.(rpm|cpio|tar)$'       => 0 ],  # allow any in Unix-type archives
  211.  
  212.   qr'.\.(pif|scr)$'i,                     # banned extensions - rudimentary
  213. # qr'^\.zip$',                            # block zip type
  214.  
  215. ### BLOCK THE FOLLOWING, EXCEPT WITHIN ARCHIVES:
  216. # [ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ],  # allow any within these archives
  217.  
  218.   qr'^application/x-msdownload$'i,        # block these MIME types
  219.   qr'^application/x-msdos-program$'i,
  220.   qr'^application/hta$'i,
  221.  
  222. # qr'^message/partial$'i,         # rfc2046 MIME type
  223. # qr'^message/external-body$'i,   # rfc2046 MIME type
  224.  
  225. # qr'^(application/x-msmetafile|image/x-wmf)$'i,  # Windows Metafile MIME type
  226. # qr'^\.wmf$',                            # Windows Metafile file(1) type
  227.  
  228.   # block certain double extensions in filenames
  229.   qr'^(?!cid:).*\.[^./]*[A-Za-z][^./]*\.\s*(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)[.\s]*$'i,
  230.  
  231. # qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i, # Class ID CLSID, strict
  232. # qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i, # Class ID extension CLSID, loose
  233.  
  234.   qr'.\.(exe|vbs|pif|scr|cpl)$'i,             # banned extension - basic
  235. # qr'.\.(exe|vbs|pif|scr|cpl|bat|cmd|com)$'i, # banned extension - basic+cmd
  236. # qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|emf|exe|fxp|grp|hlp|hta|
  237. #        inf|ini|ins|isp|js|jse|lib|lnk|mda|mdb|mde|mdt|mdw|mdz|msc|msi|
  238. #        msp|mst|ocx|ops|pcd|pif|prg|reg|scr|sct|shb|shs|sys|vb|vbe|vbs|vxd|
  239. #        wmf|wsc|wsf|wsh)$'ix,                # banned extensions - long
  240. # qr'.\.(asd|asf|asx|url|vcs|wmd|wmz)$'i,     # consider also
  241. # qr'.\.(ani|cur|ico)$'i,                 # banned cursors and icons filename
  242. # qr'^\.ani$',                            # banned animated cursor file(1) type
  243. # qr'.\.(mim|b64|bhx|hqx|xxe|uu|uue)$'i,  # banned extension - WinZip vulnerab.
  244. );
  245. # See http://support.microsoft.com/default.aspx?scid=kb;EN-US;q262631
  246. # and http://www.cknow.com/vtutor/vtextensions.htm
  247.  
  248.  
  249. # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
  250.  
  251. @score_sender_maps = ({ # a by-recipient hash lookup table,
  252.                         # results from all matching recipient tables are summed
  253.  
  254. # ## per-recipient personal tables  (NOTE: positive: black, negative: white)
  255. # '[email protected]'  => [{'[email protected]' => 10.0}],
  256. # '[email protected]'  => [{'.ebay.com'                 => -3.0}],
  257. # '[email protected]'  => [{'[email protected]' => -7.0,
  258. #                           '.cleargreen.com'           => -5.0}],
  259.  
  260.   ## site-wide opinions about senders (the '.' matches any recipient)
  261.   '.' => [  # the _first_ matching sender determines the score boost
  262.  
  263.    new_RE(  # regexp-type lookup table, just happens to be all soft-blacklist
  264.     [qr'^(bulkmail|offers|cheapbenefits|earnmoney|foryou)@'i         => 5.0],
  265.     [qr'^(greatcasino|investments|lose_weight_today|market\.alert)@'i=> 5.0],
  266.     [qr'^(money2you|MyGreenCard|new\.tld\.registry|opt-out|opt-in)@'i=> 5.0],
  267.     [qr'^(optin|saveonlsmoking2002k|specialoffer|specialoffers)@'i   => 5.0],
  268.     [qr'^(stockalert|stopsnoring|wantsome|workathome|yesitsfree)@'i  => 5.0],
  269.     [qr'^(your_friend|greatoffers)@'i                                => 5.0],
  270.     [qr'^(inkjetplanet|marketopt|MakeMoney)\d*@'i                    => 5.0],
  271.    ),
  272.  
  273. #  read_hash("/var/amavis/sender_scores_sitewide"),
  274.  
  275.    { # a hash-type lookup table (associative array)
  276.      '[email protected]'                        => -3.0,
  277.      '[email protected]'              => -3.0,
  278.      '[email protected]'                    => -3.0,
  279.      '[email protected]'                  => -3.0,
  280.      'securityfocus.com'                      => -3.0,
  281.      '[email protected]'       => -3.0,
  282.      '[email protected]'      => -3.0,
  283.      '[email protected]'      => -3.0,
  284.      '[email protected]'=> -3.0,
  285.      '[email protected]' => -3.0,
  286.      'spamassassin.apache.org'                => -3.0,
  287.      '[email protected]'   => -3.0,
  288.      '[email protected]'        => -3.0,
  289.      '[email protected]'     => -3.0,
  290.      '[email protected]'   => -3.0,
  291.      '[email protected]' => -3.0,
  292.      '[email protected]'                => -3.0,
  293.      '[email protected]'               => -3.0,
  294.      '[email protected]'                  => -3.0,
  295.      '[email protected]'          => -3.0,
  296.      '[email protected]'           => -3.0,
  297.      '[email protected]'       => -3.0,
  298.      '[email protected]'          => -3.0,
  299.      '[email protected]'            => -3.0,
  300.      '[email protected]'            => -3.0,
  301.      '[email protected]'                => -5.0,
  302.      '[email protected]'           => -3.0,
  303.      'returns.groups.yahoo.com'               => -3.0,
  304.      '[email protected]'           => -3.0,
  305.      lc('[email protected]')    => -3.0,
  306.      lc('[email protected]') => -5.0,
  307.  
  308.      # soft-blacklisting (positive score)
  309.      '[email protected]'                     =>  3.0,
  310.      '.example.net'                           =>  1.0,
  311.  
  312.    },
  313.   ],  # end of site-wide tables
  314. });
  315.  
  316.  
  317. @decoders = (
  318.   ['mail', \&do_mime_decode],
  319. # [[qw(asc uue hqx ync)], \&do_ascii],  # not safe
  320.   ['F',    \&do_uncompress, ['unfreeze', 'freeze -d', 'melt', 'fcat'] ],
  321.   ['Z',    \&do_uncompress, ['uncompress', 'gzip -d', 'zcat'] ],
  322.   ['gz',   \&do_uncompress, 'gzip -d'],
  323.   ['gz',   \&do_gunzip],
  324.   ['bz2',  \&do_uncompress, 'bzip2 -d'],
  325.   ['xz',   \&do_uncompress,
  326.            ['xzdec', 'xz -dc', 'unxz -c', 'xzcat'] ],
  327.   ['lzma', \&do_uncompress,
  328.            ['lzmadec', 'xz -dc --format=lzma',
  329.             'lzma -dc', 'unlzma -c', 'lzcat', 'lzmadec'] ],
  330.   ['lrz',  \&do_uncompress,
  331.            ['lrzip -q -k -d -o -', 'lrzcat -q -k'] ],
  332.   ['lzo',  \&do_uncompress, 'lzop -d'],
  333.   ['lz4',  \&do_uncompress, ['lz4c -d'] ],
  334.   ['rpm',  \&do_uncompress, ['rpm2cpio.pl', 'rpm2cpio'] ],
  335.   [['cpio','tar'], \&do_pax_cpio, ['pax', 'gcpio', 'cpio'] ],
  336.            # ['/usr/local/heirloom/usr/5bin/pax', 'pax', 'gcpio', 'cpio']
  337.   ['deb',  \&do_ar, 'ar'],
  338. # ['a',    \&do_ar, 'ar'],  # unpacking .a seems an overkill
  339.   ['rar',  \&do_unrar, ['unrar', 'rar'] ],
  340.   ['arj',  \&do_unarj, ['unarj', 'arj'] ],
  341.   ['arc',  \&do_arc,   ['nomarch', 'arc'] ],
  342.   ['zoo',  \&do_zoo,   ['zoo', 'unzoo'] ],
  343. # ['doc',  \&do_ole,   'ripole'],  # no ripole package so far
  344.   ['cab',  \&do_cabextract, 'cabextract'],
  345. # ['tnef', \&do_tnef_ext, 'tnef'],  # use internal do_tnef() instead
  346.   ['tnef', \&do_tnef],
  347. # ['lha',  \&do_lha,   'lha'],  # not safe, use 7z instead
  348. # ['sit',  \&do_unstuff, 'unstuff'],  # not safe
  349.   [['zip','kmz'], \&do_7zip,  ['7za', '7z'] ],
  350.   [['zip','kmz'], \&do_unzip],
  351.   ['7z',   \&do_7zip,  ['7zr', '7za', '7z'] ],
  352.   [[qw(gz bz2 Z tar)],
  353.            \&do_7zip,  ['7za', '7z'] ],
  354.   [[qw(xz lzma jar cpio arj rar swf lha iso cab deb rpm)],
  355.            \&do_7zip,  '7z' ],
  356.   ['exe',  \&do_executable, ['unrar','rar'], 'lha', ['unarj','arj'] ],
  357. );
  358. $sa_debug = 0;
  359. # Set hostname.
  360. $myhostname = "ycsab.youcantspoilababy.org";
  361.  
  362. # Set listen IP/PORT.
  363. $notify_method  = 'smtp:[127.0.0.1]:10025';
  364. $forward_method = 'smtp:[127.0.0.1]:10025';
  365.  
  366. @av_scanners = (
  367.     #### http://www.clamav.net/
  368.     ['ClamAV-clamd',
  369.     \&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamd.amavisd/clamd.socket"],
  370.     qr/\bOK$/, qr/\bFOUND$/,
  371.     qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
  372. );
  373.  
  374. @av_scanners_backup = (
  375.     ### http://www.clamav.net/   - backs up clamd or Mail::ClamAV
  376.     ['ClamAV-clamscan', 'clamscan',
  377.     "--stdout --disable-summary -r --tempdir=$TEMPBASE {}", [0], [1],
  378.     qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
  379. );
  380.  
  381. # Apply to mails which coming from internal networks or authenticated users.
  382. # mail supposedly originating from our users
  383. # $policy_bank{'MYUSERS'} = {
  384.     # # declare that mail was submitted by our smtp client
  385.     # originating => 1,
  386. #
  387.     # # enables disclaimer insertion if available
  388.     # allow_disclaimers => 1,
  389. #
  390.     # # notify administrator of locally originating malware
  391.     # virus_admin_maps => ["root\@$mydomain"],
  392.     # spam_admin_maps => [],
  393.     # bad_header_admin_maps => [],
  394.     # banned_admin_maps => ["root\@$mydomain"],
  395. #
  396.     # # notify sender of malware
  397.     # warnbadhsender => 0,
  398.     # warnbannedsender => 0,
  399. #
  400.     # # forward to a smtpd service providing DKIM signing service
  401.     # #forward_method => 'smtp:[127.0.0.1]:10027',
  402. #
  403.     # # force MTA conversion to 7-bit (e.g. before DKIM signing)
  404.     # smtpd_discard_ehlo_keywords => ['8BITMIME'],
  405. #
  406.     # # don't remove NOTIFY=SUCCESS option
  407.     # terminate_dsn_on_notify_success => 0,
  408. #
  409.     # # don't perform spam/virus/header check.
  410.     # #bypass_spam_checks_maps => [1],
  411.     # #bypass_virus_checks_maps => [1],
  412.     # #bypass_header_checks_maps => [1],
  413. #
  414.     # # allow sending any file names and types
  415.     # #bypass_banned_checks_maps => [1],
  416. #
  417.     # # Quarantine clean messages
  418.     # #clean_quarantine_method => 'sql:',
  419.     # #final_destiny_by_ccat => {CC_CLEAN, D_DISCARD},
  420. # };
  421.  
  422. #
  423. # Port used to release quarantined mails.
  424. #
  425. $interface_policy{'9998'} = 'AM.PDP-INET';
  426. $policy_bank{'AM.PDP-INET'} = {
  427.     protocol => 'AM.PDP',       # select Amavis policy delegation protocol
  428.     inet_acl => [qw( 127.0.0.1 [::1] )],    # restrict access to these IP addresses
  429.     auth_required_release => 1,    # 0 - don't require secret_id for amavisd-release
  430.     #log_level => 4,
  431.     #always_bcc_by_ccat => {CC_CLEAN, '[email protected]'},
  432. };
  433.  
  434. # Set default action.
  435. # Available actions: D_PASS, D_BOUNCE, D_REJECT, D_DISCARD.
  436. $final_virus_destiny      = D_DISCARD;
  437. $final_banned_destiny     = D_BOUNCE;
  438. $final_spam_destiny       = D_PASS;
  439. $final_bad_header_destiny = D_PASS;
  440.  
  441. #########################
  442. # Quarantine mails.
  443. #
  444.  
  445. # Where to store quarantined mail message:
  446. #   - 'local:spam-%i-%m', quarantine mail on local file system.
  447. #   - 'sql:', quarantine mail in SQL server specified in @storage_sql_dsn.
  448. #   - undef, do not quarantine mail.
  449.  
  450. # Bad header.
  451. $bad_header_quarantine_method = undef;
  452. #$bad_header_quarantine_method = 'sql:';
  453. #$bad_header_quarantine_to = 'bad-header-quarantine';
  454.  
  455. # SPAM.
  456. $spam_quarantine_method = undef;
  457. #$spam_quarantine_method = 'sql:';
  458. #$spam_quarantine_to = 'spam-quarantine';
  459.  
  460. # Virus
  461. $virus_quarantine_to     = 'virus-quarantine';
  462. $virus_quarantine_method = 'sql:';
  463.  
  464. # Banned
  465. $banned_files_quarantine_method = undef;
  466. #$banned_files_quarantine_method = 'sql:';
  467. #$banned_quarantine_to = 'banned-quarantine';
  468.  
  469. #########################
  470. # Quarantine CLEAN mails.
  471. # Don't forget to enable clean quarantine in policy bank 'MYUSERS'.
  472. #
  473. #$clean_quarantine_method = 'sql:';
  474. #$clean_quarantine_to = 'clean-quarantine';
  475.  
  476. $sql_allow_8bit_address = 1;
  477. $timestamp_fmt_mysql = 1;
  478.  
  479. # a string to prepend to Subject (for local recipients only) if mail could
  480. # not be decoded or checked entirely, e.g. due to password-protected archives
  481. #$undecipherable_subject_tag = '***UNCHECKED*** ';  # undef disables it
  482. $undecipherable_subject_tag = undef;
  483. # Hope to fix 'nested MAIL command' issue on high load server.
  484. $smtp_connection_cache_enable = 0;
  485.  
  486. # The default set of header fields to be signed can be controlled
  487. # by setting %signed_header_fields elements to true (to sign) or
  488. # to false (not to sign). Keys must be in lowercase, e.g.:
  489. # 0 -> off
  490. # 1 -> on
  491. $signed_header_fields{'received'} = 0;
  492. $signed_header_fields{'to'} = 1;
  493.  
  494. # Make sure it sings all inbound mails, avoid error log like this:
  495. # 'dkim: not signing inbound mail'.
  496. # $originating = 1;
  497.  
  498. # Add dkim_key here.
  499. dkim_key("youcantspoilababy.org", "dkim", "/var/lib/dkim/youcantspoilababy.org.pem");
  500.  
  501. # Note that signing mail for subdomains with a key of a parent
  502. # domain is treated by recipients as a third-party key, which
  503. # may 'hold less merit' in their eyes. If one has a choice,
  504. # it is better to publish a key for each domain (e.g. host1.a.cn)
  505. # if mail is really coming from it. Sharing a pem file
  506. # for multiple domains may be acceptable, so you don't need
  507. # to generate a different key for each subdomain, but you
  508. # do need to publish it in each subdomain. It is probably
  509. # easier to avoid sending addresses like host1.a.cn and
  510. # always use a parent domain (a.cn) in 'From:', thus
  511. # avoiding the issue altogether.
  512. #dkim_key("host1.youcantspoilababy.org", "dkim", "/var/lib/dkim/youcantspoilababy.org.pem");
  513. #dkim_key("host3.youcantspoilababy.org", "dkim", "/var/lib/dkim/youcantspoilababy.org.pem");
  514.  
  515. # Add new dkim_key for other domain.
  516. #dkim_key('Your_New_Domain_Name', 'dkim', 'Your_New_Pem_File');
  517.  
  518. @dkim_signature_options_bysender_maps = ( {
  519.     # ------------------------------------
  520.     # For domain: youcantspoilababy.org.
  521.     # ------------------------------------
  522.     # 'd' defaults to a domain of an author/sender address,
  523.     # 's' defaults to whatever selector is offered by a matching key
  524.  
  525.     #'[email protected]'    => { d => "youcantspoilababy.org", a => 'rsa-sha256', ttl =>  7*24*3600 },
  526.     #"[email protected]"    => { d => "youcantspoilababy.org", a => 'rsa-sha256', ttl =>  7*24*3600 },
  527.  
  528.     # explicit 'd' forces a third-party signature on foreign (hosted) domains
  529.     "youcantspoilababy.org"  => { d => "youcantspoilababy.org", a => 'rsa-sha256', ttl => 10*24*3600 },
  530.     #"host1.youcantspoilababy.org"  => { d => "host1.youcantspoilababy.org", a => 'rsa-sha256', ttl => 10*24*3600 },
  531.     #"host2.youcantspoilababy.org"  => { d => "host2.youcantspoilababy.org", a => 'rsa-sha256', ttl => 10*24*3600 },
  532.     # ---- End domain: youcantspoilababy.org ----
  533.  
  534.     # catchall defaults
  535.     '.' => { a => 'rsa-sha256', c => 'relaxed/simple', ttl => 30*24*3600 },
  536. } );
  537. # ------------ Disclaimer Setting ---------------
  538. # Uncomment this line to enable singing disclaimer in outgoing mails.
  539. #$defang_maps_by_ccat{+CC_CATCHALL} = [ 'disclaimer' ];
  540.  
  541. # Program used to signing disclaimer in outgoing mails.
  542. $altermime = '/usr/bin/altermime';
  543.  
  544. # Disclaimer in plain text formart.
  545. @altermime_args_disclaimer = qw(--disclaimer=/etc/postfix/disclaimer/_OPTION_.txt --disclaimer-html=/etc/postfix/disclaimer/_OPTION_.txt --force-for-bad-html);
  546.  
  547. @disclaimer_options_bysender_maps = ({
  548.     # Per-domain disclaimer setting: /etc/postfix/disclaimer/host1.iredmail.org.txt
  549.     #'host1.iredmail.org' => 'host1.iredmail.org',
  550.  
  551.     # Sub-domain disclaimer setting: /etc/postfix/disclaimer/iredmail.org.txt
  552.     #'.iredmail.org'      => 'iredmail.org',
  553.  
  554.     # Per-user disclaimer setting: /etc/postfix/disclaimer/boss.iredmail.org.txt
  555.     #'[email protected]'  => 'boss.iredmail.org',
  556.  
  557.     # Catch-all disclaimer setting: /etc/postfix/disclaimer/default.txt
  558.     '.' => 'default',
  559. },);
  560. # ------------ End Disclaimer Setting ---------------
  561. # Reporting and quarantining.
  562. @storage_sql_dsn = (
  563.     ['DBI:mysql:database=amavisd;host=127.0.0.1;port=3306', 'amavisd', 'JWzhJJfBmdji4FtXWYwgjzeu7awVB2'],
  564. );
  565.  
  566. # Lookup for per-recipient, per-domain and global policy.
  567. @lookup_sql_dsn = @storage_sql_dsn;
  568. # Don't send email with subject "UNCHECKED contents in mail FROM xxx".
  569. delete $admin_maps_by_ccat{&CC_UNCHECKED};
  570.  
  571. # Do not notify administrator about SPAM/VIRUS from remote servers.
  572. $virus_admin = undef;
  573. $spam_admin = undef;
  574. $banned_admin = undef;
  575. $bad_header_admin = undef;
  576.  
  577. # Num of pre-forked children.
  578. # WARNING: it must match (equal to or larger than) the number set in
  579. # /etc/postfix/master.cf "maxproc" column for the 'smtp-amavis' service.
  580. $max_servers = 4;
  581.  
  582. $localhost_name = $myhostname;
  583. # Amavisd on some Linux/BSD distribution use $banned_namepath_re instead of
  584. # $banned_filename_re, so we define some blocked file types here.
  585. #
  586. # Sample input for $banned_namepath_re:
  587. #
  588. #   P=p003\tL=1\tM=multipart/mixed\nP=p002\tL=1/2\tM=application/octet-stream\tT=dat\tN=my_docum.zip
  589. #
  590. # What it means:
  591. #   - T: type. e.g. zip archive.
  592. #   - M: MIME type. e.g. application/octet-stream.
  593. #   - N: suggested (MIME) name. e.g. my_docum.zip.
  594.  
  595. $banned_namepath_re = new_RE(
  596.     # Unknown binary files.
  597.     [qr'M=application/(zip|rar|arc|arj|zoo|gz|bz2)(,|\t).*T=dat(,|\t)'xmi => 'DISCARD'],
  598.  
  599.     [qr'T=(exe|exe-ms|lha|cab|dll)(,|\t)'xmi => 'DISCARD'],       # banned file(1) types
  600.     [qr'T=(pif|scr)(,|\t)'xmi => 'DISCARD'],                      # banned extensions - rudimentary
  601.     [qr'T=ani(,|\t)'xmi => 'DISCARD'],                            # banned animated cursor file(1) type
  602.     [qr'T=(mim|b64|bhx|hqx|xxe|uu|uue)(,|\t)'xmi => 'DISCARD'],   # banned extension - WinZip vulnerab.
  603.     [qr'M=application/x-msdownload(,|\t)'xmi => 'DISCARD'],       # block these MIME types
  604.     [qr'M=application/x-msdos-program(,|\t)'xmi => 'DISCARD'],
  605.     [qr'M=application/hta(,|\t)'xmi => 'DISCARD'],
  606.     [qr'M=(application/x-msmetafile|image/x-wmf)(,|\t)'xmi => 'DISCARD'],  # Windows Metafile MIME type
  607. );
  608. # Listen on specified addresses.
  609. #$inet_socket_bind = [ '127.0.0.1', '[::1]' ];
  610.  
  611.  
  612. # Custom Amavisd log template to always log SpamAssassin testing results,
  613. # useful for troubleshooting. if you want more verbose log, replace it by:
  614. #
  615. #   $log_templ = $log_verbose_templ;
  616. #
  617. # WARNING: $log_verbose_templ will log mail subject, this may be illegal
  618. #          according to the laws in some countries.
  619. #
  620. # Note: You can find the original log template at the bottom of
  621. #       /usr/sbin/amavisd-new.
  622. $log_templ = '
  623. [?%#D|#|Passed #
  624. [? [:ccat|major] |#
  625. OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER-[:ccat|minor]|SPAMMY|SPAM|\
  626. UNCHECKED[?[:ccat|minor]||-ENCRYPTED|]|BANNED (%F)|INFECTED (%V)]#
  627. {[:actions_performed]}#
  628. ,[?%p|| %p][?%a||[?%l|| LOCAL] [:client_addr_port]][?%e|| \[%e\]] %s -> [%D|,]#
  629. [? %q ||, quarantine: %q]#
  630. [? %Q ||, Queue-ID: %Q]#
  631. [? %m ||, Message-ID: [:mail_addr_decode_octets|%m]]#
  632. [? %r ||, Resent-Message-ID: [:mail_addr_decode_octets|%r]]#
  633. [? %i ||, mail_id: %i]#
  634. , Hits: [:SCORE]#
  635. , size: %z#
  636. [? [:partition_tag] ||, pt: [:partition_tag]]#
  637. [~[:remote_mta_smtp_response]|["^$"]||[", queued_as: "]]\
  638. [remote_mta_smtp_response|[~%x|["queued as ([0-9A-Za-z]+)$"]|["%1"]|["%0"]]|/]#
  639. #, Subject: [:dquote|[:mime2utf8|[:header_field_octets|Subject]|100|1]]#
  640. #, From: [:uquote|[:mail_addr_decode_octets|[:rfc2822_from]]]#
  641. [? [:dkim|sig_sd]    ||, dkim_sd=[:dkim|sig_sd]]#
  642. [? [:dkim|newsig_sd] ||, dkim_new=[:dkim|newsig_sd]]#
  643. , %y ms#
  644. [? %#T ||, Tests: \[[%T|,]\]]#
  645. ]
  646. [?%#O|#|Blocked #
  647. [? [:ccat|major|blocking] |#
  648. OTHER|CLEAN|MTA-BLOCKED|OVERSIZED|BAD-HEADER-[:ccat|minor]|SPAMMY|SPAM|\
  649. UNCHECKED[?[:ccat|minor]||-ENCRYPTED|]|BANNED (%F)|INFECTED (%V)]#
  650. {[:actions_performed]}#
  651. ,[?%p|| %p][?%a||[?%l|| LOCAL] [:client_addr_port]][?%e|| \[%e\]] %s -> [%D|,]#
  652. [? %q ||, quarantine: %q]#
  653. [? %Q ||, Queue-ID: %Q]#
  654. [? %m ||, Message-ID: [:mail_addr_decode_octets|%m]]#
  655. [? %r ||, Resent-Message-ID: [:mail_addr_decode_octets|%r]]#
  656. [? %i ||, mail_id: %i]#
  657. , Hits: [:SCORE]#
  658. , size: %z#
  659. [? [:partition_tag] ||, pt: [:partition_tag]]#
  660. #, Subject: [:dquote|[:mime2utf8|[:header_field_octets|Subject]|100|1]]#
  661. #, From: [:uquote|[:mail_addr_decode_octets|[:rfc2822_from]]]#
  662. [? [:dkim|sig_sd]    ||, dkim_sd=[:dkim|sig_sd]]#
  663. [? [:dkim|newsig_sd] ||, dkim_new=[:dkim|newsig_sd]]#
  664. , %y ms#
  665. [? %#T ||, Tests: \[[%T|,]\]]#
  666. ]';
  667.  
  668.  
  669. 1;  # insure a defined return
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!