一、測試DSPAM（未使用amavisd調用DSPAM）－ 一般郵件
1、外部郵箱[email protected]發送一封郵件給[email protected]
主題：1111111111111 內容空
說明：前面的博文說過了，需要再搭建一個一樣的郵件系統來模擬外部郵件；
如果你的域是萬網之類的地方註冊的，可以解析到你的郵箱服務器就可以直接用QQ郵箱發。
2、查看日誌
[root@mail ~]# tailf /var/log/maillog Dec 10 09:22:37 mail postfix/smtpd[61297]: NOQUEUE: filter: RCPT from unknown[10.188.1.86]: <unknown[10.188.1.86]>: Client host triggers FILTER lmtp:[127.0.0.1]:10028; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> #觸發DSPAM過濾器lmtp:[127.0.0.1]:10028 Dec 10 09:22:39 mail postfix/smtpd[61297]: 447941A2121: client=unknown[10.188.1.86] Dec 10 09:22:39 mail postfix/cleanup[61307]: 447941A2121: message-id=<[email protected]> Dec 10 09:22:39 mail postfix/qmgr[57578]: 447941A2121: from=<[email protected]>, size=1013, nrcpt=1 (queue active) Dec 10 09:22:39 mail postfix/smtpd[61297]: disconnect from unknown[10.188.1.86] #郵件正常發出 Dec 10 09:22:44 mail postfix/smtpd[61314]: initializing the server-side TLS engine Dec 10 09:22:44 mail postfix/smtpd[61314]: connect from localhost[127.0.0.1] Dec 10 09:22:44 mail postfix/smtpd[61314]: 3B4541A2138: client=localhost[127.0.0.1] Dec 10 09:22:44 mail postfix/cleanup[61307]: 3B4541A2138: message-id=<[email protected]> Dec 10 09:22:44 mail postfix/qmgr[57578]: 3B4541A2138: from=<[email protected]>, size=1633, nrcpt=1 (queue active) #postfix將郵件交給amavisd掃描 Dec 10 09:22:44 mail amavis[61231]: (61231-01) Passed CLEAN {RelayedInbound}, [10.188.1.86] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: bK_jEeiz4Lhq, Hits: -2.383, size: 1189, queued_as: 3B4541A2138, 4640 ms Dec 10 09:22:44 mail postfix/pipe[61315]: 3B4541A2138: to=<[email protected]>, relay=maildrop, delay=0.13, delays=0.03/0.03/0/0.08, dsn=2.0.0, status=sent (delivered via maildrop service) Dec 10 09:22:44 mail postfix/qmgr[57578]: 3B4541A2138: removed #amavisd調用clamav掃描病毒，通過並還給postfix Dec 10 09:22:44 mail postfix/lmtp[61309]: 447941A2121: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10028, delay=6.6, delays=1.5/0.03/0.06/5, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> Message accepted for delivery) Dec 10 09:22:44 mail postfix/qmgr[57578]: 447941A2121: removed #postfix將郵件交付給收件人
3、DSPAM頁面的history中有一條垃圾掃描記錄
顯示了垃圾郵件判斷結果、發送時間、發件人、郵件主題、其他信息
注意：系統管理員的主要工作將在這裏操作，即人工判斷爲垃圾郵件的，點擊AsSpam打入垃圾郵件；
經過長時間的學習，DSPAM系統將提高垃圾郵件的判斷率，可以有意將一個郵箱賬號發佈到各種網站上，
以此來吸引垃圾郵件。
4、查看信頭，最下方有一組DSPAM標記
X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Dec 10 09:22:39 2014 X-DSPAM-Confidence: 0.9902 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 1,5487a05f580541723287998
5、查看DSPAM日誌
[root@mail ~]# tail /usr/local/dspam/var/dspam/system.log 1418174559 I postmaster 1,5487a05f580541723287998 1111111111111 0.193525 extmail Delivered <[email protected]>
二、測試DSPAM（未使用amavisd調用DSPAM）－ 垃圾郵件
1、繼續發一封郵件，主題和內容使用以下垃圾郵件測試代碼
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
2、查看日誌
[root@mail ~]# tailf /var/log/maillog Dec 10 09:32:46 mail postfix/smtpd[61368]: NOQUEUE: filter: RCPT from unknown[10.188.1.86]: <unknown[10.188.1.86]>: Client host triggers FILTER lmtp:[127.0.0.1]:10028; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> Dec 10 09:32:46 mail postfix/smtpd[61368]: 2E16B1A2121: client=unknown[10.188.1.86] Dec 10 09:32:46 mail postfix/cleanup[61378]: 2E16B1A2121: message-id=<[email protected]> Dec 10 09:32:46 mail postfix/qmgr[57578]: 2E16B1A2121: from=<[email protected]>, size=1255, nrcpt=1 (queue active) Dec 10 09:32:46 mail postfix/smtpd[61368]: disconnect from unknown[10.188.1.86] Dec 10 09:32:48 mail postfix/smtpd[61384]: initializing the server-side TLS engine Dec 10 09:32:48 mail postfix/smtpd[61384]: connect from localhost[127.0.0.1] Dec 10 09:32:48 mail postfix/smtpd[61384]: BFE3E1A2141: client=localhost[127.0.0.1] Dec 10 09:32:48 mail postfix/cleanup[61378]: BFE3E1A2141: message-id=<[email protected]> Dec 10 09:32:48 mail postfix/qmgr[57578]: BFE3E1A2141: from=<[email protected]>, size=2316, nrcpt=1 (queue active) Dec 10 09:32:48 mail amavis[61233]: (61233-01) Passed SPAM {RelayedTaggedInbound,Quarantined}, [10.188.1.86] <[email protected]> -> <[email protected]>, quarantine: spam-iow5FVd_Jg1C.gz, Message-ID: <[email protected]>, mail_id: iow5FVd_Jg1C, Hits: 997.617, size: 1431, queued_as: BFE3E1A2141, 2452 ms #amavisd調用了SA掃描垃圾，判定爲SPAM（垃圾），但仍然放行了，在/var/virusmails/中保存了垃圾郵件記錄spam-iow5FVd_Jg1C.gz #由於maidrop全局過濾，垃圾郵件到了客戶端的“垃圾郵件”文件夾，使用POP3連接的客戶端無法同步到，使用IMAP連接的客戶端和WEB端可以看到垃圾郵件 Dec 10 09:32:48 mail postfix/lmtp[61380]: 2E16B1A2121: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10028, delay=2.7, delays=0.08/0.01/0.04/2.6, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> Message accepted for delivery) Dec 10 09:32:48 mail postfix/qmgr[57578]: 2E16B1A2121: removed Dec 10 09:32:48 mail postfix/pipe[61385]: BFE3E1A2141: to=<[email protected]>, relay=maildrop, delay=0.14, delays=0.03/0.04/0/0.06, dsn=2.0.0, status=sent (delivered via maildrop service) Dec 10 09:32:48 mail postfix/qmgr[57578]: BFE3E1A2141: removed
3、查看信頭
X-Virus-Scanned: amavisd-new at yourmail.com X-Spam-Flag: YES X-Spam-Score: 997.617 X-Spam-Level: **************************************************************** X-Spam-Status: Yes, score=997.617 tagged_above=2 required=6.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Dec 10 09:32:46 2014 X-DSPAM-Confidence: 0.9902 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 1,5487a2be580545400920763
注意：垃圾郵件主題中會插件***Spam***標記
結論：此時amavisd和DSPAM各自工作正常
三、測試DSPAM（已使用amavisd-2.8.0調用DSPAM）
1、外部郵箱[email protected]發送一封郵件給[email protected]
2、查看日誌
[root@mail ~]# tailf /var/log/maillog Dec 9 15:41:42 mail postfix/smtpd[57810]: NOQUEUE: filter: RCPT from unknown[10.188.1.86]: <unknown[10.188.1.86]>: Client host triggers FILTER lmtp:[127.0.0.1]:10028; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> #客戶端主機觸發了DSPAM過濾器 Dec 9 15:41:44 mail postfix/smtpd[57810]: NOQUEUE: reject: RCPT from unknown[10.188.1.86]: 450 4.7.1 <[email protected]>: Recipient address rejected: Try again, see http://bl.extmail.org/cgi/why?greylist; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> #拒收郵件，因爲是第一次接收對方郵件，Slockd的灰名單插件作用了，稍後重試 Dec 9 15:48:17 mail postfix/smtpd[57833]: NOQUEUE: filter: RCPT from unknown[10.188.1.86]: <unknown[10.188.1.86]>: Client host triggers FILTER lmtp:[127.0.0.1]:10028; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> Dec 9 15:48:17 mail postfix/smtpd[57833]: EA2AA1A211A: client=unknown[10.188.1.86] Dec 9 15:48:17 mail postfix/cleanup[57843]: EA2AA1A211A: message-id=<[email protected]> Dec 9 15:48:18 mail postfix/qmgr[57578]: EA2AA1A211A: from=<[email protected]>, size=954, nrcpt=1 (queue active) Dec 9 15:48:18 mail postfix/smtpd[57833]: disconnect from unknown[10.188.1.86] #郵件發出來了 Dec 9 15:48:19 mail dspam[57851]: Unable to determine the destination user Dec 9 15:48:19 mail dspam[57851]: DSPAM agent misconfigured: aborting #dspam報錯，dspam和amavisd都配置了--user extmail參數，應該是版本問題 Dec 9 15:48:19 mail amavis[57071]: (57071-01) (!)auto-learning with spam scanner DSPAM failed: DSPAM: error running program /usr/local/dspam/bin/dspam: exit 1 Dec 9 15:48:19 mail amavis[57071]: (57071-01) (!)Auto-learn failed: DSPAM failed: DSPAM: error running program /usr/local/dspam/bin/dspam: exit 1 at (eval 108) line 207. #amavis調用dspam報錯，這是amavis－2.8.0版本的BUG，已在在2.8.1中修復了 #BUG官方說明：http://www.ijs.si/software/amavisd/release-notes.txt Dec 9 15:48:19 mail postfix/smtpd[57852]: initializing the server-side TLS engine Dec 9 15:48:19 mail postfix/smtpd[57852]: connect from localhost[127.0.0.1] Dec 9 15:48:19 mail postfix/smtpd[57852]: 6E7A51A2142: client=localhost[127.0.0.1] Dec 9 15:48:19 mail postfix/cleanup[57843]: 6E7A51A2142: message-id=<[email protected]> Dec 9 15:48:19 mail postfix/qmgr[57578]: 6E7A51A2142: from=<[email protected]>, size=1781, nrcpt=1 (queue active) Dec 9 15:48:19 mail amavis[57071]: (57071-01) Passed CLEAN {RelayedInbound}, [10.188.1.86] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: nLJvfGg4h34C, Hits: -2.803, size: 1163, queued_as: 6E7A51A2142, 1414 ms #postfix將郵件轉給amavisd掃描 Dec 9 15:48:19 mail postfix/lmtp[57845]: EA2AA1A211A: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10028, delay=1.9, delays=0.36/0.02/0.04/1.5, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> Message accepted for delivery) Dec 9 15:48:19 mail postfix/qmgr[57578]: EA2AA1A211A: removed #dspam還回郵件 Dec 9 15:48:19 mail postfix/pipe[57853]: 6E7A51A2142: to=<[email protected]>, relay=maildrop, delay=0.21, delays=0.07/0.04/0/0.11, dsn=2.0.0, status=sent (delivered via maildrop service) Dec 9 15:48:19 mail postfix/qmgr[57578]: 6E7A51A2142: removed #amavis還回郵件
說明：由於我是先做的這個測試，所有灰名單先起作用，然後取消amavisd調用dspam，因此在測試一、二中沒有灰名單作用了，不管你先測哪個，明白第一次收到對方的郵件時灰名單作用就行了。
3、查看信頭
X-DSPAM-Processed: Tue Dec 9 15:48:19 2014 X-DSPAM-Confidence: 0.9901 X-DSPAM-Probability: 0.0000 X-Virus-Scanned: amavisd-new at yourmail.com X-DSPAM-Result: Innocent X-DSPAM-Signature: 1,5486a943574271440440046 X-DSPAM-Result: Innocent X-DSPAM-Processed: Tue Dec 9 15:48:18 2014 X-DSPAM-Confidence: 0.7811 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 1,5486a942574272128866500
說明：上部分是amavisd調用DSPAM產生的，下部分是postfix調用DSPAM產生的。
4、查看DSPAM頁面
在DSPAM頁面中的history查看Resent是因爲灰名單插件，郵件發送兩次進行了兩次DSPAM處理
5、查看日誌
[root@mail ~]# tailf /var/log/maildrop.log Date: Tue Dec 9 15:48:19 2014 From: "=?ISO-8859-1?B?cG9zdG1hc3Rlcg==?=" <[email protected]> Subj: =?ISO-8859-1?B?aGFhaGFoYWhhaA==?= File: /home/domains/yourmail.com/test/Maildir/ (1814)
四、測試DSPAM（已使用amavisd-2.6.6調用DSPAM）
1、amavisd-new換成2.6.6版本
[root@mail ~]# yum erase amavisd-new [root@mail ~]# yum install amavisd-new-2.6.6
amavis的賬號及組會重建，重新賦予權限
[root@mail ~]# chown -R amavis.amavis /var/amavis/
重新將clamav用戶加入amavis組
[root@mail ~]# usermod -G amavis clamav
重新設置amavisd.conf，參考前面的博文
重啓clamd和amavisd服務
2、外部郵箱[email protected]發送一封郵件給[email protected]
3、查看日誌
[root@mail ~]# tailf /var/log/maillog Dec 11 09:25:23 mail postfix/smtpd[17976]: NOQUEUE: filter: RCPT from unknown[10.188.1.86]: <unknown[10.188.1.86]>: Client host triggers FILTER lmtp:[127.0.0.1]:10028; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.eplantstore.com> Dec 11 09:25:23 mail postfix/smtpd[17976]: B79381A2135: client=unknown[10.188.1.86] Dec 11 09:25:23 mail postfix/cleanup[17985]: B79381A2135: message-id=<[email protected]> Dec 11 09:25:23 mail postfix/smtpd[17976]: disconnect from unknown[10.188.1.86] Dec 11 09:25:23 mail postfix/qmgr[57578]: B79381A2135: from=<[email protected]>, size=2029, nrcpt=1 (queue active) Dec 11 09:25:25 mail postfix/smtpd[17993]: initializing the server-side TLS engine Dec 11 09:25:25 mail postfix/smtpd[17993]: connect from localhost[127.0.0.1] Dec 11 09:25:25 mail postfix/smtpd[17993]: 0B6E51A2149: client=localhost[127.0.0.1] Dec 11 09:25:25 mail postfix/cleanup[17985]: 0B6E51A2149: message-id=<[email protected]> Dec 11 09:25:25 mail postfix/qmgr[57578]: 0B6E51A2149: from=<[email protected]>, size=3295, nrcpt=1 (queue active) Dec 11 09:25:25 mail amavis[17965]: (17965-01) Passed SPAM, [10.188.1.86] [10.188.1.86] <[email protected]> -> <[email protected]>, quarantine: spam-Cf07BG0OO0xy.gz, Message-ID: <[email protected]>, mail_id: Cf07BG0OO0xy, Hits: 998.797, size: 2208, queued_as: 0B6E51A2149, 1077 ms Dec 11 09:25:25 mail postfix/lmtp[17987]: B79381A2135: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10028, delay=1.5, delays=0.23/0.04/0.04/1.2, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> Message accepted for delivery) Dec 11 09:25:25 mail postfix/qmgr[57578]: B79381A2135: removed Dec 11 09:25:25 mail postfix/pipe[17994]: 0B6E51A2149: to=<[email protected]>, relay=maildrop, delay=0.25, delays=0.04/0.04/0/0.18, dsn=2.0.0, status=sent (delivered via maildrop service) Dec 11 09:25:25 mail postfix/qmgr[57578]: 0B6E51A2149: removed
這回沒有報錯信息了
4、再來查看信頭
X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Dec 11 09:25:24 2014 X-DSPAM-Confidence: 0.9902 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 1,5488f284633212468127837 X-Quarantine-ID: <Cf07BG0OO0xy> X-Virus-Scanned: amavisd-new at yourmail.com X-Spam-Flag: YES X-Spam-Score: 998.797 X-Spam-Level: **************************************************************** X-Spam-Status: Yes, score=998.797 tagged_above=2 required=6.2 tests=[ALL_TRUSTED=-1, DSPAM_AWL=-1.05, FROM_EXCESS_BASE64=0.105, GTUBE=1000, HTML_MESSAGE=0.001, HTML_MIME_NO_HTML_TAG=0.635, MIME_HTML_ONLY=1.105, TVD_SPACE_RATIO=0.001, DSPAM:Whitelisted=-1.000] autolearn=no autolearn_force=no X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Dec 11 09:25:24 2014 X-DSPAM-Confidence: 0.9902 X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 1,5488f283633214439921469
結論：
測試郵件發多了，DSPAM已自動將發件人放進白名單了；
amavisd調用了SA掃描垃圾，判定爲垃圾，投放到“垃圾郵件”箱中；
可以在X-Spam-Status看到DSPAM:Whitelisted=-1.000，這表明DSPAM作爲SA的插件，執行了分數減1的操作；
autolearn=no表示amavisd調用SA自動學習白名單沒有設置，後面關於amavisd啓動黑白名單會講。