added config for rspamd, razor, pyzor

.etckeeper

@@ -4520,9 +4520,11 @@ maybe chmod 0644 'rspamd/common.conf'
 maybe chmod 0644 'rspamd/composites.conf'
 maybe chmod 0644 'rspamd/groups.conf'
 maybe chmod 0755 'rspamd/local.d'
-maybe chmod 0644 'rspamd/local.d/arc.conf'
+maybe chmod 0644 'rspamd/local.d/antivirus.conf'
 maybe chmod 0644 'rspamd/local.d/classifier-bayes.inc'
 maybe chmod 0644 'rspamd/local.d/dkim_signing.conf'
+maybe chmod 0644 'rspamd/local.d/external_services.conf'
+maybe chmod 0644 'rspamd/local.d/force_actions.conf'
 maybe chmod 0644 'rspamd/local.d/logging.inc'
 maybe chmod 0644 'rspamd/local.d/milter_headers.inc'
 maybe chmod 0644 'rspamd/local.d/multimap.conf'
@@ -4596,6 +4598,7 @@ maybe chmod 0644 'rspamd/options.inc'
 maybe chmod 0755 'rspamd/override.d'
 maybe chmod 0644 'rspamd/override.d/classifier-bayes.conf'
 maybe chmod 0644 'rspamd/override.d/milter_headers.inc'
+maybe chmod 0644 'rspamd/override.d/worker-fuzzy.conf'
 maybe chmod 0644 'rspamd/rspamd.conf'
 maybe chmod 0755 'rspamd/scores.d'
 maybe chmod 0644 'rspamd/scores.d/content_group.conf'
@@ -4768,6 +4771,10 @@ maybe chmod 0755 'systemd/system/network-online.target.wants'
 maybe chmod 0644 'systemd/system/nextcloudcron.service'
 maybe chmod 0644 'systemd/system/nextcloudcron.timer'
 maybe chmod 0644 'systemd/system/openhabcloud.service'
+maybe chmod 0644 'systemd/system/pyzor.socket'
+maybe chmod 0644 'systemd/system/pyzor@.service'
+maybe chmod 0644 'systemd/system/razor.socket'
+maybe chmod 0644 'systemd/system/razor@.service'
 maybe chmod 0644 'systemd/system/searx.service'
 maybe chmod 0755 'systemd/system/sockets.target.wants'
 maybe chmod 0755 'systemd/system/sysinit.target.wants'

rspamd/local.d/antivirus.conf

@@ -0,0 +1,8 @@
+clamav {
+ action = "reject";
+ scan_mime_parts = true;
+ log_clean = true;
+ symbol = "CLAM_VIRUS";
+ type = "clamav";
+ servers = "/var/run/clamav/clamd.ctl";
+}

rspamd/local.d/arc.conf

@@ -1,5 +0,0 @@
-path = "/var/lib/rspamd/dkim/$selector.key";
-selector = "2017";
-
-### Enable DKIM signing for alias sender addresses
-allow_username_mismatch = true;

rspamd/local.d/arc.conf

@@ -0,0 +1 @@
+/etc/rspamd/local.d/dkim_signing.conf

rspamd/local.d/external_services.conf

@@ -0,0 +1,9 @@
+# default pyzor settings
+pyzor {
+    servers = "127.0.0.1:5953"
+}
+
+# default razor settings
+razor {
+    servers = "127.0.0.1:11342"
+}

rspamd/local.d/force_actions.conf

@@ -0,0 +1,34 @@
+rules {
+
+  WHITELIST_EXCEPTION {
+    action = "reject";
+    expression = "IS_IN_WHITELIST & (CLAM_VIRUS | FPROT_VIRUS)";
+    # message setting sets SMTP message returned by mailer
+    message = "Rejected due to suspicion of virus";
+  }
+
+  REJECT_MIME_BAD { 
+    action = "reject";
+    expression = "MIME_BAD";
+    # message can contain selector expressions enclosed in ${}
+    message = "(support-id: ${queueid}) Your mail was rejected because it contains BANNED ATTACHMENTS. Please check https://www.example.com/${languages.first}/allowed-attachments.html for further details!"
+  }
+
+  DCC_BULK {
+    action = "rewrite subject";
+    # Here expression is just one symbol
+    expression = "DCC_BULK";
+    # subject setting sets metric subject for rewrite subject action
+    subject = "[BULK] %s";
+    # honor_action setting define actions we don't want to override
+    honor_action = ["reject", "soft reject", "add header"];
+  }
+
+  BAYES_SPAM_UPGRADE {
+    action = "add header";
+    expression = "BAYES_SPAM";
+    # require_action setting defines actions that will be overridden
+    require_action = ["no action", "greylist"];
+  }
+
+}

rspamd/local.d/logging.inc

@@ -1,4 +1,4 @@
 type = "file";
 filename = "/var/log/rspamd/rspamd.log";
-level = "error";
+level = "warning";
 debug_modules = [];

rspamd/local.d/milter_headers.inc

@@ -1,3 +1,12 @@
 use = ["x-spamd-bar", "x-spam-level", "authentication-results"];
 authenticated_headers = ["authentication-results"];
-extended_spam_headers = true;
+extended_spam_headers = true
+skip_local = false
+skip_authenticated = true
+
+routines {
+  x-rspamd-server {
+    hostname = mail.solusar.de
+  }
+}
+

rspamd/local.d/multimap.conf

@@ -4,3 +4,39 @@ WHITELIST_SENDER_DOMAIN {
   map = "/etc/rspamd/local.d/whitelist.sender.domain.map";
   score = -6.0
 }
+
+WHITELIST_IP {
+   type = "ip";
+   map = "/var/lib/rspamd/whitelist_ip.map";
+   description = "Lokale ip whitelist -> accept";
+   action = "accept";
+}
+
+WHITELIST_FROM {
+   type = "from";
+   map = "/var/lib/rspamd/whitelist_from.map";
+   description = "Lokale from Whitelist -> accept";
+   action = "accept";
+}
+
+WHITELIST_FROM_DOMAIN {
+  type = "from";
+  filter = "email:domain";
+  map = "/var/lib/rspamd/whitelist_from_domain.map";
+  description = "Lokale from Domain Whitelist -> -6.0";
+  score = -6.0
+}
+
+BLACKLIST_IP {
+  type = "ip";
+  map = "/var/lib/rspamd/blacklist_ip.map";
+  description = "Lokale ip Blacklist -> reject";
+  action = "reject";
+}
+
+BLACKLIST_FROM {
+  type = "from";
+  map = "/var/lib/rspamd/blacklist_from.map";
+  description = "Lokale from Blacklist -> reject";
+  action = "reject";
+}

rspamd/override.d/worker-fuzzy.conf

@@ -0,0 +1,16 @@
+# worker instances
+count = 1;
+
+# listen on host
+bind_socket = "127.0.0.1:11333";
+
+# backend
+backen = redis;
+servers = "127.0.0.1:6379";
+timeout = 1s;
+db = 0;
+password = "3<kq43j=uB<d7q-e";
+
+expire = 90d;
+
+allow_update = "127.0.0.1"

systemd/system/pyzor.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=Pyzor socket
+
+[Socket]
+ListenStream=127.0.0.1:5953
+Accept=yes
+
+[Install]
+WantedBy=sockets.target

systemd/system/pyzor@.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Pyzor Socket Service
+Requires=pyzor.socket
+
+[Service]
+Type=simple
+ExecStart=-/usr/bin/pyzor check
+StandardInput=socket
+StandardError=journal
+TimeoutStopSec=10
+
+User=_rspamd
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+PrivateUsers=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+
+[Install]
+WantedBy=multi-user.target

systemd/system/razor.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=Razor socket
+
+[Socket]
+ListenStream=127.0.0.1:11342
+Accept=yes
+
+[Install]
+WantedBy=sockets.target

systemd/system/razor@.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Razor Socket Service
+Requires=razor.socket
+
+[Service]
+Type=simple
+ExecStart=/bin/sh -c '/usr/bin/razor-check && /bin/echo -n "spam" || /bin/echo -n "ham"'
+StandardInput=socket
+StandardError=journal
+TimeoutStopSec=10
+
+User=_rspamd
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateTmp=true
+PrivateUsers=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectSystem=strict
+
+[Install]
+WantedBy=multi-user.target

systemd/system/sockets.target.wants/pyzor.socket

@@ -0,0 +1 @@
+/etc/systemd/system/pyzor.socket

systemd/system/sockets.target.wants/razor.socket

@@ -0,0 +1 @@
+/etc/systemd/system/razor.socket