From 158a843e3cf6bdd5a26e95b9f1077828f0e7c9c0 Mon Sep 17 00:00:00 2001 From: Gorden Mende Date: Fri, 29 Apr 2022 09:48:56 +0200 Subject: [PATCH] added config for rspamd, razor, pyzor --- .etckeeper | 9 ++++- rspamd/local.d/antivirus.conf | 8 +++++ rspamd/local.d/arc.conf | 6 +--- rspamd/local.d/external_services.conf | 9 +++++ rspamd/local.d/force_actions.conf | 34 ++++++++++++++++++ rspamd/local.d/logging.inc | 2 +- rspamd/local.d/milter_headers.inc | 11 +++++- rspamd/local.d/multimap.conf | 36 +++++++++++++++++++ rspamd/override.d/worker-fuzzy.conf | 16 +++++++++ systemd/system/pyzor.socket | 9 +++++ systemd/system/pyzor@.service | 24 +++++++++++++ systemd/system/razor.socket | 9 +++++ systemd/system/razor@.service | 24 +++++++++++++ .../system/sockets.target.wants/pyzor.socket | 1 + .../system/sockets.target.wants/razor.socket | 1 + 15 files changed, 191 insertions(+), 8 deletions(-) create mode 100644 rspamd/local.d/antivirus.conf mode change 100644 => 120000 rspamd/local.d/arc.conf create mode 100644 rspamd/local.d/external_services.conf create mode 100644 rspamd/local.d/force_actions.conf create mode 100644 rspamd/override.d/worker-fuzzy.conf create mode 100644 systemd/system/pyzor.socket create mode 100644 systemd/system/pyzor@.service create mode 100644 systemd/system/razor.socket create mode 100644 systemd/system/razor@.service create mode 120000 systemd/system/sockets.target.wants/pyzor.socket create mode 120000 systemd/system/sockets.target.wants/razor.socket diff --git a/.etckeeper b/.etckeeper index a8260be9..4bdab97d 100755 --- a/.etckeeper +++ b/.etckeeper @@ -4520,9 +4520,11 @@ maybe chmod 0644 'rspamd/common.conf' maybe chmod 0644 'rspamd/composites.conf' maybe chmod 0644 'rspamd/groups.conf' maybe chmod 0755 'rspamd/local.d' -maybe chmod 0644 'rspamd/local.d/arc.conf' +maybe chmod 0644 'rspamd/local.d/antivirus.conf' maybe chmod 0644 'rspamd/local.d/classifier-bayes.inc' maybe chmod 0644 'rspamd/local.d/dkim_signing.conf' +maybe chmod 0644 'rspamd/local.d/external_services.conf' +maybe chmod 0644 'rspamd/local.d/force_actions.conf' maybe chmod 0644 'rspamd/local.d/logging.inc' maybe chmod 0644 'rspamd/local.d/milter_headers.inc' maybe chmod 0644 'rspamd/local.d/multimap.conf' @@ -4596,6 +4598,7 @@ maybe chmod 0644 'rspamd/options.inc' maybe chmod 0755 'rspamd/override.d' maybe chmod 0644 'rspamd/override.d/classifier-bayes.conf' maybe chmod 0644 'rspamd/override.d/milter_headers.inc' +maybe chmod 0644 'rspamd/override.d/worker-fuzzy.conf' maybe chmod 0644 'rspamd/rspamd.conf' maybe chmod 0755 'rspamd/scores.d' maybe chmod 0644 'rspamd/scores.d/content_group.conf' @@ -4768,6 +4771,10 @@ maybe chmod 0755 'systemd/system/network-online.target.wants' maybe chmod 0644 'systemd/system/nextcloudcron.service' maybe chmod 0644 'systemd/system/nextcloudcron.timer' maybe chmod 0644 'systemd/system/openhabcloud.service' +maybe chmod 0644 'systemd/system/pyzor.socket' +maybe chmod 0644 'systemd/system/pyzor@.service' +maybe chmod 0644 'systemd/system/razor.socket' +maybe chmod 0644 'systemd/system/razor@.service' maybe chmod 0644 'systemd/system/searx.service' maybe chmod 0755 'systemd/system/sockets.target.wants' maybe chmod 0755 'systemd/system/sysinit.target.wants' diff --git a/rspamd/local.d/antivirus.conf b/rspamd/local.d/antivirus.conf new file mode 100644 index 00000000..e972080d --- /dev/null +++ b/rspamd/local.d/antivirus.conf @@ -0,0 +1,8 @@ +clamav { + action = "reject"; + scan_mime_parts = true; + log_clean = true; + symbol = "CLAM_VIRUS"; + type = "clamav"; + servers = "/var/run/clamav/clamd.ctl"; +} diff --git a/rspamd/local.d/arc.conf b/rspamd/local.d/arc.conf deleted file mode 100644 index 185ce6c1..00000000 --- a/rspamd/local.d/arc.conf +++ /dev/null @@ -1,5 +0,0 @@ -path = "/var/lib/rspamd/dkim/$selector.key"; -selector = "2017"; - -### Enable DKIM signing for alias sender addresses -allow_username_mismatch = true; diff --git a/rspamd/local.d/arc.conf b/rspamd/local.d/arc.conf new file mode 120000 index 00000000..ce1839d1 --- /dev/null +++ b/rspamd/local.d/arc.conf @@ -0,0 +1 @@ +/etc/rspamd/local.d/dkim_signing.conf \ No newline at end of file diff --git a/rspamd/local.d/external_services.conf b/rspamd/local.d/external_services.conf new file mode 100644 index 00000000..cbaf035a --- /dev/null +++ b/rspamd/local.d/external_services.conf @@ -0,0 +1,9 @@ +# default pyzor settings +pyzor { + servers = "127.0.0.1:5953" +} + +# default razor settings +razor { + servers = "127.0.0.1:11342" +} diff --git a/rspamd/local.d/force_actions.conf b/rspamd/local.d/force_actions.conf new file mode 100644 index 00000000..2de11659 --- /dev/null +++ b/rspamd/local.d/force_actions.conf @@ -0,0 +1,34 @@ +rules { + + WHITELIST_EXCEPTION { + action = "reject"; + expression = "IS_IN_WHITELIST & (CLAM_VIRUS | FPROT_VIRUS)"; + # message setting sets SMTP message returned by mailer + message = "Rejected due to suspicion of virus"; + } + + REJECT_MIME_BAD { + action = "reject"; + expression = "MIME_BAD"; + # message can contain selector expressions enclosed in ${} + message = "(support-id: ${queueid}) Your mail was rejected because it contains BANNED ATTACHMENTS. Please check https://www.example.com/${languages.first}/allowed-attachments.html for further details!" + } + + DCC_BULK { + action = "rewrite subject"; + # Here expression is just one symbol + expression = "DCC_BULK"; + # subject setting sets metric subject for rewrite subject action + subject = "[BULK] %s"; + # honor_action setting define actions we don't want to override + honor_action = ["reject", "soft reject", "add header"]; + } + + BAYES_SPAM_UPGRADE { + action = "add header"; + expression = "BAYES_SPAM"; + # require_action setting defines actions that will be overridden + require_action = ["no action", "greylist"]; + } + +} diff --git a/rspamd/local.d/logging.inc b/rspamd/local.d/logging.inc index ed16bd8e..64a3e76c 100644 --- a/rspamd/local.d/logging.inc +++ b/rspamd/local.d/logging.inc @@ -1,4 +1,4 @@ type = "file"; filename = "/var/log/rspamd/rspamd.log"; -level = "error"; +level = "warning"; debug_modules = []; diff --git a/rspamd/local.d/milter_headers.inc b/rspamd/local.d/milter_headers.inc index 191e711b..d035154e 100644 --- a/rspamd/local.d/milter_headers.inc +++ b/rspamd/local.d/milter_headers.inc @@ -1,3 +1,12 @@ use = ["x-spamd-bar", "x-spam-level", "authentication-results"]; authenticated_headers = ["authentication-results"]; -extended_spam_headers = true; +extended_spam_headers = true +skip_local = false +skip_authenticated = true + +routines { + x-rspamd-server { + hostname = mail.solusar.de + } +} + diff --git a/rspamd/local.d/multimap.conf b/rspamd/local.d/multimap.conf index fdd28da8..1e6f380b 100644 --- a/rspamd/local.d/multimap.conf +++ b/rspamd/local.d/multimap.conf @@ -4,3 +4,39 @@ WHITELIST_SENDER_DOMAIN { map = "/etc/rspamd/local.d/whitelist.sender.domain.map"; score = -6.0 } + +WHITELIST_IP { + type = "ip"; + map = "/var/lib/rspamd/whitelist_ip.map"; + description = "Lokale ip whitelist -> accept"; + action = "accept"; +} + +WHITELIST_FROM { + type = "from"; + map = "/var/lib/rspamd/whitelist_from.map"; + description = "Lokale from Whitelist -> accept"; + action = "accept"; +} + +WHITELIST_FROM_DOMAIN { + type = "from"; + filter = "email:domain"; + map = "/var/lib/rspamd/whitelist_from_domain.map"; + description = "Lokale from Domain Whitelist -> -6.0"; + score = -6.0 +} + +BLACKLIST_IP { + type = "ip"; + map = "/var/lib/rspamd/blacklist_ip.map"; + description = "Lokale ip Blacklist -> reject"; + action = "reject"; +} + +BLACKLIST_FROM { + type = "from"; + map = "/var/lib/rspamd/blacklist_from.map"; + description = "Lokale from Blacklist -> reject"; + action = "reject"; +} diff --git a/rspamd/override.d/worker-fuzzy.conf b/rspamd/override.d/worker-fuzzy.conf new file mode 100644 index 00000000..113c7733 --- /dev/null +++ b/rspamd/override.d/worker-fuzzy.conf @@ -0,0 +1,16 @@ +# worker instances +count = 1; + +# listen on host +bind_socket = "127.0.0.1:11333"; + +# backend +backen = redis; +servers = "127.0.0.1:6379"; +timeout = 1s; +db = 0; +password = "3