Anti SPAM nçao está funcionando no VPS

Luiz,

Refiz a instalação do zero em um novo vps e o problema do spam continua.

Na instalação do ISPConfig eu coloquei para atualizar o antivirus. Demorou mas funcionou, e não desativei o Amavix, Clamav e SpamAssassin.

Também configurei o email para ter antispam,  mas mesmo assim o antispam não funciona.

Tem que fazer alguma configuração a mais?

Luiz,

Eu refiz a instalação novamente. Estou fazendo um teste com um vps de $20.

Eu coloquei o domínio e o email com o Filtro Spam: wants all spam e mesmo assim ele não está categorizando as mensagens.

Percebi que quando eu não faço a configuração no arquivo /etc/postfix/main.cf

#Próximo à Linha 57: Substitua a instrução “smtpd_recipient_restrictions” por esta abaixo (note que é uma linha única. e note também que no script novo de instalação há suporte a greylisting de emails e que o repositório padrão configurado para checagens é o zen.spamhaus.org. O SpamHaus é conhecido por cometer “enganos” com IPs legítimos, caso decida usar o serviço deles não precisa alterar a linha 57):

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unknown_recipient_domain, permit

E no arquivo /etc/postfix/header_checks

/^X-Spam-Level: \*{15,}.*/ DISCARD

Ele categorizou algumas mensagens como spam.

Qual seria a melhor configuração para esses arquivos?

Seguem os logs com o exemplo de uma mensagem que deveria ser categorizada como spam.

Log de e-mail

Aug 17 17:20:50 vps2 postfix/smtpd[6912]: connect from credibilidade-155-130-163-89.abraceestacausa.com.br[89.163.130.155]
Aug 17 17:20:51 vps2 postfix/smtpd[6912]: 53B9B60060: client=credibilidade-155-130-163-89.abraceestacausa.com.br[89.163.130.155]
Aug 17 17:20:51 vps2 postfix/cleanup[6927]: 53B9B60060: message-id=<[email protected]>
Aug 17 17:20:51 vps2 opendkim[2766]: 53B9B60060: s=default d=abraceestacausa.com.br SSL
Aug 17 17:20:52 vps2 postfix/qmgr[2709]: 53B9B60060: from=<[email protected]>, size=3450, nrcpt=1 (queue active)
Aug 17 17:20:52 vps2 postfix/smtpd[6912]: disconnect from credibilidade-155-130-163-89.abraceestacausa.com.br[89.163.130.155]
Aug 17 17:20:52 vps2 postfix/smtpd[6931]: connect from localhost[127.0.0.1]
Aug 17 17:20:52 vps2 postfix/smtpd[6931]: D632860B1F: client=localhost[127.0.0.1]
Aug 17 17:20:52 vps2 postfix/cleanup[6927]: D632860B1F: message-id=<[email protected]>
Aug 17 17:20:52 vps2 opendkim[2766]: D632860B1F: s=default d=abraceestacausa.com.br SSL
Aug 17 17:20:52 vps2 postfix/qmgr[2709]: D632860B1F: from=<[email protected]>, size=4440, nrcpt=1 (queue active)
Aug 17 17:20:52 vps2 postfix/smtpd[6931]: disconnect from localhost[127.0.0.1]
Aug 17 17:20:52 vps2 amavis[1795]: (01795-04) Passed CLEAN {RelayedInbound}, [89.163.130.155]:58045 [89.163.130.155] <[email protected]> -> <[email protected]>, Queue-ID: 53B9B60060, Message-ID: <[email protected]>, mail_id: AEuOrivE_NPO, Hits: 4.025, size: 3633, queued_as: D632860B1F, dkim_sd=default:abraceestacausa.com.br, 907 ms
Aug 17 17:20:52 vps2 postfix/smtp[6928]: 53B9B60060: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.7, delays=0.75/0.04/0.02/0.9, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as D632860B1F)
Aug 17 17:20:52 vps2 postfix/qmgr[2709]: 53B9B60060: removed
Aug 17 17:20:53 vps2 dovecot: lda([email protected]): sieve: msgid=<[email protected]>: stored mail into mailbox ‘INBOX’
Aug 17 17:20:53 vps2 postfix/pipe[6933]: D632860B1F: to=<[email protected]>, relay=dovecot, delay=0.13, delays=0.06/0.03/0/0.04, dsn=2.0.0, status=sent (delivered via dovecot service)
Aug 17 17:20:53 vps2 postfix/qmgr[2709]: D632860B1F: removed

Log de alertas
Aug 17 17:04:49 digitalocean dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Aug 17 17:04:49 digitalocean dovecot: log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Aug 17 17:08:55 digitalocean dovecot: master: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Aug 17 17:08:55 digitalocean dovecot: anvil: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Aug 17 17:08:55 digitalocean dovecot: log: Warning: Killed with signal 15 (by pid=1 uid=0 code=kill)
Aug 17 17:50:13 digitalocean postfix/smtpd[30079]: warning: hostname mail.tms-transportation.com does not resolve to address 12.11.103.130
Aug 17 17:50:15 digitalocean postfix/smtpd[30079]: warning: unknown[12.11.103.130]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug 17 18:13:47 digitalocean amavis[25577]: (25577-01) (!)connect to /var/run/clamav/clamd.ctl failed, attempt #1: Can’t connect to a UNIX socket /var/run/clamav/clamd.ctl: No such file or directory
Aug 17 18:13:48 digitalocean amavis[25577]: (25577-01) (!)connect to /var/run/clamav/clamd.ctl failed, attempt #1: Can’t connect to a UNIX socket /var/run/clamav/clamd.ctl: No such file or directory
Aug 17 18:13:48 digitalocean amavis[25577]: (25577-01) (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamav/clamd.ctl, retrying (2)
Aug 17 18:13:54 digitalocean amavis[25577]: (25577-01) (!)connect to /var/run/clamav/clamd.ctl failed, attempt #1: Can’t connect to a UNIX socket /var/run/clamav/clamd.ctl: No such file or directory
Aug 17 18:13:54 digitalocean amavis[25577]: (25577-01) (!)ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamav/clamd.ctl (All attempts (1) failed connecting to /var/run/clamav/clamd.ctl) at (eval 102) line 613.\n
Aug 17 18:13:54 digitalocean amavis[25577]: (25577-01) (!)WARN: all primary virus scanners failed, considering backups
Aug 17 15:30:01 vps2 postfix/smtpd[2465]: warning: connect to Milter service inet:localhost:12301: Connection refused
Aug 17 15:45:04 vps2 postfix/smtpd[3364]: warning: hostname mail.tms-transportation.com does not resolve to address 12.11.103.130
Aug 17 15:45:07 vps2 postfix/smtpd[3364]: warning: unknown[12.11.103.130]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Aug 17 16:39:45 vps2 postfix/smtpd[5329]: warning: hostname mail.tms-transportation.com does not resolve to address 12.11.103.130
Aug 17 16:39:48 vps2 postfix/smtpd[5329]: warning: unknown[12.11.103.130]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

Log de erros
Unable to read /var/log/mail.err

Log Clamav
Thu Aug 17 15:15:13 2017 -> +++ Started at Thu Aug 17 15:15:13 2017
Thu Aug 17 15:15:13 2017 -> Received 1 file descriptor(s) from systemd.
Thu Aug 17 15:15:13 2017 -> clamd daemon 0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Thu Aug 17 15:15:13 2017 -> Running as user clamav (UID 115, GID 123)
Thu Aug 17 15:15:13 2017 -> Log file size limited to 4294967295 bytes.
Thu Aug 17 15:15:13 2017 -> Reading databases from /var/lib/clamav
Thu Aug 17 15:15:13 2017 -> Not loading PUA signatures.
Thu Aug 17 15:15:13 2017 -> Bytecode: Security mode set to “TrustSigned”.
Thu Aug 17 15:15:48 2017 -> Loaded 6303044 signatures.
Thu Aug 17 15:15:52 2017 -> TCP: No tcp AF_INET/AF_INET6 SOCK_STREAM socket received from systemd.
Thu Aug 17 15:15:52 2017 -> LOCAL: Received AF_UNIX SOCK_STREAM socket from systemd.
Thu Aug 17 15:15:52 2017 -> Limits: Global size limit set to 104857600 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: File size limit set to 26214400 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: Recursion level limit set to 16.
Thu Aug 17 15:15:52 2017 -> Limits: Files limit set to 10000.
Thu Aug 17 15:15:52 2017 -> Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: MaxScriptNormalize limit set to 5242880 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Thu Aug 17 15:15:52 2017 -> Limits: MaxPartitions limit set to 50.
Thu Aug 17 15:15:52 2017 -> Limits: MaxIconsPE limit set to 100.
Thu Aug 17 15:15:52 2017 -> Limits: MaxRecHWP3 limit set to 16.
Thu Aug 17 15:15:52 2017 -> Limits: PCREMatchLimit limit set to 10000.
Thu Aug 17 15:15:52 2017 -> Limits: PCRERecMatchLimit limit set to 5000.
Thu Aug 17 15:15:52 2017 -> Limits: PCREMaxFileSize limit set to 26214400.
Thu Aug 17 15:15:52 2017 -> Archive support enabled.
Thu Aug 17 15:15:52 2017 -> Algorithmic detection enabled.
Thu Aug 17 15:15:52 2017 -> Portable Executable support enabled.
Thu Aug 17 15:15:52 2017 -> ELF support enabled.
Thu Aug 17 15:15:52 2017 -> Mail files support enabled.
Thu Aug 17 15:15:52 2017 -> OLE2 support enabled.
Thu Aug 17 15:15:52 2017 -> PDF support enabled.
Thu Aug 17 15:15:52 2017 -> SWF support enabled.
Thu Aug 17 15:15:52 2017 -> HTML support enabled.
Thu Aug 17 15:15:52 2017 -> XMLDOCS support enabled.
Thu Aug 17 15:15:52 2017 -> HWP3 support enabled.
Thu Aug 17 15:15:52 2017 -> Self checking every 3600 seconds.
Thu Aug 17 17:11:00 2017 -> SelfCheck: Database status OK

Vou fazer uma nova instalação do zero e testar essas configurações.Depois mando um feedback.

Obrigado

Segue o meu /etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA’s job.
append_dot_mydomain = no

# Uncomment the next line to generate “delayed mail” warnings
#delay_warning_time = 4h

readme_directory = /usr/share/doc/postfix

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = vps2.dalaz.com.br
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
myorigin = /etc/mailname
mydestination = vps2.dalaz.com.br, localhost, localhost.localdomain
relayhost =
mynetworks = 127.0.0.0/8 [::1]/128
mailbox_command = procmail -a “$EXTENSION”
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
virtual_alias_domains =
virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /var/vmail
virtual_uid_maps = mysql:/etc/postfix/mysql-virtual_uids.cf
virtual_gid_maps = mysql:/etc/postfix/mysql-virtual_gids.cf
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
inet_protocols = all
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_restriction_classes = greylisting
greylisting = check_policy_service inet:127.0.0.1:10023
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unknown_recipient_domain, permit
smtpd_tls_security_level = may
transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, reject_invalid_hostname, reject_non_fqdn_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_delay_reject = yes
smtpd_sender_restrictions =
check_sender_access regexp:/etc/postfix/tag_as_originating.re,
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf,
check_sender_access regexp:/etc/postfix/tag_as_foreign.re,
permit
smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unknown_client_hostname,
check_client_access mysql:/etc/postfix/mysql-virtual_client.cf,
permit
smtpd_client_message_rate_limit = 100
maildrop_destination_concurrency_limit = 1
maildrop_destination_recipient_limit = 1
virtual_transport = dovecot
header_checks = regexp:/etc/postfix/header_checks
mime_header_checks = regexp:/etc/postfix/mime_header_checks
nested_header_checks = regexp:/etc/postfix/nested_header_checks
body_checks = regexp:/etc/postfix/body_checks
owner_request_special = no
smtp_tls_security_level = may
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_protocols = !SSLv2,!SSLv3
smtp_tls_protocols = !SSLv2,!SSLv3
smtpd_tls_exclude_ciphers = RC4, aNULL
smtp_tls_exclude_ciphers = RC4, aNULL
dovecot_destination_recipient_limit = 1
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
content_filter = amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
message_size_limit = 104857600
authorized_submit_users = !www, root, static:all