Базовая защита от спама на backup MX'е

# yum -y install postgrey
# /etc/init.d/postgrey start
# chkconfig postgrey on

smtpd_recipient_restrictions = 
    permit_mynetworks,
    reject_unauth_destination,
    reject_non_fqdn_helo_hostname,
    reject_non_fqdn_sender,
    reject_non_fqdn_recipient,
    reject_unknown_sender_domain,
    reject_rbl_client safe.dnsbl.sorbs.net,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client xbl.spamhaus.org,
    check_policy_service unix:postgrey/socket,
    permit

Dec  6 15:07:51 baltic postfix/smtpd[6216]: NOQUEUE: reject: RCPT from aaa[111.111.111.111]: 450 4.2.0 <[email protected]>: Recipient address rejected: Greylisted, see http://postgrey.schweikert.ch/help/xxx.lt.html; from=<[email protected]> to=<[email protected]> proto=SMTP

# yum -y install spamassassin
# /etc/init.d/spamassassin start
# chkconfig spamassassin  on
# adduser -N spamchk

# cat /etc/sysconfig/spamassassin
# Options to spamd
SPAMDOPTIONS="-d -c -m5 -H --username spamchk --socketpath /var/run/spamassassin/spamd.sock"

# -----------------------------------------------------------------
# File:        spamchk
#
# Purpose:     SPAMASSASIN shell-based filter
#
# Location:    /usr/local/bin
#
# Usage:       Call this script from master.cf (Postfix)
#
# Certified:   GENTOO Linux, Spamassassin 3.0, Postfix
# -----------------------------------------------------------------

# cat /etc/postfix/contentfilter/spamchk 
#!/bin/sh
SENDMAIL="/usr/sbin/sendmail -i"
EGREP=/bin/egrep
EX_UNAVAILABLE=69
trap "/bin/rm -f /tmp/spamchk_out.$$" 0 1 2 3 15
/bin/cat | /usr/bin/spamc -u spamchk --socket=/var/run/spamassassin/spamd.sock | /bin/sed 's/^\.$/../' > /tmp/spamchk_out.$$
$SENDMAIL "$@" < /tmp/spamchk_out.$$
exit $?

smtp      inet  n       -       n       -       -       smtpd
 -o content_filter=spamchk:dummy

spamchk   unix  -       n       n       -       20      pipe
  flags=Rq user=spamchk argv=/etc/postfix/contentfilter/spamchk -f ${sender} -- ${recipient}

Dec  6 15:16:05 baltic postfix/smtpd[6637]: NOQUEUE: reject: RCPT from unknown[94.156.195.78]: 554 5.7.1 Service unavailable; Client host [94.156.195.78] blocked using safe.dnsbl.sorbs.net; Currently Sending Spam See: [url]http://www.sorbs.net/lookup.shtml?94.156.195.78[/url] / Exploitable Server See: [url]http://www.sorbs.net/lookup.shtml?94.156.195.78;[/url] from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[94.156.195.78]>

lrwxrwxrwx 1 root root 21 Nov 21 12:30 /usr/sbin/sendmail -> /etc/alternatives/mta
lrwxrwxrwx 1 root root 27 Nov 21 12:30 /etc/alternatives/mta -> /usr/sbin/sendmail.sendmail

# rm /usr/sbin/sendmail
# ln -s /usr/sbin/sendmail.postfix /usr/sbin/sendmail

Dec  6 15:20:37 baltic postfix/smtpd[11026]: connect from aaa[111.111.111.111]
Dec  6 15:20:42 baltic postgrey[6003]: action=pass, reason=triplet found, client_name=aaa, client_address=111.111.111.111, [email protected], [email protected]
Dec  6 15:20:42 baltic postfix/smtpd[11026]: BFCA11AE2ECE: client=aaa[111.111.111.111]
Dec  6 15:20:47 baltic postfix/cleanup[11020]: BFCA11AE2ECE: message-id=<>
Dec  6 15:20:47 baltic postfix/qmgr[11012]: BFCA11AE2ECE: from=<[email protected]>, size=196, nrcpt=1 (queue active)
Dec  6 15:20:47 baltic spamd[9508]: spamd: got connection over /var/run/spamassassin/spamd.sock
Dec  6 15:20:47 baltic spamd[9508]: spamd: processing message (unknown) for spamchk:500
Dec  6 15:20:48 baltic postfix/smtpd[11026]: disconnect from aaa[111.111.111.111]
Dec  6 15:20:51 baltic spamd[9508]: spamd: identified spam (6.2/5.0) for spamchk:500 in 4.6 seconds, 216 bytes.
Dec  6 15:20:51 baltic spamd[9508]: spamd: result: Y 6 - MISSING_DATE,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,RCVD_IN_BRBL_LASTEXT scantime=4.6,size=216,user=spamchk,uid=500,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=/var/run/spamassassin/spamd.sock,mid=(unknown),autolearn=no
Dec  6 15:20:51 baltic postfix/pickup[11011]: B90691AE2ED2: uid=500 from=<[email protected]>
Dec  6 15:20:51 baltic postfix/pipe[11013]: BFCA11AE2ECE: to=<[email protected]>, relay=spamchk, delay=10, delays=5.6/0/0/4.6, dsn=2.0.0, status=sent (delivered via spamchk service)
Dec  6 15:20:51 baltic postfix/qmgr[11012]: BFCA11AE2ECE: removed
Dec  6 15:20:51 baltic postfix/cleanup[11020]: B90691AE2ED2: message-id=<[email protected]>
Dec  6 15:20:51 baltic postfix/qmgr[11012]: B90691AE2ED2: from=<[email protected]>, size=1124, nrcpt=1 (queue active)
Dec  6 15:20:51 baltic spamd[9506]: prefork: child states: II
Dec  6 15:20:52 baltic postfix/smtp[11040]: B90691AE2ED2: to=<[email protected]>, relay=baltic.lt[333.333.333.333]:25, delay=1, delays=0.02/0.01/0.01/1, dsn=2.6.0, status=sent (250 2.6.0 <[email protected]> [InternalId=748885] Queued mail for delivery)
Dec  6 15:20:52 baltic postfix/qmgr[11012]: B90691AE2ED2: removed

# cat /etc/mail/spamassassin/local.cf 
required_hits 5
report_safe 0
#rewrite_header Subject [SPAM]

smtp      inet  n       -       n       -       -       smtpd
 -o content_filter=spamchk:dummy

#submission inet n       -       n       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING