<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
"http://www.w3.org/TR/REC-html40/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title></title>
</head>
<body style="font-family:Arial;font-size:14px">
<blockquote style="border-left:2px solid blue;margin-left:2px;padding-left:12px;" type="cite">
<blockquote style="border-left:2px solid blue;margin-left:2px;padding-left:12px;" type="cite">
<blockquote style="border-left:2px solid blue;margin-left:2px;padding-left:12px;" type="cite">
<blockquote style="border-left:2px solid blue;margin-left:2px;padding-left:12px;" type="cite">
<p>Hi all,<br>
<br>
I have pflogsumm running log summaries on my postfix install, and sending<br>
to an address that resolves locally. All is on localhost, which is a newly<br>
installed CentOS7 server, amavisd-new 2.10.1 from EPEL.<br>
<br>
The pflogsumm emails from root are triggering BAYES_99 as they go through<br>
amavisd-new and spamassassin, and are often ending up marked as spam.<br>
<br>
What's the best way to ensure that those are not flagged as spam, or<br>
potentially to whitelist them somehow?</p>
</blockquote>
You can whitelist sender addresses, would this solve your problem? I have<br>
these lines in /etc/amavis/conf.d/50-user:<br>
<br>
read_hash(\%whitelist_sender, '/etc/amavis/whitelist');<br>
@whitelist_sender_maps = (\%whitelist_sender);<br>
bypass_spam_checks_maps => ['@whitelist_sender_maps'], # don't<br>
spam-check this mail<br>
bypass_banned_checks_maps => ['@whitelist_sender_maps'], # don't<br>
banned-check this mail<br>
bypass_header_checks_maps => ['@whitelist_sender_maps'], # don't<br>
header-check this mail<br>
<br>
File /etc/amavis/whitelist contains a line-by-line list of whitelisted<br>
addresses. To whitelist a whole domain, just precede with a dot. Examples:<br>
<br>
<a href="mailto:fred@bloggs.com">fred@bloggs.com</a><br>
.spammers-united.com<br>
<br>
HTH, Dominic</blockquote>
----- End message from Dominic Raferd <<a href="mailto:dominic@timedicer.co.uk">dominic@timedicer.co.uk</a>> -----<br>
<br>
Thanks Dominic... it seems like a bit of a 'sledgehammer' to whitelist a sender address, when sender addresses can be spoofed. Perhaps I'm being paranoid :) Keen to hear feedback on that (the approach, not whether I am paranoid :) ).<br>
<br>
One thing I just noticed is that pflogsumm emails are dropped into Postfix (and thence into Amavisd) via postfix/pickup not postfix/smtpd. I wonder if there is a way there to mark emails from localhost root that are fed into postfix/pickup as being not spam-checked.<br>
<br>
Simon.<br>
<br>
</blockquote>
----- End message from Simon Wilson <<a href="mailto:simon@simonandkate.net">simon@simonandkate.net</a>> -----<br>
</blockquote>
<p>OK, I've added an additional listening port for amavisd (10028), assigned a policy bank that bypasses spam checks, and have added the content_filter override to postfix's pickup service - and all works as planned. The pflogsumm emails no longer get spam checked. <br>
<br>
So my question is whether in so doing I have opened up any vulnerabilities that I have not thought of... I suppose I could alter the spam check to look for emails only sent to me... but that seems a little like doing something that I will later end up wondering why something else's not working. <br>
<br>
Anyone any thoughts?<br>
<br>
Simon<br>
<br>
<br>
<br>
amavisd.conf:<br>
<br></p>
<div>$inet_socket_port = [10024,10026,10028]; # listen on multiple TCP ports</div>
<div> </div>
<div>$interface_policy{'10028'} = 'VIRUSONLY';</div>
<div> </div>
<div>$policy_bank{'VIRUSONLY'} = { # mail from the pickup daemon</div>
<div> originating => 1,</div>
<div> bypass_spam_checks_maps => [1], # don't spam-check this mail</div>
<div> bypass_banned_checks_maps => [1], # don't banned-check this mail</div>
<div> bypass_header_checks_maps => [1], # don't header-check this mail</div>
<div>};<br>
<br>
</div>
<div>___________<br>
Simon Wilson<br>
M: 0400 12 11 16</div>
</body>
</html>