가. 설치(Linux)

SpamAssassin - http://spamassassin.apache.org/

1. Download

[root@ihelpers src]# wget http://ftp.apache-kr.org/spamassassin/source/Mail-SpamAssassin-3.1.1.tar.gz

2. Pre-requisite

[root@ihelpers src]# tar xvfz Mail-SpamAssassin-3.1.1.tar.gz
[root@ihelpers src]# cd Mail-SpamAssassin-3.1.1
[root@ihelpers Mail-SpamAssassin-3.1.1]# perl Makefile.PL

~~~

REQUIRED module missing: Digest::SHA1
REQUIRED module missing: HTML::Parser
optional module missing: DB_File
optional module missing: Net::DNS
optional module missing: Mail::SPF::Query
optional module missing: IP::Country
optional module missing: Razor2
optional module missing: Net::Ident
optional module missing: IO::Socket::INET6
optional module missing: IO::Socket::SSL
optional module missing: Time::HiRes
optional module missing: DBI
optional module missing: LWP::UserAgent
optional module missing: HTTP::Date
optional module missing: Archive::Tar
optional module missing: IO::Zlib

[root@ihelpers src]# perl -MCPAN -e shell
cpan> o conf prerequisites_policy follow
prerequisites_policy follow

cpan> install Digest::SHA1 HTML::Parser DB_File Net::DNS Mail::SPF::Query IP::Country cpan> install Mail::Audit::Razor Net::Ident IO::Socket::INET6 IO::Socket::SSL Time::HiRes DBI LWP::UserAgent HTTP::Date Archive::Tar IO::Zlib

cpan> quit

위와 같은 방법으로 필요한 모듈들을 설치하고 문제가 되는 것은 아래와 같은 방법으로 개별적으로 설치하시면 됩니다.

Perl Module Search - http://search.cpan.org/

[root@ihelpers src]# wget http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/Digest-SHA1-2.11.tar.gz
[root@ihelpers src]# tar xvfz Digest-SHA1-2.11.tar.gz
[root@ihelpers Digest-SHA1-2.11]# perl Makefile.PL
[root@ihelpers Digest-SHA1-2.11]# make
[root@ihelpers Digest-SHA1-2.11]# make install

[root@ihelpers src]# wget http://search.cpan.org/CPAN/authors/id/G/GA/GAAS/HTML-Parser-3.51.tar.gz
[root@ihelpers src]# cd HTML-Parser-3.51
[root@ihelpers src]# tar xvfz HTML-Parser-3.51.tar.gz

[root@ihelpers HTML-Parser-3.51]# perl Makefile.PL
Warning: prerequisite HTML::Tagset 3 not found.
Writing Makefile for HTML::Parser

[root@ihelpers src]# wget http://search.cpan.org/CPAN/authors/id/P/PE/PETDANCE/HTML-Tagset-3.10.tar.gz
[root@ihelpers src]# tar xvfz HTML-Tagset-3.10.tar.gz
[root@ihelpers src]# cd HTML-Tagset-3.10
[root@ihelpers HTML-Tagset-3.10]# make
[root@ihelpers HTML-Tagset-3.10]# make install

[root@ihelpers HTML-Parser-3.51]# perl Makefile.PL
Writing Makefile for HTML::Parser
[root@ihelpers HTML-Parser-3.51]# make
[root@ihelpers HTML-Parser-3.51]# make install

3. Install

[root@ihelpers src]# tar xvfz Mail-SpamAssassin-3.1.1.tar.gz
[root@ihelpers src]# cd Mail-SpamAssassin-3.1.1
[root@ihelpers Mail-SpamAssassin-3.1.1]# perl Makefile.PL
What email address or URL should be used in the suspected-spam report
text for users who want more information on your filter installation?
(In particular, ISPs should change this to a local Postmaster contact)
default text: [the administrator of that system]

NOTE: settings for "make test" are now controlled using "t/config.dist".
See that file if you wish to customise what tests are run, and how.

checking module dependencies and their versions...

***************************************************************************
NOTE: the optional Razor2 (version 2.61) module is not installed.

Used to check message signatures against Vipul's Razor collaborative
filtering network. Razor has a large number of dependencies on CPAN
modules. Feel free to skip installing it, if this makes you nervous;
SpamAssassin will still work well without it.

More info on installing and using Razor can be found
at http://wiki.apache.org/spamassassin/InstallingRazor .

Net::Ident::_export_hooks() called too early to check prototype at /usr/lib/perl5/site_perl/5.8.0/Net/Ident.pm line 29.
optional module missing: Razor2

warning: some functionality may not be available,
please read the above report before continuing!

Writing Makefile for Mail::SpamAssassin
Makefile written by ExtUtils::MakeMaker 6.03

[root@ihelpers Mail-SpamAssassin-3.1.1]# make
[root@ihelpers Mail-SpamAssassin-3.1.1]# make test
[root@ihelpers Mail-SpamAssassin-3.1.1]# make install

4. Test

[root@ihelpers Mail-SpamAssassin-3.1.1]# spamassassin -t < sample-nonspam.txt
[root@ihelpers Mail-SpamAssassin-3.1.1]# spamassassin -t < sample-spam.txt

나. SpamAssassin Daemon ( 'spamd' Daemon ) 실행 - sendmail

1. 사용자 추가

groupadd spamd
useradd -g spamd spamd

2. 스크립트 및 서비스 등록

vi /etc/sysconfig/spamassassin
# Hint : if you want to enable SpamAssassin debugging
# (the debug output goes to /var/log/maillog) then use :
# SPAMDOPTIONS="-x -u spamd -H /home/spamd -d -D"
# Don't leave debugging turned on unnecessarily though,
# because it will slow down a busy server.
#
# Otherwise, for normal operation (debugging disabled) use :
SPAMDOPTIONS="-x -u spamd -H /home/spamd -d"

[root@ihelpers init.d]# cp redhat-rc-script.sh /etc/rc.d/init.d/spamd
[root@ihelpers init.d]# chkconfig --add spamd
[root@ihelpers init.d]# vi /etc/mail/spamassassin/local.cf
[root@ihelpers init.d]# /etc/rc.d/init.d/spamd start

procmail은 수신메일을 spamc에 전달하고 spamc는 데몬에 연결하여 이메일을 확인하도록 한다. spamd 데몬은 항상 실행상태에 있으며 전달받은 메일을 스캔해 스팸인 경우 별도의 스팸표시를 한다.

3. procmailrc 설정

[root@ihelpers root]# cat /etc/procmailrc

# # SpamAssassin procmail # OPPRIVS=yes :0fw * < 256000 | /usr/bin/spamc

다. 환경설정

1. spamassassin 설정파일 추가 및 수정

[root@ihelpers root]# cat /etc/mail/spamassassin/local.cf

# This is the right place to customize your installation of SpamAssassin. # # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be # tweaked. # # Only a small subset of options are listed below # ########################################################################### # Add *****SPAM***** to the Subject header of spam e-mails # rewrite_header Subject *****SPAM***** # Save spam messages as a message/rfc822 MIME attachment instead of # modifying the original message (0: off, 2: use text/plain instead) # report_safe 0 # Language # ok_locales en ko ok_languages en ko # Set which networks or hosts are considered 'trusted' by your mail # server (i.e. not spammers) # # trusted_networks 212.17.35. # Set file-locking method (flock is not safe over NFS, but is faster) # lock_method flock # Set the threshold at which a message is considered spam (default: 5.0) # required_score 8.0 # Use Bayesian classifier (default: 1) # use_bayes 1 # Bayesian classifier auto-learning (default: 1) # bayes_auto_learn 1 # Set headers which may provide inappropriate cues to the Bayesian # classifier # bayes_ignore_header X-Bogosity bayes_ignore_header X-Spam-Flag bayes_ignore_header X-Spam-Status # Rules for all senders score HEADER_8BITS 0 score HTML_COMMENT_8BITS 0 score SUBJ_FULL_OF_8BITS 0

2. 데몬 재 실행

[root@ihelpers root]# /etc/rc.d/init.d/spamd restart
Shutting down spamd: [ 확인 ]
Starting spamd: [ 확인 ]

3. SpamAssassin Configuration Tool

http://www.yrex.com/spam/spamconfig.php

라. 스팸 필터링 결과 확인

1. Outlook 에서 메일 확인

2. 스팸 메일 내용

return-Path: <nicegir331s@hanmail.net> X-Spam-Flag: YES X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on ihelpers X-Spam-Level: **************************************** X-Spam-Status: Yes, score=40.4 required=6.0 tests=DNS_FROM_RFC_POST, FORGED_IMS_HTML,FORGED_IMS_TAGS,FORGED_MSGID_YAHOO,FORGED_MUA_IMS, HEAD_ILLEGAL_CHARS,HTML_FONT_BIG,HTML_MESSAGE,HTML_MIME_NO_HTML_TAG, MIME_BOUND_DD_DIGITS,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI, MISSING_MIMEOLE,MPART_ALT_DIFF,MSGID_SPAM_CAPS,MSGID_YAHOO_CAPS, RCVD_IN_DSBL,RCVD_IN_SBL,RCVD_IN_WHOIS_INVALID,RCVD_IN_XBL, RCVD_NUMERIC_HELO,REPTO_QUOTE_IMS,REPTO_QUOTE_YAHOO,SPF_SOFTFAIL, SUBJ_ILLEGAL_CHARS,UNPARSEABLE_RELAY autolearn=unavailable version=3.1.1 X-Spam-Report: * 1.3 MSGID_YAHOO_CAPS Message-ID has ALLCAPS@yahoo.com * 3.6 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary * 3.5 MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant) * 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) * [SPF failed: Please see http://www.openspf.org/why.html?sender=nicegir331s%40hanmail.net&ip=61.149.130.107&receiver=ihelpers] * 3.4 SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters * 1.3 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO * 1.5 HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay * lines * 0.0 HTML_MESSAGE BODY: HTML included in message * 0.3 HTML_FONT_BIG BODY: HTML tag for a big font size * 0.1 MPART_ALT_DIFF BODY: HTML and text parts are different * 0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts * 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL * [61.149.130.107 listed in sbl-xbl.spamhaus.org] * 1.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org * [<http://dsbl.org/listing?61.149.130.107>] * 2.2 RCVD_IN_WHOIS_INVALID RBL: CompleteWhois: sender on invalid IP * block * [61.149.130.107 listed in combined-HIB.dnsiplists.completewhois.com] * 2.7 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL * [61.149.130.107 listed in sbl-xbl.spamhaus.org] * 1.4 DNS_FROM_RFC_POST RBL: Envelope sender in * postmaster.rfc-ignorant.org * 0.5 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag * 0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME * parts * 1.4 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE * 1.2 FORGED_MUA_IMS Forged mail pretending to be from IMS * 0.0 REPTO_QUOTE_IMS IMS doesn't do quoting like this * 2.2 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this * 2.3 FORGED_IMS_HTML IMS can't send HTML message only * 3.2 FORGED_MSGID_YAHOO Message-ID is forged, (yahoo.com) * 2.1 FORGED_IMS_TAGS IMS mailers can't send HTML in this format Received: from 61.149.130.107 ([61.149.130.107]) by mail.ihelpers.co.kr (8.12.8/8.12.8) with SMTP id k3I6vd13010844; Tue, 18 Apr 2006 15:57:41 +0900 Received: from 16.206.104.64 by ; Tue, 18 Apr 2006 03:44:36 -0300 Message-ID: <YQHTHNXMPQMJBQZSBQRNCEBIP@yahoo.com> From: "고은미" <nicegir331s@hanmail.net> Reply-To: "지소연" <nicegir331s@hanmail.net> To: jinjiny@ihelpers.co.kr Subject: *****SPAM***** 금융~업체 많습니다 금리싸고 안전한곳을 선택하세요 Date: Tue, 18 Apr 2006 10:46:36 +0400 X-Mailer: Internet Mail Service (5.5.2650.21) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--969256130084464" X-Priority: 3 X-MSMail-Priority: Normal X-Spam-Prev-Subject: 금융~업체 많습니다 금리싸고 안전한곳을 선택하세요 Status: ----969256130084464 Content-Type: text/html; Content-Transfer-Encoding: quoted-printable