PostfixのRspamd対応（ウィスル対策・SAPM対策・DKIM、DMARC、ARC対応）

pkg install -y rspamd clamav redis

*** /usr/local/etc/clamd.conf.sample	Thu Sep 12 10:04:30 2024
--- /usr/local/etc/clamd.conf	Wed Sep 18 02:31:45 2024
***************
*** 78,84 ****
  
  # Optional path to the global temporary directory.
  # Default: system specific (usually /tmp or /var/tmp).
! #TemporaryDirectory /var/tmp
  
  # Path to the database directory.
  # Default: hardcoded (depends on installation options)
--- 78,84 ----
  
  # Optional path to the global temporary directory.
  # Default: system specific (usually /tmp or /var/tmp).
! TemporaryDirectory /tmp
  
  # Path to the database directory.
  # Default: hardcoded (depends on installation options)

freshclam

service clamav_clamd enable
service clamav_clamd start
service clamav_freshclam enable
service clamav_freshclam start

service redis enable
service redis start

mkdir /usr/local/etc/rspamd/local.d

clamav {
    action = "reject";
    message = '${SCANNER}: virus fond: "${VIRUS}"';
    symbol = "CLAM_VIRUS";
    type = "clamav";
    servers = "/var/run/clamav/clamd.sock";
    whitelist = "/usr/local/etc/rspamd/antivirus.wl";
}

enabled = true;

use = ["authentication-results", "x-spamd-bar"];
extended_spam_headers = yes;

routines {
    authentication-results {
        header = "Authentication-Results";
        remove = 1;
        add_smtp_user = true;
        spf_symbols {
            pass = "R_SPF_ALLOW";
            fail = "R_SPF_FAIL";
            softfail = "R_SPF_SOFTFAIL";
            neutral = "R_SPF_NEUTRAL";
            temperror = "R_SPF_DNSFAIL";
            none = "R_SPF_NA";
            permerror = "R_SPF_PERMFAIL";
        }
        dkim_symbols {
            pass = "R_DKIM_ALLOW";
            fail = "R_DKIM_REJECT";
            temperror = "R_DKIM_TEMPFAIL";
            none = "R_DKIM_NA";
            permerror = "R_DKIM_PERMFAIL";
        }
        dmarc_symbols {
            pass = "DMARC_POLICY_ALLOW";
            permerror = "DMARC_BAD_POLICY";
            temperror = "DMARC_DNSFAIL";
            none = "DMARC_NA";
            reject = "DMARC_POLICY_REJECT";
            softfail = "DMARC_POLICY_SOFTFAIL";
            quarantine = "DMARC_POLICY_QUARANTINE";
        }
    }
    x-spamd-bar {
        header = "X-Spamd-Bar";
        positive = "+";
        negative = "-";
        neutral = "/";
        remove = 0;
    }
}

reporting {
    enabled = true;
}

actions = {
    quarantine = "add_header";
    reject = "reject";
}

send_reports = true;

report_settings {
    org_name = "EXAMPLE.COM";
    domain = "example.com";
    email = "postmaster@example.com";
}

write_servers = "localhost";
read_servers = "localhost";

ip_whitelist {
    type = "ip";
    prefilter = "true";
    map = "${DBDIR}/ip_whitelist.map";
    symbol = "IP_WHITELIST";
    action = "accept";
}
whitelist_sender_doamin {
    type = "from";
    filter = "email:domain";
    map = "${DBDIR}/sender_domain_whitelist.map";
    symbol = "WHITELIST_SENDER_DOMAIN";
    action = "accept";
}
sender_from_whitelist_user {
    type = "from";
    filter = "email:user";
    map = "${DBDIR}/sender_from_whitelist_user.map";
    symbol = "SENDER_FROM_WHITELIST_USER";
    action = "accept";
}

cd /var/db/rsoamd
chown rspamd:rspamd *

rspamadm configwizard

  ____                                     _
 |  _ \  ___  _ __    __ _  _ __ ___    __| |
 | |_) |/ __|| '_ \  / _` || '_ ` _ \  / _` |
 |  _ < \__ \| |_) || (_| || | | | | || (_| |
 |_| \_\|___/| .__/  \__,_||_| |_| |_| \__,_|
             |_|

Welcome to the configuration tool
We use /usr/local/etc/rspamd/rspamd.conf configuration file, writing results to /usr/local/etc/rspamd
Modules enabled: metadata_exporter, mid, settings, milter_headers, spf, dkim_signing, antivirus, rbl, neural, whitelist, phishing, chartable, force_actions, greylist, regexp, replies, multimap, mx_check, fuzzy_check, arc, trie, once_received, dkim, emails, dmarc, history_redis, asn, bayes_expiry, mime_types, hfilter, ratelimit, forged_recipients, maillist
Modules disabled (explicitly): aws_s3, dcc, external_relay, p0f, rspamd_update, bimi, http_headers, known_senders, gpt, spamtrap
Modules disabled (unconfigured): ip_score, dynamic_conf, reputation, maps_stats, clickhouse, spamassassin, fuzzy_collect, external_services, metric_exporter, elastic, url_redirector, clustering
Modules disabled (no Redis):
Modules disabled (experimental):
Modules disabled (failed):
Do you wish to continue?[Y/n]:

Setup WebUI and controller worker:
Controller password is not set, do you want to set one?[Y/n]:

Enter passphrase:

Set encrypted password to: $2$ygdum7x8rsohx7kccyeoaswoh4uxk6t4$xtei4ghhg95ktetpidimaraj1ibe9p66gwirqz14h71wyn96ef9b

Do you want to setup dkim signing feature?[y/N]:

How would you like to set up DKIM signing?
1. Use domain from mime from header for sign
2. Use domain from SMTP envelope from for sign
3. Use domain from authenticated user for sign
4. Sign all mail from specific networks

Enter your choice (1, 2, 3, 4) [default: 1]:

Do you want to sign mail from authenticated users? [Y/n]:

Allow data mismatch, e.g. if mime from domain is not equal to authenticated user domain? [Y/n]:

Do you want to use effective domain (e.g. example.com instead of foo.example.com)? [Y/n]:

Enter output directory for the keys [default: /var/db/rspamd/dkim/]:

Enter domain to sign:

Enter selector [default: dkim]:

Do you want to create privkey /var/db/rspamd/dkim/example.com.dkim.key[Y/n]:

You need to chown private key file to rspamd user!!
To make dkim signing working, to place the following record in your DNS zone:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuo9TwwGFJSrM2vxvs4mhp1zYtVxyGoMCF+7v8nn/Ov9aESeLiMRzWX/SvhbXtOjqi36rp5ytoFmrZgjLrJJqW/SkEbOlFgYnso9ERHNQ5qIwOk/I7WL6/SRi8SNSul0F2YmvtXYavbuBZxH/v4jSL2nM2UNqRHc1FKFWOTVOfca1PP6yXmnIdm5m8c3hotGWMtpnrY1FY+ZCYkeOsPmMokKRlsXN8kqgGB2jmptuoXy3f4yw49pwoj0/lG5Xipwzyoy7VRz8eO7JyGIc5LQTiKNA47emrcQmWprtHTgvU/j4gVoRnRYSH2yZMWP8XNUwdMMpL+naPhIYKw20t1L1fwIDAQAB

Do you wish to add another DKIM domain?[y/N]:

File: /usr/local/etc/rspamd/local.d/dkim_signing.conf, changes list:
use_domain => header
allow_hdrfrom_mismatch => true
domain => {[example.com] = {[selector] = dkim, [path] = /var/db/rspamd/dkim/example.com.dkim.key}}
allow_username_mismatch => true
sign_authenticated => true
use_esld => true
allow_hdrfrom_mismatch_sign_networks => true

Apply changes?[Y/n]:

Create file /usr/local/etc/rspamd/local.d/dkim_signing.conf
1 changes applied, the wizard is finished now
*** Please reload the Rspamd configuration ***

cd /usr/lcoal/etc/rspamd/local.d
cp dkim_signing.conf arc.conf

use_domain = "header";
allow_hdrfrom_mismatch = true;
allow_hdrfrom_mismatch_sign_networks = true;
allow_username_mismatch = true;
domain {
    exmple.com {
        path = "/var/db/rspamd/dkim/example.com.dkim.key";
        selector = "dkim";
    }
    example.net {
        path = "/var/db/rspamd/dkim/example.net.dkim.key";
        selector = "dkim";
    }
}
use_esld = true;

domain {
    exmple.com {
        path = "/var/db/rspamd/dkim/example.com.dkim.key";
        selector = "dkim";
    }
    example.net {
        path = "/var/db/rspamd/dkim/example.net.dkim.key";
        selector = "dkim";
    }
}

cd /var/db/rsapmd/dkim
chown rspamd:rspamd *

service rspamd enable
service rspamd start

*** main.cf.orig	Wed Nov  6 07:09:04 2024
--- main.cf	Wed Nov  6 07:09:10 2024
***************
*** 752,754 ****
--- 752,759 ----
  # Thunderbird Workaround
  # (This allows Thunderbird to recognize STARTTLS when create account)
  smtpd_forbid_unauth_pipelining = no
+ 
+ # mail filter
+ smtpd_milters = inet:localhost:11332
+ non_smtpd_milters = $smtpd_milters
+ milter_default_action = accept

service postfix reload