モダンな qmail 構築

Generating rsa DKIM private key keysize=2048, file /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816
Generating rsa DKIM public  key for rsa-20250816.domainkey.ep.sci.hokudai.ac.jp, file /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816.pub, keysize=2048
DKIM Private key for ep.sci.hokudai.ac.jp file /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816
-----BEGIN PRIVATE KEY-----
MIIlqckJADANBQMpkwG9w0BAQEFAASCBKgwggSkAzlWAoIBAQDovbkfEvinoKTG
...
/Mcxq84eN/DjLSWOlpnoEts
-----END PRIVATE KEY-----
-rw-r----- 1 root qmail 1704  8月 16 13:21 /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816
------------------------------------------------------
DKIM TXT record for ep.sci.hokudai.ac.jp with selector=rsa-20250816 file /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816.pub
rsa-20250816._domainkey.ep.sci.hokudai.ac.jp. IN TXT ("v=DKIM1; k=rsa; t=y; p=MII ... xEp" "0YF ... QAB")
-rw-r--r-- 1 root qmail 476  8月 16 13:21 /var/qmail/control/domainkeys/ep.sci.hokudai.ac.jp/rsa-20250816.pub
------------------------------------------------------

#!/bin/sh

# Using splogger to send the log through syslog.
# Using qmail-local to deliver messages to ~/Mailbox by default.

QMAILDIR=/var/qmail

# Comment out DKIM_ON=1 to disable dkim sign at qmail-remote level
# You have to define your variables in control/filterargs (DKIM page for more info)
# echo "*:remote:/var/qmail/bin/qmail-dkim:DKIMQUEUE=/bin/cat,\
# DKIMSIGN=/var/qmail/control/domainkeys/%/default,DKIMSIGNOPTIONS=-z 2" > /var/qmail/control/filterargs
DKIM_ON=1

if [ -r $QMAILDIR/control/filterargs ] && [ -n "$DKIM_ON" ]; then
# DKIM sign at qmail-remote level
  exec env - PATH="$QMAILDIR/bin:$PATH" \
  QMAILREMOTE=$QMAILDIR/bin/spawn-filter \
  qmail-start ./Mailbox splogger qmail
else
# Use this if you are signing at qmail-smtpd level or you don't want to sign at all
  exec env - PATH="$QMAILDIR/bin:$PATH" \
  qmail-start ./Mailbox splogger qmail
fi

*:remote:/var/qmail/bin/qmail-dkim:ERROR_FD=2,DKIMQUEUE=/bin/cat,DKIMSIGN=/var/qmail/control/domainkeys/%/rsa-20250816,DKIMSIGNOPTIONS=-z 2,DKIMSIGNEXTRA=/var/qmail/control/domainkeys/%/ed-20250816,DKIMSIGNOPTIONSEXTRA=-z 4

        ...
        # For SMTP
        export QMAILQUEUE=/var/qmail/bin/qmail-dkim
        export DKIMVERIFY="p"   ## DKIM-Status ヘッダを追加するだけで reject しない
        # This is to allow msg without "subject" in the h= list
        # export UNSIGNED_SUBJECT=1
        # This is to avoid verification of outgoing messages
        export RELAYCLIENT_NODKIMVERIFY=1
        sh -c " /sbin/start-stop-daemon --start --quiet --user qmaild \
        ...

# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################

#    A 'contact address' users should contact for more info. (replaces
#    _CONTACTADDRESS_ in the report template)
# report_contact youremailaddress@domain.tld

# 常に X-Spam-Report: を付加
add_header all Report _REPORT_

#   Add *****SPAM***** to the Subject header of spam e-mails
#
rewrite_header Subject *****SPAM*****


#   Save spam messages as a message/rfc822 MIME attachment instead of
#   modifying the original message (0: off, 2: use text/plain instead)
#
report_safe 0


#   Set which networks or hosts are considered 'trusted' by your mail
#   server (i.e. not spammers)
#
trusted_networks 133.50.0.0/16 133.87.0.0/16 192.50.101.190 192.168.0.0/24
internal_networks 133.50.0.0/16 133.87.0.0/16 192.50.101.190 192.168.0.0/24
#internal_networks 133.50.160.0/23 133.87.45.0/24 192.168.0.0/24

# Envelope-From として Return-Path を使う
always_trust_envelope_sender 1

#   Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock


#   Set the threshold at which a message is considered spam (default: 5.0)
#
required_score 6.0


#   Use Bayesian classifier (default: 1)
#
use_bayes 1

#   Bayesian classifier auto-learning (default: 1)
#
bayes_auto_learn 1

bayes_path /var/spool/spamassassin/bayes
bayes_file_mode 0666

# 学習フィルタを重視する
score BAYES_00  0  0 -3.0   -3.8
score BAYES_05  0  0 -0.6   -1.0
score BAYES_20  0  0 -0.002 -0.002
score BAYES_40  0  0 -0.002 -0.002
score BAYES_50  0  0  4.0    1.6
score BAYES_60  0  0  5.0    3.0
score BAYES_80  0  0  5.4    4.0
score BAYES_95  0  0  6.4    6.0
score BAYES_99  0  0  7.6    7.0
score BAYES_999 0  0  0.4    0.4

# Validity への DNS クエリを無効化 (どのみちブロックされる)
dns_query_restriction deny bl.score.senderscore.com
dns_query_restriction deny sa-accredit.habeas.com
dns_query_restriction deny sa-trusted.bondedsender.org

# ep サーバで誤判定の多かった規定を無効化
meta RCVD_IN_PBL 0
score RDNS_NONE 0

#   Set headers which may provide inappropriate cues to the Bayesian
#   classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status


#   Whether to decode non- UTF-8 and non-ASCII textual parts and recode
#   them to UTF-8 before the text is given over to rules processing.
#
normalize_charset 1

# 日本人からのメールを受け取る場合
meta FROM_EXCESS_BASE64 0

# 本文の文字エンコーディングが UTF-8 のメールを許容する場合
meta MIME_BASE64_TEXT 0

# スペースを多用する署名を許容する場合
meta TVD_SPACE_RATIO 0

# MIME エンコードしていない ISO-2022-JP の Subject を許容する場合
meta SUBJ_ILLEGAL_CHARS 0
# meta SUBJECT_NEEDS_ENCODING 0

# DNS として HINES のものを使う (yellow は再帰的に検索できない)
dns_server 133.87.1.11

#   Textual body scan limit    (default: 50000)
#
#   Amount of data per email text/* mimepart, that will be run through body
#   rules.  This enables safer and faster scanning of large messages,
#   perhaps having very large textual attachments.  There should be no need
#   to change this well tested default.
#
# body_part_scan_size 50000

#   Textual rawbody data scan limit    (default: 500000)
#
#   Amount of data per email text/* mimepart, that will be run through
#   rawbody rules.
#
# rawbody_part_scan_size 500000

#   Some shortcircuiting, if the plugin is enabled
#
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
#
#   default: strongly-welcomelisted mails are *really* welcomelisted now, if
#   the shortcircuiting plugin is active, causing early exit to save CPU
#   load.  Uncomment to turn this on
#
#   SpamAssassin tries hard not to launch DNS queries before priority -100.
#   If you want to shortcircuit without launching unneeded queries, make
#   sure such rule priority is below -100. These examples are already:
#
# shortcircuit USER_IN_WELCOMELIST       on
# shortcircuit USER_IN_DEF_WELCOMELIST   on
# shortcircuit USER_IN_ALL_SPAM_TO     on

#   the opposite; blocklisted mails can also save CPU
#
# shortcircuit USER_IN_BLOCKLIST       on
# shortcircuit USER_IN_BLOCKLIST_TO    on

#   if you have taken the time to correctly specify your "trusted_networks",
#   this is another good way to save CPU
#
# shortcircuit ALL_TRUSTED             on

#   and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99                spam
# shortcircuit BAYES_00                ham

endif # Mail::SpamAssassin::Plugin::Shortcircuit

  body     BODY_JA_SPAMLIER   /配信停止/
  describe BODY_JA_SPAMLIER   You might be a spam sender.
  score    BODY_JA_SPAMLIER   1.0

ifplugin Mail::SpamAssassin::Plugin::ExtractText

extracttext_external pdftotext /usr/bin/pdftotext -nopgbrk -layout -enc UTF-8 {} -
extracttext_use pdftotext .pdf application/pdf

# http://docx2txt.sourceforge.net
extracttext_external docx2txt /usr/bin/docx2txt {} -
extracttext_use docx2txt .docx application/docx

extracttext_external antiword /usr/bin/antiword -t -w 0 -m UTF-8.txt {}
extracttext_use antiword .doc application/(?:vnd\.?)?ms-?word.*

extracttext_external unrtf /usr/bin/unrtf --nopict {}
extracttext_use unrtf .doc .rtf application/rtf text/rtf

extracttext_external odt2txt /usr/bin/odt2txt --encoding=UTF-8 {}
extracttext_use odt2txt .odt .ott application/.*?opendocument.*text
extracttext_use odt2txt .sdw .stw application/(?:x-)?soffice application/(?:x-)?starwriter

extracttext_external tesseract {OMP_THREAD_LIMIT=1} /usr/bin/tesseract -c page_separator= {} -
extracttext_use tesseract .jpg .png .bmp .tif .tiff image/(?:jpeg|png|x-ms-bmp|tiff)

add_header all ExtractText-Flags _EXTRACTTEXTFLAGS_

header PDF_NO_TEXT X-ExtractText-Flags =~ /\bNoText\b/
describe PDF_NO_TEXT PDF without text
score PDF_NO_TEXT 0.2

header DOC_NO_TEXT X-ExtractText-Flags =~ /\bNoText\b/
describe DOC_NO_TEXT Document without text
score DOC_NO_TEXT 0.2

header EXTRACTTEXT exists:X-ExtractText-Flags
describe EXTRACTTEXT Email processed by extracttext plugin
score EXTRACTTEXT 0.001

endif

  SAHOME="/etc/mail/spamassassin/"     # この行を追加
  OPTIONS="-u debian-spamd --create-prefs --max-children 5 --helper-home-dir"
    ## 上のように編集 (spamd を root 以外で動かす)

  #!/bin/sh
    exec /usr/bin/spamc | /var/qmail/bin/qmail-queue.org

  #!/bin/bash
  umask 022

  timestamp() {
    echo "$(date "+%Y-%m-%dT%H:%M:%S.%6N%:z") $(hostname)"
  }

  logfile="/var/log/sa-update.log"

  /usr/bin/sa-update --checkonly 2>&1
  status=$?

  if [ $status -eq 0 ]; then
    echo "$(timestamp) SpamAssassin rules will be updated..." >> "$logfile"
    /usr/bin/sa-update >> "$logfile" 2>&1
    echo "$(timestamp) SpamAssassin will be restarted..." >> "$logfile"
    systemctl restart spamd >> "$logfile" 2>&1
    exit 0
  elif [ $status -eq 1 ]; then
    echo "$(timestamp) No fresh updates for SpamAssassin" >> "$logfile"
    exit 0
  else
    echo "$(timestamp) Something wrong happened... Check the log files" >> "$logfile"
    exit 1
  fi
  # sa-update の exit コードは man sa-update 参照
  # log に余計な出力をしないよう、更新のない場合もexit コードは 0 に指定

SHELL=/bin/bash
PATH=/bin:/usr/bin:/usr/local/bin
ADDRESS=mondohoge@usuzumi.ep.sci.hokudai.ac.jp
LOGFILE=$HOME/.procmail/`date +%Y%m`.log
LOCKFILE=$HOME/.procmail/.lockfile
MAILDIR=$HOME/Maildir
MBOX=$HOME/Mailbox
DEFAULT=$MBOX

# spamc に通す (フィルタ)
:0fw
| /usr/bin/spamc

# ========== ここから配送 ==========

# mbox 形式 (Mailbox)
:0c:
$HOME/Mailbox

# Maildir 形式
:0c
$HOME/Maildir/

# 外部アドレス転送
:0
! hogehoge@example.com