我需要建议：具有垃圾邮件过滤功能的占用内存少的Linux邮件服务器

我有一个VPS，最初将其定位为Web服务器，但是还需要部署一些最低限度的邮件功能，包括作为独立服务器进行发送和接收。

当前设置如下：

• Postfix接收邮件，用户位于虚拟表中，存储在MySQL中
• 在连接时，所有服务器都通过针对某些DNSBL的策略加权服务进行了测试
• 所有邮件都是在spamc客户端的帮助下通过SpamAssassin spamd运行的
• 然后，邮件也会与Dovecot 2'LDA（本地传递代理）以及虚拟用户一起传递

如你所见...

• 没有运行病毒扫描程序，这是有原因的：clamav吞噬了所有可能的内存，而且，通过此设置过滤掉了所有病毒邮件（我已经对启用ClamAV的1.5年进行了相同的测试，从来没有病毒邮件甚至达到ClamAV）
• 我不使用amavisd，我真的不想要。如果您有足够的内存和大量同时扫描程序，则只需要该怪物即可。手工微调也是一场噩梦。
• 我在后缀中运行策略化权重而不是策略化和本机DNSBL。我不喜欢遣送某人，因为有一项服务列出了他们。

重要声明：一切正常。我收到的垃圾邮件数量很少，几乎从未收到过误报，而且大多数不良邮件都被按策略限制。我感觉到的所有服务中唯一的“问题”总共占用了很多内存。

我已经削减了spamassassin的模块（见下文），但是我真的很想听听一些建议，以尽可能减少内存占用，主要是：SpamAssassin真正需要哪些插件，或多或少没用，关于我当前的后缀和策略权重设置？

SpamAssassin规则也使用sa-compile进行编译（sa-update每周从cron运行一次，之后立即运行compile）

这些是当前可能很重要的一些配置，如果需要更多内容，请告诉我。

postfix/master.cf （仅零件）

dovecot   unix  -       n       n        -      -       pipe
  flags=DRhu user=vmail:vmail argv=/usr/bin/spamc -e /usr/lib/dovecot/deliver -d ${recipient} -f {sender}

postfix/main.cf （仅零件）

smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
        reject_invalid_hostname,
        permit

smtpd_recipient_restrictions =  permit_mynetworks,
        permit_sasl_authenticated,
        reject_invalid_hostname,
        reject_non_fqdn_hostname,
        reject_non_fqdn_recipient,
        reject_unknown_recipient_domain,
        reject_unauth_pipelining,
        reject_unauth_destination,
        check_policy_service inet:127.0.0.1:12525,
        permit

policyd-weight.conf （仅零件）

$REJECTMSG = "550 Mail appeared to be SPAM or forged. Ask your Mail/DNS-Administrator to correct HELO and DNS MX settings or to get removed from DNSBLs";

$REJECTLEVEL = 4;
$DEFER_STRING = 'IN_SPAMCOP= BOGUS_MX=';
$DEFER_ACTION = '450';
$DEFER_LEVEL  = 5;
$DNSERRMSG = '450 No DNS entries for your MTA, HELO and Domain. Contact YOUR administrator';

# 1: ON, 0: OFF (default)
# If ON request that ALL clients are only checked against RBLs
$dnsbl_checks_only = 0;

# 1: ON (default), 0: OFF
# When set to ON it logs only RBLs which affect scoring (positive or negative)
$LOG_BAD_RBL_ONLY  = 1;

## DNSBL settings
@dnsbl_score = (
        # host,                 hit,    miss,   log name
        'dnsbl.ahbl.org',       3,      -1,     'dnsbl.ahbl.org',
        'dnsbl.njabl.org',      3,      -1,     'dnsbl.njabl.org',
        'dnsbl.sorbs.net',      3,      -1,     'dnsbl.sorbs.net',
        'bl.spamcop.net',       3,      -1,     'bl.spamcop.net',
        'zen.spamhaus.org',     3,      -1,     'zen.spamhaus.org',
        'pbl.spamhaus.org',     3,      -1,     'pbl.spamhaus.org',
        'cbl.abuseat.org',      3,      -1,     'cbl.abuseat.org',
        'list.dsbl.org',        3,      -1,     'list.dsbl.org',
);

# If Client IP is listed in MORE DNSBLS than this var, it gets REJECTed immediately
$MAXDNSBLHITS  = 3;

# alternatively, if the score of DNSBLs is ABOVE this level, reject immediately
$MAXDNSBLSCORE = 9;

$MAXDNSBLMSG = '550 Az levelezoszerveruk IP cime tul sok spamlistan talahato, kerjuk ellenorizze! / Your MTA is listed in too many DNSBLs; please check.';

## RHSBL settings
@rhsbl_score = (
        'multi.surbl.org',              4,      0,      'multi.surbl.org',
        'rhsbl.ahbl.org',               4,      0,      'rhsbl.ahbl.org',
        'dsn.rfc-ignorant.org',         4,      0,      'dsn.rfc-ignorant.org',
#       'postmaster.rfc-ignorant.org',  0.1,    0,      'postmaster.rfc-ignorant.org',
#       'abuse.rfc-ignorant.org',       0.1,    0,      'abuse.rfc-ignorant.org'
);

# skip a RBL if this RBL had this many continuous errors
$BL_ERROR_SKIP = 2;

# skip a RBL for that many times
$BL_SKIP_RELEASE = 10;

## cache stuff
# must be a directory (add trailing slash)
$LOCKPATH = '/var/run/policyd-weight/';

# socket path for the cache daemon.
$SPATH = $LOCKPATH.'/polw.sock';

# how many seconds the cache may be idle before starting maintenance routines
#NOTE: standard maintenance jobs happen regardless of this setting.
$MAXIDLECACHE = 60;

# after this number of requests do following maintenance jobs: checking for config changes
$MAINTENANCE_LEVEL = 5;

# negative (i.e. SPAM) result cache settings ##################################

# set to 0 to disable caching for spam results. To this level the cache will be cleaned.
$CACHESIZE = 2000;

# at this number of entries cleanup takes place
$CACHEMAXSIZE = 4000;

$CACHEREJECTMSG  = '550 temporarily blocked because of previous errors';

# after NTTL retries the cache entry is deleted
$NTTL = 1;

# client MUST NOT retry within this seconds in order to decrease TTL counter
$NTIME = 30;

# positve (i.,e. HAM) result cache settings ###################################

# set to 0 to disable caching of HAM. To this number of entries the cache will be cleaned
$POSCACHESIZE = 1000;

# at this number of entries cleanup takes place
$POSCACHEMAXSIZE = 2000;

$POSCACHEMSG = 'using cached result';

#after PTTL requests the HAM entry must succeed one time the RBL checks again
$PTTL = 60;

# after $PTIME in HAM Cache the client must pass one time the RBL checks again.
#Values must be nonfractal. Accepted time-units: s, m, h, d
$PTIME = '3h';

# The client must pass this time the RBL checks in order to be listed as hard-HAM
# After this time the client will pass immediately for PTTL within PTIME
$TEMP_PTIME = '1d';


## DNS settings

# Retries for ONE DNS-Lookup
$DNS_RETRIES = 1;

# Retry-interval for ONE DNS-Lookup
$DNS_RETRY_IVAL  = 5;

# max error count for unresponded queries in a complete policy query
$MAXDNSERR = 3;

$MAXDNSERRMSG = 'passed - too many local DNS-errors';

# persistent udp connection for DNS queries.
#broken in Net::DNS version 0.51. Works with Net::DNS 0.53; DEFAULT: off
$PUDP= 0;

# Force the usage of Net::DNS for RBL lookups.
# Normally policyd-weight tries to use a faster RBL lookup routine instead of Net::DNS
$USE_NET_DNS  = 0;

# A list of space separated NS IPs
# This overrides resolv.conf settings
# Example: $NS = '1.2.3.4 1.2.3.5';
# DEFAULT: empty
$NS  = '';

# timeout for receiving from cache instance
$IPC_TIMEOUT  = 2;

# If set to 1 policyd-weight closes connections to smtpd clients in order to avoid too many
#established connections to one policyd-weight child
$TRY_BALANCE  = 0;

# scores for checks, WARNING: they may manipulate eachother
# or be factors for other scores.
#  HIT score, MISS Score
@client_ip_eq_helo_score = (1.5, -1.25 );
@helo_score  = (1.5, -2 );
@helo_score  = (0, -2 );
@helo_from_mx_eq_ip_score= (1.5, -3.1  );
@helo_numeric_score= (2.5,  0 );
@from_match_regex_verified_helo= (1,-2 );
@from_match_regex_unverified_helo = (1.6, -1.5  );
@from_match_regex_failed_helo  = (2.5,  0 );
@helo_seems_dialup = (1.5,  0 );
@failed_helo_seems_dialup= (2, 0 );
@helo_ip_in_client_subnet= (0,-1.2  );
@helo_ip_in_cl16_subnet  = (0,-0.41 );
#@client_seems_dialup_score  = (3.75, 0 );
@client_seems_dialup_score  = (0, 0 );
@from_multiparted  = (1.09, 0 );
@from_anon= (1.17, 0 );
@bogus_mx_score = (2.1,  0 );
@random_sender_score  = (0.25, 0 );
@rhsbl_penalty_score  = (3.1,  0 );
@enforce_dyndns_score = (3, 0 );

spamassassin/init.pre （我将.pre文件放在一起）

loadplugin Mail::SpamAssassin::Plugin::Hashcash
loadplugin Mail::SpamAssassin::Plugin::SPF
loadplugin Mail::SpamAssassin::Plugin::Pyzor
loadplugin Mail::SpamAssassin::Plugin::Razor2
loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
loadplugin Mail::SpamAssassin::Plugin::ReplaceTags
loadplugin Mail::SpamAssassin::Plugin::Check
loadplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
loadplugin Mail::SpamAssassin::Plugin::URIDetail    
loadplugin Mail::SpamAssassin::Plugin::Bayes
loadplugin Mail::SpamAssassin::Plugin::BodyEval
loadplugin Mail::SpamAssassin::Plugin::DNSEval
loadplugin Mail::SpamAssassin::Plugin::HTMLEval
loadplugin Mail::SpamAssassin::Plugin::HeaderEval
loadplugin Mail::SpamAssassin::Plugin::MIMEEval
loadplugin Mail::SpamAssassin::Plugin::RelayEval
loadplugin Mail::SpamAssassin::Plugin::URIEval
loadplugin Mail::SpamAssassin::Plugin::WLBLEval
loadplugin Mail::SpamAssassin::Plugin::VBounce
loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody

spamassassin/local.cf （部分）

use_bayes                       1
bayes_auto_learn                1
bayes_store_module              Mail::SpamAssassin::BayesStore::MySQL
bayes_sql_dsn                   DBI:mysql:db:127.0.0.1:3306
bayes_sql_username              user
bayes_sql_password              pass
bayes_ignore_header             X-Bogosity
bayes_ignore_header             X-Spam-Flag
bayes_ignore_header             X-Spam-Status

### User settings
user_scores_dsn                 DBI:mysql:db:127.0.0.1:3306
user_scores_sql_password        user
user_scores_sql_username        pass
user_scores_sql_custom_query    SELECT preference, value FROM _TABLE_ WHERE username = _USERNAME_ OR username = '$GLOBAL' OR username = CONCAT('%',_DOMAIN_) ORDER BY username ASC

# for better speed
score DNS_FROM_AHBL_RHSBL       0
score __RFC_IGNORANT_ENVFROM    0
score DNS_FROM_RFC_DSN          0
score DNS_FROM_RFC_BOGUSMX      0
score __DNS_FROM_RFC_POST       0
score __DNS_FROM_RFC_ABUSE      0
score __DNS_FROM_RFC_WHOIS      0

更新01

正如适配器建议的那样，我删除了策略重量和已配置的postfix后屏幕，这从RAM使用情况中导致了大约-15-20 MB，并且工作速度大大提高。我不确定它是否已满负荷工作，但似乎很有希望。

我建议您升级到postfix 2.8+并部署postscreen；这是专门设计为僵尸/ DNSBL分类服务器，并可以高速处理多个黑名单。

它还提供了完全加权的黑/白名单评分，明确的白名单等等。

关于第二个问题，我建议您检查一下spamass-milter；在线斜切机比外部流程效率更高。