apt-get install -y perl-doc

# perldoc -T Mail::SpamAssassin::Conf 2>&1 | head -6
You need to install the perl-doc package to use this program.

# perldoc -T Mail::SpamAssassin::Conf 2>/dev/null | head -6
NAME
    Mail::SpamAssassin::Conf - SpamAssassin configuration file

SYNOPSIS
      # a comment

ls /etc/mail/spamassassin/

65_debian.cf
init.pre
local.cf
local.cf.orig
sa-compile.pre
sa-update-hooks.d
sa-update-keys
v310.pre
v312.pre
v320.pre
v330.pre
v340.pre
v341.pre
v342.pre
v343.pre

# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################

#    A 'contact address' users should contact for more info. (replaces
#    _CONTACTADDRESS_ in the report template)
# report_contact youremailaddress@domain.tld


#   Add *****SPAM***** to the Subject header of spam e-mails
#
# rewrite_header Subject *****SPAM*****


#   Save spam messages as a message/rfc822 MIME attachment instead of
#   modifying the original message (0: off, 2: use text/plain instead)
#
# report_safe 1


#   Set which networks or hosts are considered 'trusted' by your mail
#   server (i.e. not spammers)
#
# trusted_networks 212.17.35.

/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
/etc/mail/spamassassin/init.pre:loadplugin Mail::SpamAssassin::Plugin::SPF
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Pyzor
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Razor2
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::SpamCop
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::AutoLearnThreshold
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::WhiteListSubject
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
/etc/mail/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::ReplaceTags

spamassassin --lint

spamassassin --lint -D config 2>&1 | grep -E "config: read file|config: using"

dbg: config: using "/etc/mail/spamassassin" for site rules pre files
dbg: config: read file /etc/mail/spamassassin/init.pre
dbg: config: read file /etc/mail/spamassassin/sa-compile.pre
dbg: config: read file /etc/mail/spamassassin/v310.pre
dbg: config: read file /etc/mail/spamassassin/v312.pre
dbg: config: read file /etc/mail/spamassassin/v320.pre
dbg: config: read file /etc/mail/spamassassin/v330.pre
dbg: config: read file /etc/mail/spamassassin/v340.pre
dbg: config: read file /etc/mail/spamassassin/v341.pre
dbg: config: read file /etc/mail/spamassassin/v342.pre
dbg: config: read file /etc/mail/spamassassin/v343.pre
dbg: config: using "/var/lib/spamassassin/3.004006" for sys rules pre files
dbg: config: using "/var/lib/spamassassin/3.004006" for default rules dir
dbg: config: read file /var/lib/spamassassin/3.004006/updates_spamassassin_org.cf
dbg: config: using "/etc/mail/spamassassin" for site rules dir
dbg: config: read file /etc/mail/spamassassin/65_debian.cf
dbg: config: read file /etc/mail/spamassassin/local.cf
dbg: config: using "/root/.spamassassin/user_prefs" for user prefs file
dbg: config: read file /root/.spamassassin/user_prefs
dbg: config: using "/var/lib/spamassassin/3.004006/updates_spamassassin_org/10_default_prefs.cf" for included file

spamassassin --cf="required_score 2000" -t gtube.eml | grep X-Spam-Status
spamassassin --cf="rewrite_header Subject [CUSTOM-MARK]" -t gtube.eml | grep "^Subject"

X-Spam-Status: No, score=1000.8 required=2000.0 tests=BAYES_50,GTUBE,

Subject: [CUSTOM-MARK] Test spam mail (GTUBE)

vi /etc/mail/spamassassin/local.cf
spamassassin --lint && systemctl restart spamassassin
systemctl is-active spamassassin

active

required_score n.nn (default: 5)
    Set the score required before a mail is considered spam. "n.nn" can
    be an integer or a real number. 5.0 is the default setting, and is
    quite aggressive; it would be suitable for a single-user setup, but
    if you're an ISP installing SpamAssassin, you should probably set
    the default to be more conservative, like 8.0 or 10.0. It is not
    recommended to automatically delete or discard messages marked as
    spam, as your users will complain, but if you choose to do so, only
    delete messages with an exceptionally high score such as 15.0 or
    higher. This option was previously known as "required_hits" and that
    name is still accepted, but is deprecated.

required_score 5.0

rewrite_header Subject *****SPAM*****

spamc < /var/mailtest/gtube.eml | grep -E "^Subject|X-Spam-Status"

Subject: *****SPAM***** Test spam mail (GTUBE)
X-Spam-Status: Yes, score=1000.0 required=5.0 tests=GTUBE,NO_RECEIVED,

Subject: Weekly project meeting minutes

trusted_networks 192.168.1.0/24

report_safe ( 0 | 1 | 2 ) (default: 1)
    if this option is set to 1, if an incoming message is tagged as
    spam, instead of modifying the original message, SpamAssassin will
    create a new report message and attach the original message as a
    message/rfc822 MIME part (ensuring the original message is
    completely preserved, not easily opened, and easier to recover).

    If this option is set to 2, then original messages will be attached
    with a content type of text/plain instead of message/rfc822. ...

    If this option is set to 0, incoming spam is only modified by adding
    some "X-Spam-" headers and no changes will be made to the body. In
    addition, a header named X-Spam-Report will be added to spam. ...

report_safe 1

Content-Type: multipart/mixed; boundary="----------=_6ACC2D5B.B5448E95"

use_bayes 1
bayes_auto_learn 1
bayes_min_ham_num 200
bayes_min_spam_num 200

systemctl restart spamassassin
spamc -t < /var/mailtest/bayes-test.eml | grep -E "BAYES|X-Spam-Status"

X-Spam-Status: Yes, score=6.6 required=5.0 tests=BAYES_99,BAYES_999,

spamassassin -t /var/mailtest/bayes-test.eml | grep -E "pts rule|BAYES_9"

 0.2 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
 3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%

ok_locales xx [ yy zz ... ] (default: all)
    This option is used to specify which locales are considered OK for
    incoming mail. Mail using the character sets that are allowed by
    this option will not be marked as possibly being spam in a foreign
    language.

    If you receive lots of spam in foreign languages, and never get any
    non-spam in these languages, this may help. Note that all ISO-8859-*
    character sets, and Windows code page character sets, are always
    permitted by default.

    Set this to "all" to allow all character sets. This is the default.

    The rules "CHARSET_FARAWAY", "CHARSET_FARAWAY_BODY", and
    "CHARSET_FARAWAY_HEADERS" are triggered based on how this is set.

use_razor2 0
use_pyzor 0

# ===== 判定与改写 =====
required_score 5.0
rewrite_header Subject *****SPAM*****
report_safe 1

# ===== 信任网段 =====
trusted_networks 192.168.1.0/24

# ===== 贝叶斯自适应学习 =====
use_bayes 1
use_bayes_rules 1
bayes_auto_learn 1
bayes_auto_learn_threshold_spam 12.0
bayes_auto_learn_threshold_nonspam 0.1
bayes_min_ham_num 200
bayes_min_spam_num 200
bayes_path /var/lib/spamassassin/bayes
bayes_journal_max_size 102400
bayes_expiry_max_db_size 150000
bayes_auto_expire 1

# ===== 协同过滤（未部署即关闭）=====
use_razor2 0
use_pyzor 0

spamassassin --lint
systemctl restart spamassassin && systemctl is-active spamassassin
spamc -c < /var/mailtest/gtube.eml

active
1000.0/5.0

Subject: *****SPAM***** Test spam mail (GTUBE)

Oct 12 00:47:25.798 [5573] warn: config: failed to parse line, skipping, in "/etc/spamassassin/local.cf": use_dcc 0
Oct 12 00:47:26.422 [5573] warn: lint: 1 issues detected, please rerun with debug enabled for more information

Oct 12 00:47:25.798 [5573] warn: netset: cannot include 127.0.0.1/8 as it has already been included

spamassassin --lint -D config 2>&1 | less