You may need to add root and your MTA user to the directory's [mail] group
in /etc/group. The MTA user is usually 'daemon' or 'smmsp' although on
FreeBSD the default is 'mailnull'. This is very important, as your MTA
user needs to be able to lock and work with files.
IMPORTANT!!!
FreeBSD's mail.local changes its effective uid, and so in order to use it
dspam must be installed as setuid root to work on the commandline properly.
This is done automatically on install.
If you find that DSPAM is erroneously processing all operations as a single
user, chances are that user should be added to trusted.users as an
administrative user,
信任用户安全管理（TRUSTED USERS SECURITY）
DSPAM对系统内的不可靠用户有着严格的安全体系，目的是防止他们欺骗其他用户或者指定其自己的通行参
数（passthru arguments）潜在地劫持发送代理。应用这种安全方法是因为执行某些命令（比如使用procmail)
时会要求setuid或是setgid DSPAM代理。
trusted.users文件应该创建在$DSPAM_HOME (默认是 /var/dspam)中。该文件应该包含trusted users的名单， 字串6
这些trusted users允许设置或限制垃圾用户，passthru parameters及其他被某些恶意用户设置的具有潜在
危险的信息。该文件一行一个用户名，通常都是MTA和CGI用户的用户名。例如：
root
smmsp
daemon
cgi
mailnull
Where cgi represents the special CGI user you configure Apache to
run your dspam.cgi as.
TRUSTED USERS SECURITY
DSPAM has tighter security for untrusted users on the system, to prevent
them from being able to spoof other users or specify their own passthru
arguments to potentially hijack the delivery agent. This method
of security has been implemented due to the fact that some implementations
(such as those using procmail) may require the DSPAM agent to be setuid or
setgid.
The trusted.users file should be created in $DSPAM_HOME (defaulted to
/var/dspam). This file should contain a list of trusted users who
should be allowed to set the dspam user, passthru parameters, and other
information that would be potentially dangerous for a malicious user to
字串8
be able to set. The file should contain one username per line, and will
generally the usernames of the MTA and CGI users. Example:
root
smmsp
daemon
cgi
mailnull
Where cgi represents the special CGI user you configure Apache to
run your dspam.cgi as.
一定要检查DSPAM_HOME/dspam.debug以确保当提交垃圾或假阳性邮件时您没有收到任何不可靠用户的警告，
因为这些actions会经常从不同的用户调用垃圾邮件而不是从标准投递调用。
如果您在调用DSPAM匹配目的用户之前已经更改了userid的MTA时，您不该（should, NOT）把每个用户都添加到trusted users文件中，您应该配置一个事先调整的命令行。DSPAM就会看到这个用户是不可靠的用户，自动设置其
DSPAM用户id和随意配置发送代理参数。
为了不考虑某个untrusted user的通过代理参数（是指可以用来攻击发送代理以获得访问系统的特权的参数），您只需在相同的目录
（$DSPAM_HOME）中建一个untrusted.mailer_args的文件。第一行应该是到发送代理的路径，接下来是所有
要通过的LDP参数列表（如果必要的话可以包括每个用户的是识别标志）。这个文件的信息将不会考虑任何
字串9
由用户指定的通过命令行的参数。例如:
/bin/mail -d $u
变量$u告诉DSPAM您愿意目标用户名可以用于$u被指定的地方，因此当DSPAM为用户'bob'调用您的LDA时，
他将会这样调用：
/bin/mail -d bob
Be sure to examine DSPAM_HOME/dspam.debug to insure that you don't get any
untrusted user warnings when submitting spam or a false positive, as both
of these actions frequently call dspam from a different user than
standard mail delivery.
If you are using an MTA that changes its userid before calling DSPAM to
match the destination user, you should NOT add each user to the trusted
users file, but instead configure a preset commandline. DSPAM will see
that the user is not trusted and automatically set their DSPAM user id
and optionally the passthru delivery agent arguments.
To override an untrusted user's passthru delivery agent arguments
(arguments which could be used to hijack the delivery agent to gain
privileged access to the system) you will need to set up a file called
字串4
untrusted.mailer_args in the same directory ($DSPAM_HOME). The first line
should contain the path to the delivery agent followed by a list of
all the LDA arguments to pass through (including a user identity flag if
necessary). This file's information will override any passthru commandline
parameters specified by the user. For example:
/bin/mail -d $u
The variable $u informs DSPAM that you would like the destination username
to be used in the position $u is specified, so when DSPAM calls your LDA
for user 'bob', it will call it with:
/bin/mail -d bob
注：如果下列所有（ALL）事件都是真：
- 您的MTA在调用DSPAM之前对目标用户执行setup()
- 在配置文件中不能指定，但是还必需得传递给DSPAM的参数additional_dynamically assigned_paramerers存在
- 发送代理没有潜在危险的命令行参数选项，或者您给发送代理加了一层封皮