Package: rspamd
Version: 1.9.4-2
Hi,
I see various connections from my system to 88.99.142.95 (the rspamd
home).
The https ones seem to be targeted at "maps.rspamd.com", which are used
by the default config to download various "map" files.
I'd feel safer if an independent cronjob would handle those (and maybe
even disable it by default), or maybe deploy through a separate package?
(No idea how often those are updated.)
Then there are UDP connections to port 11335, which probably comes from:
servers = "round-robin:fuzzy1.rspamd.com:11335,fuzzy2.rspamd.com:11335";
in /etc/rspamd/modules.d/fuzzy_check.conf.
This module should imho be disabled by default, especially given there
is a "usage policy" connected to it:
https://rspamd.com/doc/usage_policy.html
cheers,
Stefan
