blog.monogatari.pl

SpamAssasin is the last weapon from our arsenal that we will use to keep spam away from our mail server.

Install needed packages:

apt-get install spamassassin spamc

1	apt-get install spamassassin spamc

We ned to add user that will be running spamassasin on our server:

groupadd spamd
useradd -g spamd -s /bin/false spamd
chown spamd:spamd -R /etc/spamassassin/

groupadd spamd

useradd -g spamd -s /bin/false spamd

chown spamd:spamd -R /etc/spamassassin/

User is ready now we need configure SA to use it:

#vim /etc/default/spamassassin

# If you're using systemd (default for jessie), the ENABLED setting is
# not used. Instead, enable spamd by issuing:
# systemctl enable spamassassin.service
# Change to "1" to enable spamd on systems using sysvinit:
ENABLED=1
SPAMD_HOME="/home/spamd/"
OPTIONS="--create-prefs --max-children 5 --username spamd --helper-home-dir /home/spamd/ -s /home/spamd/spamd.log"
PIDFILE="/home/spamd/spamd.pid"
CRON=1

#vim /etc/default/spamassassin

# If you're using systemd (default for jessie), the ENABLED setting is

# not used. Instead, enable spamd by issuing:

# systemctl enable spamassassin.service

# Change to "1" to enable spamd on systems using sysvinit:

ENABLED=1

SPAMD_HOME="/home/spamd/"

OPTIONS="--create-prefs --max-children 5 --username spamd --helper-home-dir /home/spamd/ -s /home/spamd/spamd.log"

PIDFILE="/home/spamd/spamd.pid"

CRON=1

Start SA:

service spamassassin start

1	service spamassassin start

Add SpamAssassin Support to postfix:

#vim /etc/postfix/master.cf

# on the bottom of file add:
spamassassin unix -     n       n       -       -       pipe
        user=spamd argv=/usr/bin/spamc -f -e  
        /usr/sbin/sendmail -oi -f ${sender} ${recipient}

# in every protocol we use (ex. smtps, submission) we should add this line below to forward mails to spamassasin:
-o content_filter=spamassassin

#vim /etc/postfix/master.cf

# on the bottom of file add:

spamassassin unix - n n - - pipe

user=spamd argv=/usr/bin/spamc -f -e

/usr/sbin/sendmail -oi -f ${sender} ${recipient}

# in every protocol we use (ex. smtps, submission) we should add this line below to forward mails to spamassasin:

-o content_filter=spamassassin

Restart postfix:

service postfix restart

1	service postfix restart

We need to create rules for SA:

#/etc/spamassassin/local.cf

rewrite_header Subject ***** SPAM _SCORE_ *****
report_safe             0
required_score          5.0
use_bayes               1
use_bayes_rules         1
bayes_auto_learn        1
skip_rbl_checks         0
use_razor2              0
use_dcc                 0
use_pyzor               0

#Adjust scores for SPF FAIL
score SPF_FAIL 4.0
score SPF_HELO_FAIL 4.0
score SPF_HELO_SOFTFAIL 3.0
score SPF_SOFTFAIL 3.0

#adjust DKIM scores
score DKIM_ADSP_ALL 3.0
score DKIM_ADSP_DISCARD  10.0
score DKIM_ADSP_NXDOMAIN 3.0

#/etc/spamassassin/local.cf

rewrite_header Subject ***** SPAM _SCORE_ *****

report_safe 0

required_score 5.0

use_bayes 1

use_bayes_rules 1

bayes_auto_learn 1

skip_rbl_checks 0

use_razor2 0

use_dcc 0

use_pyzor 0

#Adjust scores for SPF FAIL

score SPF_FAIL 4.0

score SPF_HELO_FAIL 4.0

score SPF_HELO_SOFTFAIL 3.0

score SPF_SOFTFAIL 3.0

#adjust DKIM scores

score DKIM_ADSP_ALL 3.0

score DKIM_ADSP_DISCARD 10.0

score DKIM_ADSP_NXDOMAIN 3.0

Restart service to be sure we use newest rules:

service spamassassin restart

1	service spamassassin restart

To test spamassasin we can send mail from external mail server to our server and check header to see if spamassasin added his header with scoring.

Update 05/11/2016:

I notice that spamassassin throw error in syslog

warn: config: failed to parse line, skipping, in "/etc/spamassassin/local.cf": use_dcc 0

1	warn: config: failed to parse line, skipping, in "/etc/spamassassin/local.cf": use_dcc 0

This can be fix easily by commenting out use_dcc line or adding dcc and not use it (pointless)

Rest post related to this topic:

Fight against spam part 3 – Postfix DMARC

Domain-based Message Authentication, Reporting and Conformance (DMARC) is an email validation system designed to detect and prevent email spoofing. It provides a mechanism which allows a receiving organization to check that incoming mail from a domain is authorized by that domain’s administrators and that the email (including attachments) has not been modified during transport – Wikipedia

This is a continuation of topic about fighting against spam when you are self-hosting your mail server which in this case should be Postfix, previously we did finish confguration of SPF and DKIM.

Install needed package:

#debian/ubuntu
apt-get install opendmarc

1 2	#debian/ubuntu apt-get install opendmarc

Configure it with basic configuration:

#vim /etc/opendmarc.conf

AuthservID mail.example.com
PidFile /var/run/opendmarc.pid #Debian default
RejectFailures false
Syslog true
TrustedAuthservIDs mail.example.com,mail2.example.com
UMask 0002
UserID opendmarc:opendmarc
IgnoreHosts /etc/opendmarc/ignore.hosts
HistoryFile /var/run/opendmarc/opendmarc.dat
#only for debugging we can add the line below
SoftwareHeader true

#vim /etc/opendmarc.conf

AuthservID mail.example.com

PidFile /var/run/opendmarc.pid #Debian default

RejectFailures false

Syslog true

TrustedAuthservIDs mail.example.com,mail2.example.com

UMask 0002

UserID opendmarc:opendmarc

IgnoreHosts /etc/opendmarc/ignore.hosts

HistoryFile /var/run/opendmarc/opendmarc.dat

#only for debugging we can add the line below

SoftwareHeader true

But thats not all, lets create folder:

mkdir /etc/opendmarc/

1	mkdir /etc/opendmarc/

And add host that will be excluded from scanning – us !?!

#vim /etc/opendmarc/ignore.hosts

localhost
ip_address_of_our_server

#vim /etc/opendmarc/ignore.hosts

localhost

ip_address_of_our_server

Assuming we used previous post about fighting with spam we should have DKIM on port 12301 so we can user port 54321 for DMARC:

#vim /etc/default/opendmarc
...
SOCKET="inet:54321@localhost"
...

#vim /etc/default/opendmarc

...

SOCKET="inet:54321@localhost"

...

Let us start opendmarc to ensure we don’t have any typo in configuration file:

/etc/init.d/opendmarc start

1	/etc/init.d/opendmarc start

We need to enable support for this technic in postfix:

#vim /etc/postfix/main.cf

...
smtpd_milters=inet:localhost:12345,inet:localhost:54321
non_smtpd_milters=inet:localhost:12345,inet:localhost:54321
...

#vim /etc/postfix/main.cf

...

smtpd_milters=inet:localhost:12345,inet:localhost:54321

non_smtpd_milters=inet:localhost:12345,inet:localhost:54321

...

Remamber that smtpd-milters and non_smtpd_milters was previously configurated with DKIM so now we have two values as the second is DMARC 🙂

Reload our postfix so he can use DMARC:

/etc/init.d/postfix reload

1	/etc/init.d/postfix reload

Knowing that DMARC use DKIM and SPF we will have to add another TXT record to our DNS. Internet is full of DMARC wizards to create different configuration, for now we can use the one provided here:

_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=0; adkim=r; aspf=r; pct=100; rf=afrf; ri=86400"

1	_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=0; adkim=r; aspf=r; pct=100; rf=afrf; ri=86400"

Normaly alot of people end the configuration here but that is not fully implemented DMARC. They forget about exchanging reports between mail servers. This is way we can fix this:

#vim /usr/share/doc/opendmarc/schema.mysql
...
CREATE USER 'opendmarc'@'localhost' IDENTIFIED BY 'changeme';
GRANT ALL ON opendmarc.* to 'opendmarc'@'localhost';
...

#vim /usr/share/doc/opendmarc/schema.mysql

...

CREATE USER 'opendmarc'@'localhost' IDENTIFIED BY 'changeme';

GRANT ALL ON opendmarc.* to 'opendmarc'@'localhost';

...

Those line and in schema.mysql but are commented, just uncomment them so we will create proper user for opendmarc

Read and execute schema:

mysql -u root -p < schema.mysql

1	mysql -u root -p < schema.mysql

Create script that will make reports for us:

#vim /etc/opendmarc/report_script

#!/bin/bash

DB_SERVER='database.example.com'
DB_USER='opendmarc'
DB_PASS='password
DB_NAME='opendmarc'
WORK_DIR='/var/run/opendmarc'
REPORT_EMAIL='dmarc@example.com'
REPORT_ORG=example.com'

mv ${WORK_DIR}/opendmarc.dat ${WORK_DIR}/opendmarc_import.dat -f
cat /dev/null > ${WORK_DIR}/opendmarc.dat

/usr/sbin/opendmarc-import --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose < ${WORK_DIR}/opendmarc_import.dat
/usr/sbin/opendmarc-reports --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose --interval=86400 --report-email $REPORT_EMAIL --report-org $REPORT_ORG
/usr/sbin/opendmarc-expire --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose

#vim /etc/opendmarc/report_script

#!/bin/bash

DB_SERVER='database.example.com'

DB_USER='opendmarc'

DB_PASS='password

DB_NAME='opendmarc'

WORK_DIR='/var/run/opendmarc'

REPORT_EMAIL='dmarc@example.com'

REPORT_ORG=example.com'

mv ${WORK_DIR}/opendmarc.dat ${WORK_DIR}/opendmarc_import.dat -f

cat /dev/null > ${WORK_DIR}/opendmarc.dat

/usr/sbin/opendmarc-import --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose < ${WORK_DIR}/opendmarc_import.dat

/usr/sbin/opendmarc-reports --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose --interval=86400 --report-email $REPORT_EMAIL --report-org $REPORT_ORG

/usr/sbin/opendmarc-expire --dbhost=${DB_SERVER} --dbuser=${DB_USER} --dbpasswd=${DB_PASS} --dbname=${DB_NAME} --verbose

We need to add that script to cron to make it work multiply times:

chmod +x /etc/opendmarc/report_script

# first test the script before adding it to cron
su -c "/etc/opendmarc/report_script" -s /bin/bash opendmarc

#vim /etc/crontab

1 0 * * * opendmarc /etc/opendmarc/report_script

chmod +x /etc/opendmarc/report_script

# first test the script before adding it to cron

su -c "/etc/opendmarc/report_script" -s /bin/bash opendmarc

#vim /etc/crontab

1 0 * * * opendmarc /etc/opendmarc/report_script

It is a good practice to view reports that we send to external mail servers, we will achive this in postfix this way:

#vim /etc/postfix/main.cf

...
sender_bcc_maps = hash:/etc/postfix/bcc_map
...

#vim /etc/postfix/bcc_map
dmarc@example.com mailboxforbcc@example.com


postmap /etc/postfix/bcc_map

#vim /etc/postfix/main.cf

...

sender_bcc_maps = hash:/etc/postfix/bcc_map

...

#vim /etc/postfix/bcc_map

dmarc@example.com mailboxforbcc@example.com

postmap /etc/postfix/bcc_map

Just one more restart of service and we are ready to go:

/etc/init.d/postfix restart

1	/etc/init.d/postfix restart

To test DMARC we need to send email from our server to external server that support DMARC and send it from there to us. For example GMail does support this.

In mail header there should be DMARC header. But remamber to delete debug header in configuration after checking if our configuration works alright:

#vim /etc/opendmarc.conf

#SoftwareHeader true

#vim /etc/opendmarc.conf

#SoftwareHeader true

Quick restart:

/etc/init.d/opendmarc restart

1	/etc/init.d/opendmarc restart

Rest post related to this topic:

Fight against spam part 2 – Postfix DKIM

DomainKeys Identified Mail (DKIM) – is an email authentication method designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain is authorized by that domain’s administrators. It is intended to prevent forged sender addresses in emails, a technique often used in phishing and email spam. – Wikipedia

This is a continuation of topic about fighting against spam when you are self-hosting your mail server which in this case should be Postfix.

Install needed packages:

#debian/ubuntu
apt-get install opendkim opendkim-tools

1 2	#debian/ubuntu apt-get install opendkim opendkim-tools

Let us configure opendkim, if 12301port is use by some other service change it in below configuration:

#vim /etc/opendkim.conf

OversignHeaders         From
AutoRestart             Yes
AutoRestartRate         10/1h
UMask                   002
Syslog                  yes
SyslogSuccess           Yes
LogWhy                  Yes

Canonicalization        relaxed/simple

ExternalIgnoreList      refile:/etc/opendkim/TrustedHosts
InternalHosts           refile:/etc/opendkim/TrustedHosts
KeyTable                refile:/etc/opendkim/KeyTable
SigningTable            refile:/etc/opendkim/SigningTable

Mode                    sv
PidFile                 /var/run/opendkim/opendkim.pid
SignatureAlgorithm      rsa-sha256

UserID                  opendkim:opendkim

Socket                  inet:12301@localhost

#vim /etc/opendkim.conf

OversignHeaders From

AutoRestart Yes

AutoRestartRate 10/1h

UMask 002

Syslog yes

SyslogSuccess Yes

LogWhy Yes

Canonicalization relaxed/simple

ExternalIgnoreList refile:/etc/opendkim/TrustedHosts

InternalHosts refile:/etc/opendkim/TrustedHosts

KeyTable refile:/etc/opendkim/KeyTable

SigningTable refile:/etc/opendkim/SigningTable

Mode sv

PidFile /var/run/opendkim/opendkim.pid

SignatureAlgorithm rsa-sha256

UserID opendkim:opendkim

Socket inet:12301@localhost

#vim /etc/default/opendkim

SOCKET="inet:12301@localhost"

#vim /etc/default/opendkim

SOCKET="inet:12301@localhost"

Add support for this tool inside postfix:

#vim /etc/postfix/main.cf

milter_protocol = 2
milter_default_action = accept

smtpd_milters = inet:localhost:12301
non_smtpd_milters = inet:localhost:12301

#vim /etc/postfix/main.cf

milter_protocol = 2

milter_default_action = accept

smtpd_milters = inet:localhost:12301

non_smtpd_milters = inet:localhost:12301

If we already have something in lines smtpd_milters i/lub non_smtpd_milters we can add new tools after comma.

Create needed folders and configuration files, which we used as table source in configuration above:

mkdir -p /etc/opendkim/keys

#vim /etc/opendkim/TrustedHosts

127.0.0.1
localhost
192.168.0.1/24
*.example.com


#vim /etc/opendkim/KeyTable

mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private

#vim /etc/opendkim/SigningTable

example.com mail._domainkey.example.com

mkdir -p /etc/opendkim/keys

#vim /etc/opendkim/TrustedHosts

127.0.0.1

localhost

192.168.0.1/24

*.example.com

#vim /etc/opendkim/KeyTable

mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/mail.private

#vim /etc/opendkim/SigningTable

example.com mail._domainkey.example.com

Let us generate keys to use with DKIM:

mkdir /etc/opendkim/keys/example.com
cd /etc/opendkim/keys/example.com
opendkim-genkey -s mail -d example.com
chown opendkim:opendkim mail.private

mkdir /etc/opendkim/keys/example.com

cd /etc/opendkim/keys/example.com

opendkim-genkey -s mail -d example.com

chown opendkim:opendkim mail.private

Now we need to add proper key to TXT record in our DNS server:

cat /etc/opendkim/keys/example.com/mail.txt

#bind9
mail._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=VALUE_THAT_WE_GO_FROM_CAT_COMMAND_ABOVE"

cat /etc/opendkim/keys/example.com/mail.txt

#bind9

mail._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=VALUE_THAT_WE_GO_FROM_CAT_COMMAND_ABOVE"

We need to restart every service that we just edit configuration file:

service postfix restart
service opendkim restart
service bind9 restart

service postfix restart

service opendkim restart

service bind9 restart

To ensure we configure this properly the best way would be send email to service that check this for us, for example: check-auth(at)verifier.port25.com

Rest post related to this topic:

Fight against spam part 1 – Postfix SPF

Sender Policy Framework (SPF) – is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain’s administrators. The list of authorized sending hosts for a domain is published in the Domain Name System (DNS) records for that domain in the form of a specially formatted TXT record. – Wikipedia

I assume you have working postfix server already. Also I assume that you follow guide that have been posted here Postfix i Dovecot – perfect duo for mail server which use Debian/Ubuntu to achieve that.

Install needed package:

#debina/ubuntu
apt-get install postfix-policyd-spf-python

1 2	#debina/ubuntu apt-get install postfix-policyd-spf-python

Default configuration that is present in package give us almost complete implementation we need to tweak it a bit to make it perfect:

#vim /etc/postfix-policyd-spf-python/policyd-spf.conf

#  For a fully commented sample config file see policyd-spf.conf.commented

debugLevel = 1
defaultSeedOnly = 1

HELO_reject = False
Mail_From_reject = False

PermError_reject = False
TempError_Defer = False

skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

#vim /etc/postfix-policyd-spf-python/policyd-spf.conf

# For a fully commented sample config file see policyd-spf.conf.commented

debugLevel = 1

defaultSeedOnly = 1

HELO_reject = False

Mail_From_reject = False

PermError_reject = False

TempError_Defer = False

skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/104,::1

Let postfix know that we use more anti-spam technics:

#vim /etc/postfix/main.cf

policy-spf_time_limit = 3600s

smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policy-spf

#vim /etc/postfix/main.cf

policy-spf_time_limit = 3600s

smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination,check_policy_service unix:private/policy-spf

#vim /etc/postfix/master.cf

policy-spf  unix  -       n       n       -       -       spawn
     user=nobody argv=/usr/bin/policyd-spf

#vim /etc/postfix/master.cf

policy-spf unix - n n - - spawn

user=nobody argv=/usr/bin/policyd-spf

We need to restart postfix to make thise work

/etc/init.d/postfix restart

1	/etc/init.d/postfix restart

Rest post related to this topic: