Rspamd


1. Rspamd

★

IMPORTANT:
This is not written by AI. When we were testing this we used AI to try and configure it and it got it badly wrong. We have noted this to be a trend and are encountering more and more AI documentation that is just pure nonsense. We are
now marking ALL our hand written documentation as not AI generated. This does not mean that it is guarantee to work as that is dependent on the version and your base configuration, it is simply an informative
statement and like much of the hand crafted documentation on the internet, we can only guarantee that it works on our own equipment.

We are using Rspamd to replace spamassassin as it is written in C and easier to configure.  These are the steps required to get it working.

⚠

WARNING:
This documentation assumes that you have an operational email server.

1.2 Installation

# apt-get install rspamd redis-server

1.3 Configure

1.3.1 Configure redis-server

The conriguration file for redis server is /etc/redis/redis.conf and is well documented however there are a couple of parameters you may need to change in order to get it working.

The first one is bind which we configured on the internal interface in order to get it to run.

bind 192.168.0.254 #or whatever your local interface is

ℹ

NOTE:
Most doucmentation implies that you should configure this to 127.0.0.1 however we could never get it to start and so we explicitly ran it on the internal interface.

Other than that we just turned protected mode off (this should not be a problem as neitehr redis nor its ports are open to the internet). 

protected-mode no

That should be all there is to redis other than to enable and start the service.

systemctl enable redis-server
systemctl start redis-server

ℹ

IMPORTANT:
If you run into issues then redis server has its own logging. The log is located at /var/log/redis/redis-server.log

1.3.2 Configure rspamd

rspamd itself has a handful of configuration files that it needs in order to operate correctly

★

IMPORTANT:
All rspamd configuration files must be saved in /etc/rspamd/local.d/ You should not edit existing rspamd configuration files in other locations.

1.3.2.1 redis.conf

/etc/rspamd/local.d/redis.conf (not to be confused with the redis.conf file mentioned in 1.3.1 Configure redis-server) is where we tell rspamd how to talk to
redis-server and is a simple one liner referencing the ip and port declared in the /etc/rspamd/local.d/redis.conf file. 

servers = "192.168.0.254:6379"; #or whatever your server ip is

1.3.2.2 actions.conf

A very basic actions configuration (taken from the rspamd documentation) is

# Basic action thresholds
reject = 15;        # Reject obvious spam
add_header = 6;     # Add spam headers
greylist = 4;       # Temporary delay suspicious mail

1.3.2.3 worker-controller.inc

This file configures the web interface that gives you all of the statistics etc.

Before you set it up you need to create a hashed password using the rspamadm utility

rspamadm pw

And follow the instructions to generate your password.

Copy the long string generated as you will need this for the next steps.

Now create a file called worker-controller.inc and add the following

password = "your-long-password-string-saved-from-the-previous-step";
# Listen on the server's LAN IP
bind_socket = "192.168.0.254:11334" #replace with your own local ip

# Explicitly restrict web UI access to your desktop IP only
secure_ip = "162.168.0.2" #replace with the explicit ip of your desktop client
allow_local = false

In this file we tell rspamd that we are only allowing a single ip on our lan to access the interface

1.3.2.4 milter_headers.conf

Unlike spamassassin, rspamd does not attach the spam status headers by default unless it finds something that it considers to be spam however we prefer to have them in all instances as for a tiny bit of overhead it vastly simplifies
debugging. In order to do this you need to create a milter_headers.conf file and add the following 

# Define which standard header routines to run
use = ["x-spamd-result", "x-spam-status", "x-spam-level"];

# Force headers to be added to clean/ham messages, not just spam
always_add = true;

# Optional: Also add them for local or authenticated senders if desired
skip_local = false;
skip_authenticated = false;

1.3.2.5 worker-proxy.inc

The final configuration file enables the milter for intergration with Postfix and simply contains the following 

milter = yes;
timeout = 120s;
upstream "local" {
  default = yes;
  self_scan = yes;  # Scan messages directly
}

1.3.2.6 Final Steps

All that remains now is to enable and start the rspamd daemon 

systemctl enable rspamd
systemctl start rspamd

ℹ

Note:
If you encouter issues rspamd also has its own log, located at /var/log/rspamd/rspamd.log

You should now be able to connect to your interface on the client that you set in your worker-controller.inc configuration file by navigating to 

http://192.168.0.254:11334/ #replace with your own ip

in a browser

⚠

WARNING:
The connection is not secure as it uses basic http. Use it with caution or secure it behind a reverse proxy. This is just for initial configuration and testing.

1.3.3 Configure Postfix

All that is left to do is hook it into postfix. If you have a previous spamassassin configuration then it will probably look like 

smtpd_milters = unix:spamass/spamass.sock inet:localhost:8891

To switctch to rspamd simply remove unix:spamass/spamass.sock and replace it with 

inet:162.168.1.254:11332 #change to your server's local ip

★

IMPORTANT:
Make sure you only remove references to spamassassin, you may likely have a reference to open DKIM on the same line like the example above.

Our configuration was

smtpd_milters = inet:172.17.1.22:11332, inet:localhost:8891
non_smtpd_milters = inet:172.17.1.22:11332, inet:localhost:8891
milter_default_action = accept
milter_protocol = 6

And that should be it; restart postfix and test everything by looking in the headers and checking the logs

Filed under: Debian Server - @ 8:10 pm