rspamadm pw<\/code><\/pre>\n<\/p><\/div>\n<\/p><\/div>\nAnd follow the instructions to generate your password.<\/p>\n
Copy the long string generated as you will need this for the next steps.<\/p>\n
Now create a file called worker-controller.inc<\/b> and add the following<\/p>\n\n
\n
password = \"your-long-password-string-saved-from-the-previous-step\";\r\n# Listen on the server's LAN IP\r\nbind_socket = \"192.168.0.254:11334\" #replace with your own local ip\r\n\r\n# Explicitly restrict web UI access to your desktop IP only\r\nsecure_ip = \"162.168.0.2\" #replace with the explicit ip of your desktop client\r\nallow_local = false\r\n<\/code><\/pre>\n<\/p><\/div>\n<\/p><\/div>\n\n In this file we tell rspamd that we are only allowing a single ip on our lan to access the interface\n <\/p>\n
1.3.2.4 milter_headers.conf<\/h4>\n
\n Unlike spamassassin, rspamd does not attach the spam status headers by default unless it finds something that it considers to be spam however we prefer to have them in all instances as for a tiny bit of overhead it vastly simplifies
\n debugging. In order to do this you need to create a milter_headers.conf<\/b> file and add the following\n <\/p>\n\n
\n
# Define which standard header routines to run\r\nuse = [\"x-spamd-result\", \"x-spam-status\", \"x-spam-level\"];\r\n\r\n# Force headers to be added to clean\/ham messages, not just spam\r\nalways_add = true;\r\n\r\n# Optional: Also add them for local or authenticated senders if desired\r\nskip_local = false;\r\nskip_authenticated = false;\r\n<\/code><\/pre>\n<\/p><\/div>\n<\/p><\/div>\n1.3.2.5 worker-proxy.inc<\/h4>\n
\n The final configuration file enables the milter for intergration with Postfix and simply contains the following\n <\/p>\n
\n
\n
milter = yes;\r\ntimeout = 120s;\r\nupstream \"local\" {\r\n default = yes;\r\n self_scan = yes; # Scan messages directly\r\n}\r\n<\/code><\/pre>\n<\/p><\/div>\n<\/p><\/div>\n1.3.2.6 Final Steps<\/h4>\n
\nAll that remains now is to enable and start the rspamd daemon\n<\/p>\n
\n
\n
systemctl enable rspamd\r\nsystemctl start rspamd<\/code><\/pre>\n<\/p><\/div>\n<\/div>\n\n
\u2139<\/span><\/p>\n\n
Note:<\/strong>
\n If you encouter issues rspamd also has its own log, located at \/var\/log\/rspamd\/rspamd.log<\/b>\n <\/div>\n<\/div>\n\nYou should now be able to connect to your interface on the client that you set in your worker-controller.inc<\/b> configuration file by navigating to\n<\/p>\n\n
\n
http:\/\/192.168.0.254:11334\/ #replace with your own ip<\/code><\/pre>\n<\/p><\/div>\n<\/div>\nin a browser<\/p>\n
\n
⚠<\/span><\/p>\n\n
WARNING:<\/strong>
\n The connection is not secure as it uses basic http. Use it with caution or secure it behind a reverse proxy. This is just for initial configuration and testing.\n <\/div>\n<\/div>\n1.3.3 Configure Postfix<\/h3>\n
\nAll that is left to do is hook it into postfix. If you have a previous spamassassin configuration then it will probably look like\n<\/p>\n
\n
\n
smtpd_milters = unix:spamass\/spamass.sock inet:localhost:8891\r\n<\/code><\/pre>\n<\/p><\/div>\n<\/div>\n\nTo switctch to rspamd simply remove unix:spamass\/spamass.sock<\/b> and replace it with\n<\/p>\n\n
\n
inet:162.168.1.254:11332 #change to your server's local ip<\/code><\/pre>\n<\/p><\/div>\n<\/div>\n\n
\u2605<\/span><\/p>\n\n
IMPORTANT:<\/strong>
\n Make sure you only remove references to spamassassin, you may likely have a reference to open DKIM on the same line like the example above.\n <\/div>\n<\/div>\nOur configuration was<\/p>\n
\n
\n
smtpd_milters = inet:172.17.1.22:11332, inet:localhost:8891\r\nnon_smtpd_milters = inet:172.17.1.22:11332, inet:localhost:8891\r\nmilter_default_action = accept\r\nmilter_protocol = 6\r\n<\/code><\/pre>\n<\/p><\/div>\n<\/div>\nAnd that should be it; restart postfix and test everything by looking in the headers and checking the logs<\/p>\n","protected":false},"excerpt":{"rendered":"
1. Rspamd \u2605 IMPORTANT: This is not written by AI. When we were testing this we used AI to try and configure it and it got it badly wrong. We have noted this to be a trend and are encountering more and more AI documentation that is just pure nonsense. We are now marking ALL […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-569","post","type-post","status-publish","format-standard","hentry","category-debian-server"],"_links":{"self":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=569"}],"version-history":[{"count":1,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/569\/revisions"}],"predecessor-version":[{"id":577,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/569\/revisions\/577"}],"wp:attachment":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=569"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=569"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}