andr3w.net » email

Updated .mailfilter for Courier Maildrop and SpamAssassin

Andrew — Mon, 27 Apr 2009 05:18:50 +0000

My spam count has exploded in the last few days, so I made a decision to adjust my filtering a little more.

Previously, all messages that got more than 5 points in SpamAssassin tests were flagged and sent to my .Spam folder. This got to be a bit of an issue as I still check there to make sure that no emails are miscategorized… Call me crazy, but I’m a bit anal when it comes to that stuff. (I missed an interview because of Gmail’s filters, but that’s a story for another day).

For the last few days, I’ve been reviewing the spam counts for both the more cleverly hidden spam and the less-than-clever spam. I’ve come to realize that while the odds are low that any real emails will get marked as spam if they do they’ll definitely get a score less than 10. So to combat the large amount of spam that’s now coming through, emails with greater than 10 points will now be sent directly to the trash.

Here’s what I put in my .mailfilter file for courier-maildrop:

1
2
3
4
5
6
7
8
9

if ( /^X-Spam-Level: \*\*\*\*\*\*\*\*\*.*$/ )
{
exit
}

if ( /X-Spam-Flag/ )
{
to "$DEFAULT.Spam"
}

This way, anything that gets more than won’t even be delivered, and all other emails that get a spam flag (greater than 5 points) get sent to spam, then the rest of my filters are processed.

Tested the email with the GTUBE and with a normal message and it seems to work, but we’ll see if I wake up in the morning and all my email has been dumped in the trash can.

Configuring Postfix, Courier, and Courier-Maildrop for Virtual Users

Andrew — Mon, 23 Mar 2009 19:08:46 +0000

Here are some highlights for configuring Postfix to use Courier-Maildrop for local delivery.

This allows some advantages over just having postfix deliver, because you can do server-side filtering of spam and mailing list messages to de-clutter your inbox.

All these notes are based on configuring the setup on Ubuntu 8.10 (Intrepid Ibex) with Debian Lenny’s courier-maildrop

The following are snippets from my configuration files, highlighting the changes that I had to make, from an already existing mail server. If these look unfamiliar, or you need more assistance setting up the basic framework of a Postfix + Courier-IMAP mail server, start here.

1
2
3
4
5
6
7

#/etc/courier/maildroprc
EXTENSION="$1"
RECIPIENT=tolower("$2")
USER="$3"
HOST="$4"
SENDER="$5"
DEFAULT="/home/vmail/$HOST/$USER/."

1
2
3

#/etc/postfix/main.cf
virtual_transport = maildrop
maildrop_destination_recipient_limit = 1

1
2
3

#/etc/postfix/master.cf
maildrop unix - n n - - pipe
flags=ODRhu user=vmail argv=/usr/bin/maildrop -w 90 -d ${user}@${nexthop} ${extension} ${recipient} ${user} ${nexthop}

So if you have a working mail server: make these changes, sudo /etc/init.d/postfix restart, and then get to work writing your .mailfilters!

Intrepid’s courier-maildrop and authlib

Andrew — Mon, 23 Mar 2009 18:29:27 +0000

Ubuntu 8.10′s courier-maildrop is not compiled against courier-authlib and so cannot read from many of the supported authentication schemes that authlib can support.

Fortunately, Debian Lenny’s can. So if you’re having trouble you can try and install the package from that distribution, YMMV.

To save you the effort of going out and locating it, I’ll attach a version of it here. Use it at your own risk, but it’s working for me.

courier-maildrop_0600-2_amd64

Migrating Email Server

Andrew — Sat, 21 Mar 2009 23:09:38 +0000

Here are the steps that I went through to migrate my Postfix/Courier server from Slicehost to Mosso.

Check current DNS MX records for applicable domains. I had mine set to all go through a central A record (my mail server) so it was easy.
Set MX records to expire quickly (I think the minimum is 60 minutes). This can take 24 hours to propogate, so do this early, and then you’ll have time to do the rest of the processing.
Configure Postfix/Courier/IMAP as desired on new server. There are a lot of howtos on this, and some hints on this site, so I won’t go over how to do this here.
Test server to ensure that email can go in and out and that any spam filtering or other processes are operating well.
I use MySQL for managing users and forwardings, so I dumped and locked my existing database, and copied that to the new database.
Rsync maildirs over from the old server to the new server. This can take a while, depending on server speed and bandwidth.
Ensure that Postfix and Courier are up and running on the new server.
Change central DNS record to point to new server IP address.
Stop Postfix and Courier on old server. This could lead to a couple of bounced emails, but in all likelihood the sending email servers will retry and find their way to the new server.
Watch closely.

There should be very little loss of email, connectivity, or data using this path.

If anyone has any better suggestions, let me know.

Configuring Spamassassin as a Daemon on Ubuntu Intrepid

Andrew — Fri, 20 Mar 2009 22:10:37 +0000

Here is the process I took to install Spamassassin as a daemon working with Postfix to process incoming mail.

I’ll also be trying to reduce the memory footprint while still getting acceptable performance. Mind you, this is being implemented on a low volume server, so these settings may not be applicable to a production server with lots of users.

First, let’s do some prep work

1
2
3
4
5

$ sudo aptitude install spamassassin spamc
$ sudo groupadd -u 5001 spamd
$ sudo useradd -u 5001 -g spamd -s /sbin/nologin -d /var/lib/spamassassin spamd
$ sudo mkdir /var/lib/spamassassin
$ sudo chown spamd:spamd /var/lib/spamassassin

Now edit /etc/default/spamassassin and change the lines below

1
2
3
4

# /etc/default/spamassassin
ENABLED=1
SAHOME="/var/lib/spamassassin"
OPTIONS="--create-prefs --max-children 2 --username spamd -H ${SAHOME}"

Edit /etc/spamassassin/local.cf

1
2
3
4
5
6
7
8

ENABLED=1
rewrite_header Subject **SPAM _SCORE_**
required_score 5.0
use_bayes 1
bayes_auto_learn 1
use_dcc 0
use_pyzor 0
use_razor2 0

Now edit /etc/postfix/master.cf and change it to look like this:

1
2
3
4
5
6
7
8
9

# /etc/postfix/master.cf
26 inet n - - - - smtpd
-o content_filter=spamassassin

# Add this segment to end of file
# Spamassassin processing filter
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}

Now reboot some stuff

1 2	$ sudo /etc/init.d/spamassassin restart $ sudo postfix reload

Now test by sending email to yourself. If you view the full headers it should now have X-SPAM headers in it.

If you send an email with “XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X” in the body of the email, it is guaranteed to be flagged as SPAM, and is a great way to test your spam filter.

Courier IMAP SSL Certificate Issues

Andrew — Fri, 20 Mar 2009 19:05:53 +0000

If you are having issues getting an SSL connection to Courier IMAP. Check your certificate files.

1 2	# In /etc/courier/imapd-ssl TLS_CERTFILE=/etc/ssl/private/certificate.pem

Courier is expecting a PEM file for TLS_CERTFILE with your certificate and private key. Do not use just your certificate.

Also, if you require intermediate certificates to complete the trust chain, you can include them in this file.

MAKE SURE that you have proper permissions on this file to the security of your private key.

Make Postfix Listen to Multiple Ports

Andrew — Fri, 20 Mar 2009 19:01:49 +0000

If you need postfix to listen on multiple ports (like I do) add lines like the following (replace numbers with whatever ports you desire):

1
2
3

# In /etc/postfix/master.cf
25 inet n - - - - smtpd
26 inet n - - - - smtpd

Make sure to open the ports in iptables as well.