1 Topic by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Topic: Some thoughts and wishes

==== Required information ====
- iRedMail version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Linux/BSD distribution name and version:
- Related log if you're reporting an issue:
======== Required information ====
- iRedMail version: 1.9.2
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Linux/BSD distribution name and version: CentOS 6.6
- Related log if you're reporting an issue:
====

Hi,

I'm with iRedAdmin-Pro almost two months and I'm very impressed with it. I must recognize that I was very afraid to begin to build my own mail server but our growing business and an importance of reliable mail flow make me start looking in different mail solutions. As our main WebGUI we use old free Google App but we have a lot of mails from our clients to many our domain names. An absence of full mail logs made me blind. So when I found iRedMail and tried it I was very impressive how easy it was to install and setup it for an immediate start of using. So now I moved to my iRedMail server all important mail flow and I see all mail logs, I can find a reason for non-delivery of mails. iRedAdmin-Pro shows me all blocked spam messages in nice WebGUI and allows to release good ones. Default settings of spam filters are very good and I didn't see many false positives and during two months I released just 5-10 messages.
Yes, I did some manual editing of amavisd.conf to block some spam messages according to recipient patterns, also I found a file /etc/mail/spamassassin/local.cf where I started to add some blacklist for subjects. But main job for any mail server is a setup of all these anti-spam systems to work together. And iRedMail already did this! You have a working system in 10 minutes with all standard, enterprise-ready, components (Postfix, Amavisd-New, Spamassasin) working together that you can fine-tune for your needs just by searching internet for ready solutions.
I have iRedAdmin-Pro window opened all the time to check blocked mails because it's important for us, I have Nagios that checks a length of a  mail queue to react quickly on any possible issues like Gmail rate-limit.
So I recommend this system to everyone and buy iRedAdmin-Pro because it's very quick WebGUI that has almost everything you need for everyday work.

Now just some wishes fro future updates:
1. When I want to add many aliases it will be good to have Save and Create button or may be a possibility to import text file for bulk adding
2. I have Delete and Add to blacklist feature but I don't have Delete and Add to whitelist. It will be convenient for me to add my clients' mail addresses in whitelist from Sent Mails screen.
3. Using of wildcard in white/black lists with domain names. Spammers use similar domain names, for example, @.xmass2015a.com, @.xmass2015b.com, @.xmass2015c.com, @.xmass2015d.com, to send spam and now I need to add each found domain name. It will good to simply add @.xmass*.com or even @*xmass* to the blacklist.

Thank you for all your efforts to bring to us such a quality solution.
Regards,
Roman

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by 7t3chguy

  • 7t3chguy
  • 7t3chguy
  • Forum Moderator
  • Offline
  • From: United Kingdom
  • Registered: 2015-01-08
  • Posts: 713

Re: Some thoughts and wishes

3. I'm not sure amavis supports wildcards. But I'll look into it for you. If it doesn't, then there's not much we can do. I guess we could add support to the amavis iredapd plugin but then it'd reject the mails and not quarantine them. (during smtp session not post queue)

7t3chguy's Website

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: Some thoughts and wishes

romanmm wrote:

1. When I want to add many aliases it will be good to have Save and Create button or may be a possibility to import text file for bulk adding

Bulk importing is planned, but not high priority. sorry about this, will add it in future release.

romanmm wrote:

2. I have Delete and Add to blacklist feature but I don't have Delete and Add to whitelist. It will be convenient for me to add my clients' mail addresses in whitelist from Sent Mails screen.

Do you mean delete/add to whitelist in Quarantined Mails page?

romanmm wrote:

3. Using of wildcard in white/black lists with domain names. Spammers use similar domain names, for example, @.xmass2015a.com, @.xmass2015b.com, @.xmass2015c.com, @.xmass2015d.com, to send spam and now I need to add each found domain name. It will good to simply add @.xmass*.com or even @*xmass* to the blacklist.

You'd better achieve this with Postfix header_checks with pcre regular expression.

It's not convenience to achieve this with SQL db:

*) White/Blacklists are stored in SQL database, mainly `amavisd.mailaddr` (addresses) and `amavisd.wblist` (relationship about whitelist or blacklist).

*) With upcoming iRedAdmin-Pro release, it's able to use 'username@*' as white/blacklist senders, but still doesn't support wildcard like the one you requested. The problem is that it's not convenience to query matched white/blacklist stored in SQL db.

For example, sender 'user@xmass2015b.com', how do you query a matched wblist (with wildcard in domain name part) stored in SQL db? it could be:

- @x*
- @xm*
- @xma*
- @xmas*
...

Also:

- @*mass*
- @*2015*

Too many possibilities. But it's too easy to do this with a pcre regular expression, for example:

/\@.*xmass.*/ REJECT you are spam

4 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

Hi,

Thanks for the answers.

2. No, I meant Delete/Add to whitelist in Sent mails. It will allow me to add my good senders in white list.
3. So I uncommented this row in /etc/postfix/main.cf:
header_checks = pcre:/etc/postfix/header_checks

Then I created a file /etc/postfix/header_checks and added the row like:
/\@.*safon.*/ REJECT you are spam

service postfix restart

As I undertood I don't need to postman pcre files.
And then tried to send mail from my mail that contains safon word inside but mail passed.
Can you tell me where is my mistake?

And one more: I don't see X-Spam etc. headers inside mails that I receive.
May be it's because I added all my domains in @local_domains_maps variable?

Just to be clear: I use iRedMail just to forward all mails to Google Apps.

Thanks in advance,
Roman

5 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: Some thoughts and wishes

You should specify the mail header. For example:

/^From:.*\@.*safon.*/ REJECT you are spam

6 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

Thanks, it works.

ZhangHuangbin wrote:

You should specify the mail header. For example:

/^From:.*\@.*safon.*/ REJECT you are spam

7 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

One more proposition for this way to block spammers.
In the same /etc/postfix/header_checks file we can use DISCARD to claim a successful delivery to a spammer and discard the message:

/^From:(.*user.*\@.*)/ DISCARD discarding a message from $1
/^From:(.*\@.*domain.*)/ DISCARD discarding a message from $1

So in this case the spammer are sure that the message was delivered, Postfix discarded it and wrote a row in its log about discarding the message with pointing to the sender address and IP of his server. So it can be useful for logwatch or fail2ban, for example, to log parsing. Example of log message:

Apr 25 09:25:47 postfix/cleanup[21836]: 3DA7240343: discard: header From: xxx yyy <susern@xxx.com> from nk11p07mm-asmtpout002.xxx.com[1.1.2.2]; from=<susern@xxx.com> to=<bbb@bbb.com> proto=ESMTP helo=<nk11p07mm-asmtp002.xxx.com>: discarding a message from  xxx yyy <susern@xxx.com>

8 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

One more question:
I see that some mails come to Google Apps without X-Spam headers. Which parameter does control this behavior?

9 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: Some thoughts and wishes

romanmm wrote:

In the same /etc/postfix/header_checks file we can use DISCARD to claim a successful delivery to a spammer and discard the message:

Sure you can, it's all up to you.

romanmm wrote:

I see that some mails come to Google Apps without X-Spam headers. Which parameter does control this behavior?

Check our tutorial:
http://www.iredmail.org/docs/no.x-spam.headers.html

10 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

Hi, I have such a row:

$sa_tag_level_deflt  = undef;  # Any message that is addressed to a recipient that is considered local will have X-Spam-Status, X-Spam-Score and X-Spam-Level headers added

As I understand, this is the same as -999. And I have all my domains in @local_domains_maps.

So may be there is another reason?

11 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: Some thoughts and wishes

'undef' means not defined, it's not same as '-999'.

12 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

ZhangHuangbin wrote:

'undef' means not defined, it's not same as '-999'.

Ok, thanks, I will check this with -999.

13 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

Hi,
Sorry, but no changes. May be this is because of forwarding to another domain that is not the local one?

14 Reply by 7t3chguy

  • 7t3chguy
  • 7t3chguy
  • Forum Moderator
  • Offline
  • From: United Kingdom
  • Registered: 2015-01-08
  • Posts: 713

Re: Some thoughts and wishes

The server you are forwarding to may be stripping the headers from the e-mail.

7t3chguy's Website

15 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

7t3chguy wrote:

The server you are forwarding to may be stripping the headers from the e-mail.

It's gmail server and I look at mail source.

16 Reply by 7t3chguy

  • 7t3chguy
  • 7t3chguy
  • Forum Moderator
  • Offline
  • From: United Kingdom
  • Registered: 2015-01-08
  • Posts: 713

Re: Some thoughts and wishes

GMail may be removing those headers for security purposes.

7t3chguy's Website

17 Reply by romanmm

  • romanmm
  • Member
  • Offline
  • Registered: 2015-01-29
  • Posts: 31

Re: Some thoughts and wishes

7t3chguy wrote:

GMail may be removing those headers for security purposes.

Ok. Thanks, I will monitor this issue.