1

Topic: lots of spam

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.5-1
- Linux/BSD distribution name and version: ubuntu 16
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Web server (Apache or Nginx):apache
- Manage mail accounts with iRedAdmin-Pro? yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hey everybody,
seems like my iredmail server getting tons of spam and giving everything really low score.
for example:

May 16 23:02:08 i2 amavis[17180]: (17180-12) Passed SPAM {RelayedInbound}, [192.99.125.118]:51069 [192.99.125.118] <survivalist.community@hipies.net> -> <my@mail.com>, Queue-ID: 16F075FEEF, Message-ID: <Z6.Wey08lg.8Z8mQaRVNL7zw0pY@peace.hipies.net>, mail_id: uESt3wNX4hvb, Hits: 0.01, size: 39299, queued_as: C91AB65E4A, 1062 ms, Tests: [HTML_MESSAGE=0.001,SPF_HELO_PASS=-0.001,SPF_PASS=-0.001,T_KAM_HTML_FONT_INVALID=0.01,URIBL_BLOCKED=0.001]
May 16 23:02:08 i2 postfix/smtp[18450]: 16F075FEEF: to=<my@mail.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.9, delays=0.81/0/0/1.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as C91AB65E4A)

i dont understang why "URIBL_BLOCKED" gets so slow score if this domain listed in uribl?

im also using policy from amavis database:


id    2
policy_name    Antispam Policy
virus_lover    N
spam_lover    Y
unchecked_lover    Y
banned_files_lover    N
bad_header_lover    Y
bypass_virus_checks    N
bypass_spam_checks    N
bypass_banned_checks    N
bypass_header_checks    N
virus_quarantine_to    NULL
spam_quarantine_to    NULL
banned_quarantine_to    NULL
unchecked_quarantine_to    NULL
bad_header_quarantine_to    NULL
clean_quarantine_to    NULL
archive_quarantine_to    NULL
spam_tag_level    3
spam_tag2_level    3
spam_tag3_level    3
spam_kill_level    0
spam_dsn_cutoff_level    0
spam_quarantine_cutoff_level    0
addr_extension_virus    NULL
addr_extension_spam    NULL
addr_extension_banned    NULL
addr_extension_bad_header    NULL
warnvirusrecip    NULL
warnbannedrecip    NULL
warnbadhrecip    NULL
newvirus_admin    NULL
virus_admin    NULL
banned_admin    NULL
bad_header_admin    NULL
spam_admin    NULL
spam_subject_tag    NULL
spam_subject_tag2    NULL
spam_subject_tag3    NULL
message_size_limit    NULL
banned_rulenames    NULL
disclaimer_options    NULL
forward_method    NULL
sa_userconf    NULL
sa_username    NULL

my spamassassin local.cf file:

required_score      5.0
rewrite_header      subject [ SPAM ]

report_safe         0
lock_method         flock

#
# Bayesian support
#
# References:
# - http://wiki.apache.org/spamassassin/BayesInSpamAssassin
# - http://svn.apache.org/repos/asf/spamass … ADME.bayes
# Addition plugin for Roundcube webmail to call sa-learn
# - http://www.tehinterweb.co.uk/roundcube/#pimarkasjunk2
#
use_bayes          1
bayes_auto_learn   1
bayes_auto_expire  1

# Store bayesian data in MySQL.
# Please make sure you have correct server address, port and database name.
#bayes_store_module Mail::SpamAssassin::BayesStore::MySQL
#bayes_sql_dsn      DBI:mysql:sa_bayes:127.0.0.1:3306

# Store bayesian data in PostgreSQL.
# Please make sure you have correct server address, port and database name.
#bayes_store_module Mail::SpamAssassin::BayesStore::PgSQL
#bayes_sql_dsn      DBI:Pg:sa_bayes:127.0.0.1:5432

# SQL username and password.
#bayes_sql_username db_username
#bayes_sql_password db_password

# Override the username used for storing data in the database.
# This could be used to group users together to share bayesian filter data.
# You can also use this config option to trick sa-learn to learn data as a specific user.
#bayes_sql_override_username vmail


# Turn off ALL DNSBL (DNS Blocklists)
#skip_rbl_checks  1
# Turn off DNSBL: rhsbl.ahbl.org.
# Check /usr/share/spamassassin/20_dnsbl_teest.cf to see the rule name.
score DNS_FROM_AHBL_RHSBL 0

score URIBL_AB_SURBL 0 0.3306 0 0.3812
score URIBL_JP_SURBL 0 0.3360 0 0.4087
score URIBL_OB_SURBL 0 0.2617 0 0.3008
score URIBL_PH_SURBL 0 0.2240 0 0.2800
score URIBL_SBL 0 0.1094 0 0.1639
score URIBL_SC_SURBL 0 0.3600 0 0.4498
score URIBL_WS_SURBL 0 0.1533 0 0.2140

score URIBL_ABUSE_SURBL 2.7

# Whitelist from SPF.
#whitelist_from_spf joe@example.com fred@example.com
#whitelist_from_spf *@example.com

# Whitelist from DKIM.
loadplugin Mail::SpamAssassin::Plugin::DKIM
whitelist_from_dkim *@paypal.com
whitelist_from_dkim *@linkedin.com
whitelist_from_dkim *@twitter.com
whitelist_from_dkim *@bounce.twitter.com

# Whitelist domains.
# Reference: http://wiki.apache.org/spamassassin/ManualWhitelist
#whitelist_from         *@gmail.com

# Locales.
ok_locales          all



what can i do to improve the spam detecting?

Thank you

raz

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: lots of spam

I think this might be your problem:

spam_lover    Y


this account loves spam which if you want to block it, should probably be set to N.

3

Re: lots of spam

raz wrote:

spam_lover    Y

As @stahr replied, with 'spam_lover=Y', although email was marked as spam, Amavisd still pipes to Postfix for delivery.

Did you manage this spam policy with iRedAdmin-Pro? Why it has "policy_name=Antispam Policy"? It should be '@.' for catch-all or a domain name (per-domain policy), or a email address (per-user policy).

4

Re: lots of spam

ZhangHuangbin wrote:
raz wrote:

spam_lover    Y

As @stahr replied, with 'spam_lover=Y', although email was marked as spam, Amavisd still pipes to Postfix for delivery.

Did you manage this spam policy with iRedAdmin-Pro? Why it has "policy_name=Antispam Policy"? It should be '@.' for catch-all or a domain name (per-domain policy), or a email address (per-user policy).

Hey zhang
Thank you for you answer.

i want spam to delivery into the mailbox. i use the dovecot.sieve file to move all the spam email into junk folder.

in this example of email the score was only "0.01"
and in my policy the spam tag is: "spam_tag_level    3"
i dont get it how in works.

why it says "Passed SPAM" if the score is only 0.01? is there another rule somewhere that stronger than amavis policy?

Thank you.

raz

5

Re: lots of spam

You didn't answer my question in previous reply, let me ask again:

Did you manage this spam policy with iRedAdmin-Pro? Why it has "policy_name=Antispam Policy"? It should be '@.' for catch-all or a domain name (per-domain policy), or a email address (per-user policy).

6

Re: lots of spam

Hey zhang,

No. its a spam policy that i created by myself.
and im using it per user.

7

Re: lots of spam

raz wrote:

No. its a spam policy that i created by myself.
and im using it per user.

I think your policy doesn't work at all.

It must be linked with sql table "amavisd.users", and column "policy.policy_name" must be either '@.', '@<domain>', '<full-email>'.

8

Re: lots of spam

are you sure?
i thought the link occurs with the users.policy_id column and policy.id column

9

Re: lots of spam

raz wrote:

are you sure?
i thought the link occurs with the users.policy_id column and policy.id column

users.policy_id is connected with "policy.id", this is correct. Do you have correct record in "users" table?
Also, in iRedAdmin-Pro, we set "policy_name" to either '@.', '@<domain>', '<full-email>'.

10

Re: lots of spam

Yes.
i have a row for each user with priority=10

11

Re: lots of spam

Please try to turn on debug mode in Amavisd, check log to see whether it correctly finds and applies your policy.