DSPAM: setting up with Postfix/Dovecot in Ispconfig3 environment

Today’s mail servers, when set up correctly, are able to filter out almost all the spam directed at our e-mail inboxes.

But for every defensive measure adopted there is a world of idlers who enjoy setting up ever more aggressive and penetrating countermeasures.

The best system for fighting spam is us, and if our system could learn from us wouldn’t that be great?!
A tool like DSPAM makes it possible to “train” our mail system so that it can recognize unwanted mail.

The cornerstone premise is the environment in which we will operate: Ispconfig3 (our server is based on The Perfect Server – Debian Wheezy)

I will explain how to:

• install DSPAM and configure it to work with Postfix and Dovecot;
• train DSPAM through the dovecot-antispam plugin.

Let’s install

apt-get install dspam libdspam7-drv-mysql dovecot-antispam

When creating the MySql DB, just let dbconfig take care of it.

First let’s integrate Postfix. Add the following lines to /etc/postfix/master.cf

dspam     unix  -       n       n       -       10      pipe
  flags=Rhqu user=vmail argv=/usr/bin/dspam --deliver=innocent,spam --user $recipient -i -f $sender -- $recipient

in /etc/postfix/main.cf the highlighted lines

...
smtpd_client_restrictions =
	permit_mynetworks,
	permit_sasl_authenticated,
	reject_unknown_client_hostname,
	check_client_access mysql:/etc/postfix/mysql-virtual_client.cf,
	reject_rbl_client cbl.abuseat.org,
	reject_rbl_client b.barracudacentral.org,
	reject_rbl_client bl.spamcop.net,
	reject_rbl_client psbl.surriel.com,
	pcre:/etc/postfix/dspam_filter_access
...
#DSPAM
dspam_destination_recipient_limit = 1

Create the file /etc/postfix/dspam_filter_access with this content

/./   FILTER dspam:unix:/var/run/dspam/dspam.sock

Now take care of the file /etc/dspam/dspam.conf

Home /var/spool/dspam
StorageDriver /usr/lib/i386-linux-gnu/dspam/libmysql_drv.so
TrustedDeliveryAgent "/usr/sbin/sendmail"
UntrustedDeliveryAgent "/usr/lib/dovecot/deliver -d %u"
OnFail error
Trust root
Trust dspam
Trust mail
Trust postfix
Trust vmail
Trust dovecot
Trust dovenull
TrainingMode teft
TestConditionalTraining on
Feature whitelist
Feature tb=5
Algorithm graham burton
Tokenizer osb
Pvalue bcr
WebStats on
Preference "trainingMode=TEFT"
Preference "spamAction=tag"
Preference "spamSubject=[SPAM]"
Preference "signatureLocation=headers"
Preference "statisticalSedation=5"
Preference "enableBNR=on"
Preference "enableWhitelist=on"
Preference "showFactors=off"
Preference "whitelistThreshold=20"
Preference "processorBias=on"
Preference "trainPristine=off"
PurgeSignatures 14
PurgeNeutral	90	# Tokens with neutralish probabilities
PurgeUnused	90	# Unused tokens
PurgeHapaxes	30	# Tokens with less than 5 hits (hapaxes)
PurgeHits1S	15	# Tokens with only 1 spam hit
PurgeHits1I	15	# Tokens with only 1 innocent hit
SystemLog	on
UserLog		on
Opt out
TrackSources spam nonspam
ProcessorURLContext on
ProcessorBias on
StripRcptDomain off
Debug *
DebugOpt process spam fp inoculation corpus
ParseToHeaders on
ChangeModeOnParse on
ChangeUserOnParse full
Broken case
ServerPID /var/run/dspam/dspam.pid
ServerDomainSocketPath "/var/run/dspam/dspam.sock"
ClientHost /var/run/dspam/dspam.sock
Include /etc/dspam/dspam.d/

The IgnoreHeader and AllowOverride directives have been placed in two separate files inside the /etc/dspam/dspam.d/ folder

Before moving on to the file /etc/dovecot/dovecot.conf, let’s create two folders

mkdir -pv /etc/sieve/conf.d/before
mkdir -pv /etc/sieve/conf.d/after

Create the file /etc/sieve/conf.d/before/spam-folder.sieve with the following content, make sure it is owned by the user:group vmail, and compile it for sieve

require ["regex", "fileinto", "imap4flags"];

# Catch mail tagged as Spam, except Spam retrained and delivered to the mailbox
if allof (header :regex "X-DSPAM-Result" "^(Spam|Virus|Bl[ao]cklisted)$",
          not header :contains "X-DSPAM-Reclassified" "Innocent") {

  # Mark as read
  setflag "\Seen";

  # Move into the Junk folder
  fileinto "Spam";

  # Stop processing here
  stop;
}

chown -R vmail:vmail /etc/sieve/*
sievec /etc/sieve/conf.d/before/

Now it’s Dovecot’s turn. Now on to /etc/dovecot/dovecot.conf

...
protocol imap {
  mail_plugins = quota imap_quota antispam
}
...
plugin {
  quota = dict:user::file:/var/vmail/%d/%n/.quotausage
  sieve=/var/vmail/%d/%n/.sieve
  sieve_extensions = +spamtest +spamtestplus +relational +comparator-i;ascii-numeric
  sieve_before = /etc/sieve/conf.d/before
  sieve_after = /etc/sieve/conf.d/after
  # Antispam (DSPAM)
  antispam_backend = dspam
  antispam_signature = X-DSPAM-Signature
  antispam_signature_missing = error
  antispam_trash = trash;Trash;Deleted Items;Deleted Messages
  antispam_spam = Spam;Junk;Indesiderata
  antispam_allow_append_to_spam = yes
  antispam_dspam_binary = /usr/bin/dspam
  antispam_dspam_args = --deliver=;--user;%u
  antispam_dspam_result_header = X-DSPAM-Result
  antispam_dspam_result_blacklist = Virus
  antispam_dspam_spam = --class=spam
  antispam_dspam_notspam = --class=innocent
  #antispam_debug_target = syslog
  #antispam_verbose_debug = 1
}

Let’s fix owners and permissions on some files and directories

chgrp vmail /etc/dspam/dspam.conf
chgrp vmail /var/log/dspam
chmod g+w /var/log/dspam
chgrp vmail /etc/dspam/dspam.d/*
chgrp -R vmail /var/spool/dspam

And now: It’s show time! Let’s restart the services and check that everything works (edit the file /etc/default/dspam changing START from ‘no’ to ‘yes’ to allow the daemon to start)

/etc/init.d/dovecot restart
/etc/init.d/postfix restart
/etc/init.d/dspam start

From now on, if any spam should arrive in your Inbox, all you have to do is move it into Spam/Junk so that the system learns from you. Conversely, if by mistake a clean message ends up in Spam/Junk, move it to the Inbox.

WARNING: I said the system will learn from you, so give it time and rest assured it won’t let you down!!!