more pages migrated

This commit is contained in:
Christoph Haas 2024-12-21 23:35:53 +01:00
parent 56776228b9
commit d01e984538
6 changed files with 129 additions and 13 deletions

View file

@ -10,6 +10,7 @@ export default defineConfig({
starlight({
lastUpdated: true,
title: "ISPmail Guide",
// https://expressive-code.com/key-features/word-wrap/#configuration
components: {
Footer: "./src/components/Footer.astro",
},

View file

@ -1,6 +1,6 @@
---
title: Catching spam with rspamd
lastUpdated: 2023-10-04
lastUpdated: 2024-12-21
slug: ispmail-bookworm/catching-spam-with-rspamd/
sidebar:
order: 190
@ -53,13 +53,9 @@ sendmail john@example.org < gtube.txt
Check your /var/log/mail.log. You will find something like this:
```
Jan 13 09:21:01 mail postfix/cleanup[19945]: 95B7A42212:
milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]:
5.7.1 Gtube pattern; from=<root@mail.example.org> to=<john@example.org>
Jan 13 09:21:01 mail postfix/cleanup[19945]: 95B7A42212: milter-reject: END-OF-MESSAGE from localhost[127.0.0.1]: 5.7.1 Gtube pattern; from=<root@mail.example.org> to=<john@example.org>
Jan 13 09:21:01 jen postfix/cleanup[19945]: 95B7A42212:
to=<john@example.org>, relay=none, delay=0.18,
delays=0.18/0/0/0, dsn=5.7.1, status=bounced (Gtube pattern)
Jan 13 09:21:01 jen postfix/cleanup[19945]: 95B7A42212: to=<john@example.org>, relay=none, delay=0.18, delays=0.18/0/0/0, dsn=5.7.1, status=bounced (Gtube pattern)
```
“milter-reject” tells that the milter (rspamd) recommended to Postfix to reject the email. It gave the reason “5.7.1 Gtube pattern”. In mail communication you often find these three digit codes. They are defined in [RFC 3463](https://tools.ietf.org/html/rfc3463). The first digit is most important:
@ -494,11 +490,7 @@ tail -f /var/log/mail.log
Now open your IMAP client (Thunderbird, Evolution, Roundcube, mutt or whatever you prefer) and drag an email to your Junk folder. The mail log will show a lot of things that are going on. I tried to compact the output so that you better understand that it worked:
```
imapsieve: Static mailbox rule [1]: mailbox=`Junk' from=`*'
causes=(COPY) =>
before=`file:/etc/dovecot/sieve/learn-spam.sieve'
after=(none)
imapsieve: Static mailbox rule [1]: mailbox=`Junk' from=`*' causes=(COPY) => before=`file:/etc/dovecot/sieve/learn-spam.sieve' after=(none)
imapsieve: Static mailbox rule [2]: mailbox=`*' from=`Junk'
causes=(COPY) => before=`file:/etc/dovecot/sieve/learn-ham.sieve'
after=(none)
@ -535,5 +527,64 @@ Dont forget to switch off “mail\_debug” again or your users actions wi
rspamd keeps a verbose log of its actions in /var/log/rspamd/rspamd.log. If a user complains that a certain email got blocked or at least flagged as spam then take a look at this log. You can match the /var/log/mail.log with it by comparing the Postfix queue ID. Those are the 12-digit hexadecimal number like “**95CE05A00547**“. Those IDs can be found in the rspamd.log, too:
```
<40985d>; task; rspamd\_task\_write\_log: id: <undef>, qid: <**95CE05A00547**\>, ip: 12.13.51.194, from: <…>, (default: F (no action): \[3.40/15.00\] \[MISSING\_MID(2.50){},MISSING\_DATE(1.00){},MIME\_GOOD(-0.10){text/plain;},ARC\_NA(0.00){},ASN(0.00){asn:8220, ipnet:212.123.192.0/18, country:GB;},FROM\_EQ\_ENVFROM(0.00){},FROM\_NO\_DN(0.00){},RCPT\_COUNT\_ONE(0.00){1;},RCVD\_COUNT\_ZERO(0.00){0;},RCVD\_TLS\_ALL(0.00){},TO\_DN\_NONE(0.00){},TO\_DOM\_EQ\_FROM\_DOM(0.00){},TO\_MATCH\_ENVRCPT\_ALL(0.00){}\]), len: 181, time: 16.000ms real, 6.385ms virtual, dns req: 0, digest: <69b289a82827c11f759837c033cd800a>, rcpts: <…>, mime\_rcpt: <…>
<40985d>; task; rspamd_task_write_log: id: <undef>, qid: <**95CE05A00547**>, ip: 12.13.51.194, from: <…>, (default: F (no action): [3.40/15.00] [MISSING_MID(2.50){},MISSING_DATE(1.00){},MIME_GOOD(-0.10){text/plain;},ARC_NA(0.00){},ASN(0.00){asn:8220, ipnet:212.123.192.0/18, country:GB;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},RCVD_TLS_ALL(0.00){},TO_DN_NONE(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 181, time: 16.000ms real, 6.385ms virtual, dns req: 0, digest: <69b289a82827c11f759837c033cd800a>, rcpts: <…>, mime_rcpt: <…>
```
## The web interface
rspamd comes with a neat bonus feature: a web interface. It allows you to check emails for spam, get statistics and fine-tune scores. It is already installed and enabled by default and expects HTTP requests on port 11334 on the localhost interface. I suggest you add a simple proxy configuration to your already working HTTPS-enabled web mail configuration to get access.
![rspamd dashboard](images/catching-spam-rspamd-dashboard.png)
First you need to enable Apaches modules for HTTP proxying and rewriting:
```
a2enmod proxy_http
a2enmod rewrite
```
You can either create a new virtual host configuration or just edit the /etc/apache2/sites-available/webmail.**example.org**-https.conf file. Anywhere within the _VirtualHost_ tags add:
```
<Location /rspamd>
Require all granted
</Location>
RewriteEngine On
RewriteRule ^/rspamd$ /rspamd/ \[R,L\]
RewriteRule ^/rspamd/(.\*) http://localhost:11334/$1 \[P,L\]
```
This piece of configuration will forward any requests to `https://webmail.example.org/rspamd` to localhost:11334 and thus give you access to the rspamd web interface.
The interface is password protected. Lets generate a new access password:
```
pwgen 15 1
```
This gives you a password like “eiLi1lueTh9mia4”. You could put that password in an rspamd configuration file. But cleartext passwords in configuration files are not quite elegant. Lets create a hash of the password:
```
rspamadm pw
Enter passphrase: …
$2$icoahes75e7g9wxapnrbmqnpuzjoq7z…
```
Feed it the password that pwgen created for you and you will get a long hashed password. This procedure by the way is also documented on the [rspamd pages](https://rspamd.com/doc/tutorials/quickstart.html#setting-the-controller-password).
Create a new configuration file `/etc/rspamd/local.d/worker-controller.inc` and put your hashed password in there:
```
password = "$2$icoahes75e7g9wxapnrbmqnpuzjoq7z…"
```
Thats it for the configuration. Finally restart both rspamd and Apache to load your changed configuration:
```
systemctl restart rspamd
systemctl restart apache2
```
If everything went as expected you should now be able to access the rspamd web interface at `https://webmail.example.org/rspamd`

View file

@ -0,0 +1,58 @@
---
title: Setting DNS records
lastUpdated: 2023-10-04
slug: ispmail-bookworm/setting-dns-records/
sidebar:
order: 200
---
import { Aside } from "@astrojs/starlight/components";
## MX entries
So now you have your working mail server. But how do other mail servers get to know you? The answer lies in the most important service on the internet: [DNS](http://en.wikipedia.org/wiki/Domain_Name_System) the Domain Name System. Assume that a mail server somewhere on the other end of the internet wants to send an email to `john@example.org`. The server must find out the name (and IP address) of the mail server responsible for the example.org domain. This is how that works:
![Big picture of how MX records work](images/setting-dns-records-mx-big-picture.png)
The remote server queries its DNS server for the MX (Mail eXchanger) record of the “example.org” domain. (If no MX record was found it tries again and asks for A (address) records. Thats a fallback solution.) Lets run a query for a real domain to get an idea. Lets ask which servers receive email for …@gmail.com.
```
$> host -t MX gmail.com
gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com.
gmail.com mail is handled by 5 gmail-smtp-in.l.google.com.
```
So as a result we get 5 different MX records. Each of them consists of a numeric priority and the host name of the mail server. A mail server would pick the entry with the highest priority (=the lowest number) and establish an SMTP connection to that host. In this example that would be the priority 5 server gmail-smtp-in.l.google.com. If that server could not be reached then the next best server with priority 10 would be used and so on. So all you have to do in your own DNS zone is add an MX entry pointing to your mail server. If you want to run a backup mail server (which is outside of the scope of this tutorial) then you can add a second entry with a an equal or lower priority.
A mistake some people make is using an IP address in MX records. That is not allowed. An MX record always points to a host name. You will have to add an A record for your MX record to point to the actual IP address of your mail server.
<Aside type="tip" title="For fun and science">
In the above example it is very unlikely that a mail server will ever have to use the server with priority 40. Adventurous system administrators can add such a low-priority entry and see who connects to it. An interesting observation is that spammers often try these servers first hoping that it is just for backup purposes and less restrictive or lazily configured than the main server. If you see someone connecting to the lowest-priority address first without having tried a higher-priority mail server then you can be pretty certain that its not a friend whos knocking at your door.
</Aside>
## Fallback to A entries
It is advised to explicitly name mail servers for your domain in the MX records. If you cant do that for whatever reason then the remote mail server will just do an A record lookup for the IP address and then send email there. If you just run one server for both the web service and the email service then you can do that. But if the web server for your domain is located at another IP address than your mail server then this wont work.
## Reverse DNS
Many mail servers check that your forward (name to IP) and reverse (IP to name) lead to the same results. This is how it should look:
example.org —(MX)> mx.example.org
mx.example.org —(A)> 1.2.3.4
1.2.3.4 —(PTR)> mx.example.org
(1.2.3.4 in a PTR record is actually 4.3.2.1.in-addr.arpa.)
## IPv6
Fortunately many ISPs finally start to offer IPv6 in their networks. So if you rent a virtual server from a provider then check if you also got an IPv6 address assigned. In that case you also need to have proper DNS records for that as well. Like:
example.org —(MX)> mx.example.org
mx.example.org —(AAAA)> fdeb:37d7:ef39:e063::1
fdeb:37d7:ef39:e063 —(PTR)> mx.example.org
Chances are that you havent dealt with IPv6 yet. Give it a try. IP addresses may look different at first but you will never again have to deal with odd subnet sizes or NAT. Thank me later. 🙂

Binary file not shown.

After

Width:  |  Height:  |  Size: 47 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 55 KiB

View file

@ -29,3 +29,9 @@ li > br {
.starlight-aside {
margin-top: 2em !important;
}
.ec-line .code {
text-indent: -1em !important;
padding-left: 2em !important;
text-wrap: wrap;
}