Mail filtering with Dovecot

This expands on my previous post about how to set up an email server.

We’re going to set up a few spam filters in Dovecot under Debian. We’re going to use Sieve, which lets the user set up whichever filters they want. However, we’re going to run a couple pre-baked spam filters regardless of what the user sets up.

1. Install Sieve.
   
   sudo apt-get install dovecot-sieve dovecot-managesieved

   1	sudo apt-get install dovecot-sieve dovecot-managesieved

2. Add Sieve to Dovecot
   
   # /etc/dovecot/dovecot.conf # Sieve and ManageSieve protocols = $protocols sieve protocol lmtp { mail_plugins = $mail_plugins sieve } service managesieve-login { inet_listener sieve { port = 4190 } } protocol sieve { managesieve_logout_format = bytes ( in=%i : out=%o ) } plugin { # Settings for the Sieve and ManageSieve plugin sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /etc/dovecot/sieve.d/ sieve_dir = ~/sieve # For old version of ManageSieve #sieve_extensions = +vnd.dovecot.filter #sieve_plugins = sieve_extprograms }

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

   # /etc/dovecot/dovecot.conf # Sieve and ManageSieve protocols = $protocols sieve protocol lmtp { mail_plugins = $mail_plugins sieve } service managesieve-login { inet_listener sieve { port = 4190 } } protocol sieve { managesieve_logout_format = bytes ( in=%i : out=%o ) } plugin { # Settings for the Sieve and ManageSieve plugin sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /etc/dovecot/sieve.d/ sieve_dir = ~/sieve # For old version of ManageSieve #sieve_extensions = +vnd.dovecot.filter #sieve_plugins = sieve_extprograms }

3. Install and update SpamAssassin, a heuristic perl script for spam filtering.
   
   sudo apt-get install spamasssassin sudo sa-update

   1 2	sudo apt-get install spamasssassin sudo sa-update

   
   
   # /etc/default/spamassassin ENABLED=1 #CRON=1 # Update automatically

   1 2 3

   # /etc/default/spamassassin ENABLED=1 #CRON=1 # Update automatically

   
   
   # /etc/spamassassin/local.cf report_safe 0 # Don't modify headers

   1 2	# /etc/spamassassin/local.cf report_safe 0 # Don't modify headers

   
   
   sudo service spamassassin start

   1	sudo service spamassassin start

4. There’s a lot of custom configuration and training you should do to get SpamAssassin to accurately categorize what you consider spam. I’m including a minimal amount here. The following will train SpamAssassin system-wide based on what users sort into spam folders.
   
   #!/bin/sh # /etc/cron.daily/spamassassin-train all_folders() { find /var/mail/vmail -type d -regextype posix-extended -regex '.*/cur|new$' } all_folders | grep "Spam" | sa-learn --spam -f - >/dev/null 2>/dev/null all_folders | grep -v "Spam" | sa-learn --ham -f - >/dev/null 2>/dev/null

   1 2 3 4 5 6 7 8

   #!/bin/sh # /etc/cron.daily/spamassassin-train all_folders() {         find /var/mail/vmail -type d -regextype posix-extended -regex '.*/cur|new$' }   all_folders | grep "Spam" | sa-learn --spam -f - >/dev/null 2>/dev/null all_folders | grep -v "Spam" | sa-learn --ham -f - >/dev/null 2>/dev/null

5. Make Postfix run SpamAssassin as a filter, so that it can add headers as mail comes in.
   
   # /etc/postfix/master.cf smtp inet n - - - - smtpd -o content_filter=spamassassin # ... spamassassin unix - n n - - pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

   1 2 3 4 5

   # /etc/postfix/master.cf smtp inet n - - - - smtpd -o content_filter=spamassassin # ... spamassassin unix - n n - - pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

   
   
   sudo service postfix restart

   1	sudo service postfix restart

6. Add SpamAssassin to Sieve. Dovecot (via Sieve) will now move messages with spam headers from SpamAssassin to your spam folder. Make sure you have a “Spam” folder and that it’s set to autosubscribe.
   
   # /etc/dovecot/sieve.d/spam-assassin.sieve require ["fileinto"]; # Move spam to spam folder if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; # Stop here - if there are other rules, ignore them for spam messages stop; }

   1 2 3 4 5 6 7 8

   # /etc/dovecot/sieve.d/spam-assassin.sieve require ["fileinto"]; # Move spam to spam folder if header :contains "X-Spam-Flag" "YES" { fileinto "Spam"; # Stop here - if there are other rules, ignore them for spam messages stop; }

   
   
   cd /etc/dovecot/sieve.d sudo sievec spam-assassin.sieve

   1 2	cd /etc/dovecot/sieve.d sudo sievec spam-assassin.sieve

7. Restart Dovecot
   
   sudo service dovecot restart

   1	sudo service dovecot restart

8. Test spam. The GTUBE is designed to definitely get rejected. Set the content of your email to this:
   
   XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

   1	XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X

9. You should also be able to create user-defined filters in Sieve, via the ManageSieve protocol. I tested this using a Sieve thunderbird extension. You’re on your own here.