[Short Tip] Debug Spamassassin within Amavisd

920839987_135ba34fff
Filtering e-mail for spam and viruses can be done efficiently with Amavisd-New. Besides its own technologies to identify and filter out Spam it can also make use of Spamassassin and its results. However, since Amavisd starts Spamassassin itself, it sometimes is hard to debug when something is not working.

For example in a recent case I saw that the Bayes database was not used when checking for spam characteristics, although the database was properly trained with ham and spam.

Thus first I checked Spamassassin itself:

$ su -s /bin/bash mailuser -c "spamassassin -D -t < ExampleSpam.eml 2>&1"  | tee sa.out

That worked well, the Bayes database was queried, results were shown.

Next, I added $sa_debug = '1,all'; to the Amavisd configuration and run Amavisd in debug mode:

$ amavisd -c /etc/amavisd/amavisd.conf debug

And that showed the problem: one of the Bayes files had wrong permissions. After fixing those, the filter run again properly.

Advertisements

[Howto] LDAP schema for Postfix

Postfix LogoThe official Postfix documentation to use LDAP for user and alias lookup mentions certain LDAP attributes which are not part of the default OpenLDAP. In this article I will shortly explain a basic theme providing these attributes and the corresponding object class.

Postfix can easily be connected to LDAP to lookup addresses and aliases. The Postfix LDAP documentation covers all the details. As mentioned there the default configuration of Postfix expects two LDAP attributes in the LDAP schema: mailacceptinggeneralid and maildrop. This also shows in the code in src/global/dict_ldap.c:

dict_ldap->query =
    cfg_get_str(dict_ldap->parser, "query_filter",
        "(mailacceptinggeneralid=%s)", 0, 0);

However, these attributes are not part of the default OpenLDAP installation, and the Postfix documentation does not mention how exactly that has to look like and where to get it. For that reason we at my employer credativ provide such a schema at Github: github.com/credativ/postfix-ldap-schema. The github repository contains the schema, the corresponding licence and a short documentation. A German introduction to the schema can also be found at credativ’s blog: LDAP-Schema für Postfix-Abfragen

The provided schema defines the necessary attribute types mailacceptinggeneralid and maildrop as well as the object class postfixUser. Please note that in this schema the used OIDs are of the type Experimental OpenLDAP, see also the OID database.

To use the schema it must be used by OpenLDAP, for example by including in in slapd.conf. A corresponding LDAP entry could look like:

dn: uid=mmu,ou=accounts,dc=example,dc=net
objectclass: top
objectclass: person
objectclass: posixAccount
objectclass: postfixUser
cn: Max Mustermann
sn: Mustermann
uid: mmu
uidNumber: 5001
gidNumber: 5000
homeDirectory: /home/vmail
mailacceptinggeneralid: mmu
mailacceptinggeneralid: max.mustermann
mailacceptinggeneralid: m.mustermann
mailacceptinggeneralid: bugs
maildrop: mmu

As you see the example covers multiple aliases. Also, the final mailbox is a domain less entity: maildrop: mmu does not mention any domain name. This only works if your mail boxes actually do not require (or even allow) domain names – in this case this was true since the mail is finally transported to a Dovecot server which does not know about the various domains.

Please note that this schema can only be the foundation for a more sophisticated, more complex schema which need to be tailored to fit the individual needs of the corresponding setup.

Postfix Architecture Overview

Postfix LogoPostfix consists of numerous services, commandos and queues. The documentation describes them in detail, but a general overview was missing – so I gave it a try.

The Postfix documentation is very detailed and of high quality. One example is postfix.org/OVERVIEW.html which explains the various services, queues and commandos and how they interact with each other. However, despite the included ASCII diagrams a “big picture” is missing. Since we do have quite some customers using Postfix at credativ my company gave me some time to spend at creating such an overview. Here you go:

Postfix Architecture Overview
Postfix Architecture Overview

The image links to the company website where you can download the PDF, but there is also a Postfix Architecture Overview Github repository including the odg, a pdf and a png.

Of course Postfix is far too complex to highlight all services and all commandos and all ways of communication, so the picture had to be simplified. For example, the process of flushing mails does only cover the deferred and incoming queue and not the processes which actually trigger the flushing. Also, policyd’s are missing, and I would actually like to include where Milter filters can be attached. Maybe I’ll update the graphic in the future. The license will be CC-BY-SA, so if you have ideas to extend the picture further you will be able to send me pull requests. Speaking about ideas, thanks to Patrick Ben Koetter who gave me the idea to create such an image.

Small Gems: KMail attachment notification

PIA16218

Once in a while I run into really nice and well crafted features in software which are hardly known – or at least not advertised enough. I call these small but shiny features “little gems”. One of those struck me in a recent KMail release.

Everyone who has ever used e-mails has at least once gotten or sent an e-mail which was intended to have an attachment, but didn’t have it. KMail has the possibility to check a written mail for certain, user configurable key words: if there is a word match in the mail without it having an attachment, the user is asked if he/she hasn’t forgotten the attachment when he/she hits the send button.

With recent KMail versions, the check is done on the fly, and the notion about a possible forgotten attachment is integrated much better into the entire interface:
Kmail-attachments
Pretty neat =)