Docker-mailserver: multiple users: spamassassin not working properly

[davidszp]

I first configured the container with one user and spamassassin works fine and as expected for months. Then I added two new users with their own directory for receiving mails and for the life of me I can't get spamassassin headers added to incoming emails:

Return-Path: [e-mail]
Delivered-To: [email protected]
Received: from localhost (localhost [127.0.0.1])
by mail.domain.com(Postfix) with ESMTP id 8290F1723BE
for [e-mail]; Sun, 29 Jan 2017 01:40:10 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at domain.net
Received: from mail.domain.com([127.0.0.1])
by localhost (mail.domain.com[127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id P5EdkQSiJxjI for [e-mail];

So Amavis passes the mail off to Virus Scanning, works fine. But it doesn't pass it to Spamassassin?

My SA Tags are as follows:

$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 3.4; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 99; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent

• I checked permissions on the new users' postfix folders and they look OK. They appear writable.
• Nothing of note is showing up in mail.err in /var/log/mail

1. In theory, amavis is setup to process Spamassassin for all users with a single bayes database/tokens?
2. Is there anything in amavis/spamassassin that would stop Spamassassin from adding X-Spam headers to these additional postfix users' mails?

[davidszp]

After a few additional hours, I have been able to figure out the problem. Here is some more info for those who were as lost as me:

• In its default setup, amavis does not support "per user" setup of spamassassin rules. You can't have bayes sets for individual users. You have to use a shotgun approach: one big rule & bayes set that fits all users.
• my problem above boiled down to the acl domain rules in amavis setup. Some of my domains are subdomains. The default amavis setup does activate spamassassin settings for subdomains but only for domain.com type domains.

I have overridden the default in 05-domain_id (in the amavis defaults)

@local_domains_acl = ( ".$mydomain" );

in 50-user with this rule

@local_domains_maps = (".");

which matches any sort of domain. And now my subdomain email accounts get Spamassassin x-headers written into their mails like they're supposed to.

[davidszp]

I closed the ticket and added the relevant information to the FAQ.

[tomav]

Thanks for the update and wiki @makloda

[theomega]

Not sure if we should close this so easy: Setting local_domains_maps only to head -n 1 /etc/mailname per default means that we enable spamfiltering only for the first domain and not for other domains we have.

I think we should modify amavisd here and provide it with all domains we know, maybe the /etc/postfix/vhost file could be handy here.

[tomav]

I think @theomega is right. Only the first domain is scanned.

[tomav]

Yep, just tried adding this to /etc/amavis/conf.d/40-policy_banks

@local_domains_maps = (
   read_hash('/etc/postfix/vhost')
);

Seems to work on other domain. I think we should also add integration tests too on that.

[tomav]

PR https://github.com/tomav/docker-mailserver/pull/563

[tomav]

@makloda, @theomega

The added test is ok on the PR:

@test "checking spamassassin: all registered domains should see spam headers" {
  run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/localhost.localdomain/user1/new"
  assert_success
  run docker exec mail /bin/sh -c "grep -ir 'X-Spam-' /var/mail/otherdomain.tld/user2/new"
  assert_success
}

I let you check this code. I'll merge when I have your approval.

[thiesschneider]

is there any solution yet?

[tomav]

Hi @thiesschneider, there are some fix to do on the PR https://github.com/tomav/docker-mailserver/pull/563
I currently don't have time for that but you can finalize it if you want.
Sorry.

[thiesschneider]

:) so I will wait...
i am not into it that much sorry!
but thank you for the project!!!

[tomav]

Done.

[thiesschneider]

Is there a reason that this was pushed on elk only and not to the latest tag?
Would love to have this in my image too

[tomav]

Docker Hub build failed due to Clamav.. again...
Just restarted it.
https://hub.docker.com/r/tvial/docker-mailserver/builds/

[thiesschneider]

hm... it failed again i think :(

[tomav]

Better now.

[wasgehthierab]

can you please make instructions how to make this exactly work

[thiesschneider]

I am also wondering which file I have to modify to get this working.
I am still getting Spam on my other domains :/
thx!

[thiesschneider]

Hey there,

can nobody help?

thx