aspamd - Installation

Egress

When running Exim as an outgoing MTA, to better protect your IP reputation, you should send all outgoing mail to aspamd, running in egress mode. To do this, use the command line, flag, --egress, or set EGRESS=true in the configuration file. This will give better configuration results. The installation creates a systemd service, aspamd@egress, which uses the configuration file at /etc/atmail/aspamd/aspamd-egress.conf. Edit this file to check that the Egress entry is set to true and to remove the hash from LISTEN entry so that the listener can use port 7831.

vi /etc/atmail/aspamd/aspamd-egress.conf
EGRESS=true
LISTEN=127.0.0.1:7831

Start the aspamd egress service

systemctl start aspamd@egress
systemctl enable aspamd@egress
systemctl status aspamd@egress

● aspamd@egress.service - atmail-aspamd-egress - aspamd egress server
   Loaded: loaded (/usr/lib/systemd/system/aspamd@egress.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2020-10-20 17:13:50 BST; 11s ago
Docs: http://www.atmail.com/
  Process: 7062 ExecStop=/bin/kill -s QUIT $MAINPID (code=exited, status=0/SUCCESS)
Main PID: 7212 (aspamd)
   CGroup: /system.slice/system-aspamd.slice/aspamd@egress.service  
           └─7212 /usr/bin/aspamd -c /etc/atmail/aspamd/aspamd-egress.conf -syslogEnable

Jun 05 09:00:46 vm1 systemd[1]: Started atmail-aspamd - aspamd egress server.
Jun 05 09:00:55 vm1 aspamd[948]: time=“2019-06-05T09:00:55+10:00” level=info msg=“aspamd engine initializing”
Jun 05 09:00:55 vm1 aspamd[948]: time=“2019-06-05T09:00:55+10:00” level=info msg=“egress mode”
Jun 05 09:00:55 vm1 aspamd[948]: time=“2019-06-05T09:00:55+10:00” level=info msg=“aspamd listening on 127.0.0.1:7831"

atmail Mailserver

atmail Mailserver manages Exim's configuration, so any changes made manually to the exim configuration are likely to be erased on next configuration publish. To integrate this product into a platform that is managed by atmail mailserver the following configurations steps need to be performed (assumes aspamd itself has been configured to listen on port 7830). This requires atmail-mailserver and atmail-mailserver-ansible versions >= 8.6.0-19

Update Exim to use new aspamd Engine

In order to do this it is currently necessary to update and overwrite some configuration variables in the inventory. Firstly change the connection mode from tcp by updating the spamd_mode configuration:

use mailserver;
select * from inventory where configVariable = 'spamd_mode';
+-------------+---------------+---------------+----------------+-------------+
| inventoryId | inventoryItem | configSection | configVariable | configValue |
+-------------+---------------+---------------+----------------+-------------+
| 180         | _default      | exim          | spamd_mode     | tcp         |
+-------------+---------------+---------------+----------------+-------------+

update inventory set configValue = 'aspamd' where configVariable = 'spamd_mode' and configSection = 'exim';

select * from inventory where configVariable = 'spamd_mode';
+-------------+---------------+---------------+----------------+-------------+
| inventoryId | inventoryItem | configSection | configVariable | configValue |
+-------------+---------------+---------------+----------------+-------------+
| 180         | _default      | exim          | spamd_mode     | aspamd      |
+-------------+---------------+---------------+----------------+-------------+

Next update the variable spamd_socket to take the value for connecting to aspamd:

select * from inventory where configVariable = 'spamd_socket';
+-------------+---------------+---------------+----------------+---------------------------+
| inventoryId | inventoryItem | configSection | configVariable | configValue               |
+-------------+---------------+---------------+----------------+---------------------------+
| 197         | _default      | exim          | spamd_socket   | /var/run/spamd/spamd.sock |
+-------------+---------------+---------------+----------------+---------------------------+

update inventory set configValue = '$acl_m_spamd' where configVariable = 'spamd_socket' and configSection = 'exim';

select * from inventory where configVariable = 'spamd_socket';
+-------------+---------------+---------------+----------------+--------------+
| inventoryId | inventoryItem | configSection | configVariable | configValue  |
+-------------+---------------+---------------+----------------+--------------+
| 197         | _default      | exim          | spamd_socket   | $acl_m_spamd |
+-------------+---------------+---------------+----------------+--------------+

These changes will allow you to publish out without changing the current exim.conf.j2 template found in mailserver for the default ss1ip role.

Finally check if the X-atmail-spam-action header variable exists:

select * from inventory where configValue='X-atmail-spam-action';
+---------------+---------------+----------------+----------------------+
| inventoryItem | configSection | configVariable | configValue          |
+---------------+---------------+----------------+----------------------+
| _default      | exim          | h_spam_action  | X-atmail-spam-action |
+---------------+---------------+----------------+----------------------+
1 row in set (0.00 sec)

If not then add it:

insert into inventory(inventoryItem, configSection, configVariable, configValue) values('_default','exim','h_spam_action','X-atmail-spam-action');

Update the Exim ACL

This will need to be done on each mailserver instance if using the publish button to push configuration changes.

Change directory the override directory for the in-built ss1ip ansible role.

cd /var/lib/atmail/mailserver/roles/ss1ip/templates/amp/exim

Copy over the current data ACL template file:

cp ../../exim/acl_check_data.j2 .

Ensure that the file has sufficient read permissions:

chmod 0644 acl_check_data.j2

Update the file to use new rules based around aspamd - example is given below:

vi acl_check_data.j2 

acl_check_data:

 deny
 message = Virus $malware_name detected.
 malware = */defer_ok
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:REJECT:$sender_host_address:$sender_address:$recipients:Malware/Virus $malware_name detected

warn
 set acl_m_spamd = 127.0.0.1 7830 variant=rspamd

warn
 condition = ${if def:acl_m_outbound}
 set acl_m_spamd = 127.0.0.1 7831 variant=rspamd

warn
 spam = nobody:true/defer_ok
 add_header = {{ exim_h_spam_bar }}: $spam_bar \n\
 {{ exim_h_spam_report }}: $spam_report \n\
 {{ exim_h_spam_action }}: $spam_action

deny
 condition = ${if def:acl_m_outbound}
 condition = {{ '${if eq {$spam_action}{reject}{1}{0}}' }}
 message = Rejected - messages seen as spam
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:REJECT:$sender_host_address:$sender_address:Outbound message seen as SPAM

accept
 condition = ${if def:acl_m_outbound}
 message = Accepted outbound message
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:ACCEPT:$sender_host_address:$sender_address:Message accepted for outbound

accept
 condition = ${if eq {$acl_m_antispam_override}{1}{yes}{no}}
 condition = {{ '${if eq {$spam_action}{reject}{1}{0}}' }}
 add_header = {{ exim_h_spam_override }}: 1
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:ACCEPT:$sender_host_address:$sender_address:Message accepted due to antispam override

deny
 condition = {{ '${if eq {$spam_action}{reject}{1}{0}}' }}
 message = Rejected as SPAM
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:REJECT:$sender_host_address:$sender_address:$recipients:Rejected as SPAM

accept
 logwrite = $pid:$tod_epoch:LOG:ACL_CHECK_CONTENT:ACCEPT:$sender_host_address:$sender_address:$recipients:Message accepted as non SPAM

Any publish will now insert the custom acl_check_data.j2 into the main configuration file.

systemctl restart exim