4

My server worked, but I installed SpamAssassin using a tutorial from Digital Ocean.

Here is my /etc/default/spamassassin:

# /etc/default/spamassassin
# Duncan Findlay

# WARNING: please read README.spamd before using.
# There may be security risks.

# Change to one to enable spamd
ENABLED=1

# Options
# See man spamd for possible options. The -d option is automatically added.

# SpamAssassin uses a preforking model, so be careful! You need to
# make sure --max-children is not set to anything higher than 5,
# unless you know what you're doing.
SAHOME="/var/log/spamassassin/"
OPTIONS="--create-prefs --max-children 2 --username spamd -H ${SAHOME} -s ${SAHOME}spamd.log"
# Pid file
# Where should spamd write its PID to file? If you use the -u or
# --username option above, this needs to be writable by that user.
# Otherwise, the init script will not be able to shut spamd down.
PIDFILE="${SAHOME}spamd.pid"

# Set nice level of spamd
#NICE="--nicelevel 15"

# Cronjob
# Set to anything but 0 to enable the cron job to automatically update
# spamassassin's rules on a nightly basis
CRON=1

And /etc/postfix/master.cf:

# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       -       smtpd
  -o content_filter=spamassassin
#smtp      inet  n       -       -       -       1       postscreen
#smtpd     pass  -       -       -       -       -       smtpd
#dnsblog   unix  -       -       -       -       0       dnsblog
#tlsproxy  unix  -       -       -       -       0       tlsproxy
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=
#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix  -       n       n       -       2       pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}
spamassassin unix -     n       n       -       -       pipe
        user=spamd argv=/usr/bin/spamc -f -e
        /usr/sbin/sendmail -oi -f ${sender} ${recipient}
                                                                                                                   129,1         Bot

Permissions are following:

-rw-r-----   1 root root   329 Oct 17 13:58 dynamicmaps.cf
-rw-r--r--   1 root root  2237 Oct 17 21:18 main.cf
-rw-r-----   1 root root  1359 Oct 17 18:04 main.cf.orig
-rw-r-----   1 root root  6383 Oct 18 08:47 master.cf
-rw-r-----   1 root root  6068 Oct 17 18:20 master.cf.orig
-rw-r-----   1 root root   160 Oct 17 18:18 mysql-virtual-alias-maps.cf
-rw-r-----   1 root root   151 Oct 17 18:18 mysql-virtual-email2email.cf
-rw-r-----   1 root root   148 Oct 17 18:16 mysql-virtual-mailbox-domains.cf
-rw-r-----   1 root root   147 Oct 17 18:17 mysql-virtual-mailbox-maps.cf
-rw-r-----   1 root root 20281 Feb  5  2015 postfix-files
-rwxr-x---   1 root root  8861 Feb  5  2015 postfix-script
-rwxr-x---   1 root root 28047 Feb  5  2015 post-install
drwxr-x---   2 root root  4096 Feb  5  2015 sasl

I am getting following error:

Oct 18 08:57:57 ubuntuserver postfix/pipe[3132]: 40CA0A1A2C: to=<admin@mydomain.com>, relay=spamassassin, delay=356, delays=355/0.03/0/0.71, dsn=4.3.0, status=deferred (temporary failure. Command output: sendmail: fatal: open /etc/postfix/main.cf: Permission denied )

Should I change permissions to 777 or something of configuration file ? I think this is worst idea.

I have just set 744 permissions to this folder, but it still doesn't work ( I have tried to set 777 permissions for this main.cf, still doesn't work.

4
  • What are the permissions of your /etc/postfix folder?
    – Jens Erat
    Oct 18 '16 at 7:20
  • @JensErat I have just set 744 permissions to this folder but it still doesn't work ( I have tried to set 777 permissions for this main.cf, still doesn't work
    – frvzuaex
    Oct 18 '16 at 8:47
  • Never set write permissions for non-root users to anything in /etc unless there are very special requirements. /etc/postfix is a directory and thus needs the executable bit set in addition to the read bit, so use 755, not 744.
    – Jens Erat
    Oct 18 '16 at 9:21
  • Thank you so much, I have just set directory permissions to 755 !! Please post your comment as an answer I will accept it
    – frvzuaex
    Oct 18 '16 at 10:00
3

Spam Assasin is not run as root user, but spamd instead:

spamassassin unix -     n       n       -       -       pipe
        user=spamd argv=/usr/bin/spamc -f -e
        /usr/sbin/sendmail -oi -f ${sender} ${recipient}

The log message indicates improper permissions on the Postfix configuration when Spam Assasin tries to deliver the scanned mail back into the Postfix system:

Oct 18 08:57:57 ubuntuserver postfix/pipe[3132]: 40CA0A1A2C: to=, relay=spamassassin, delay=356, delays=355/0.03/0/0.71, dsn=4.3.0, status=deferred (temporary failure. Command output: sendmail: fatal: open /etc/postfix/main.cf: Permission denied )

sendmail is implemented by Postfix on your system.

Likely you have somehow messed up the permissions on the Postfix configuration file /etc/postfix/main.cf or /etc/postifx folder. Both should belong to root and be readable for anybody (but only writeable for root), the directory also needs the executable permission set:

$ ls -lad /etc/postfix /etc/postfix/main.cf
drwxr-xr-x 1 root root  146 Aug 12 21:52 /etc/postfix/
-rw-r--r-- 1 root root 1873 Feb 22  2016 /etc/postfix/main.cf

There might be sensitive files containing credentials in /etc/postfix (for example for SMTP smarthost delivery) -- make sure they have tight permissions!

2
  • Thanks a lot. It worked well. I wonder how did it stopped automatically, it was working well earlier. Oct 12 '19 at 18:39
  • This was helpful, but wouldn't it be better to add the spamd user to the postfix group and keep the permissions isolated to the group instead of allowing world readable?
    – slf
    Sep 3 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.