I have set up spamassassin with postfix. The problem is I tried testing the spamassassin default filter by sending the GTUBE spam test email from gmail to my mail server. Spamassassin is not even checking that email or for that case, any incoming email. But only the outgoing emails are being checked by spamassassin and if I try to send the GTUBE test email to my gmail account from my server, spamassassin blocks it. I have started from scratch and each and every time this same problem persists. Please help
My postfix master.cf file:
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master" or
# on-line: http://www.postfix.org/master.5.html).
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
submission inet n - y - - smtpd
-o content_filter=spamassassin
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_tls_wrappermode=no
-o smtpd_sasl_auth_enable=yes
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
-o smtpd_sasl_type=dovecot
-o smtpd_sasl_path=private/auth
#smtp inet n - y - 1 postscreen
#smtpd pass - - y - - smtpd
#dnsblog unix - - y - 0 dnsblog
#tlsproxy unix - - y - 0 tlsproxy
#submission inet n - y - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_tls_auth_only=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - y - - smtpd
# -o syslog_name=postfix/smtps
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - y - - qmqpd
pickup unix n - y 60 1 pickup
cleanup unix n - y - 0 cleanup
qmgr unix n - n 300 1 qmgr
#qmgr unix n - n 300 1 oqmgr
tlsmgr unix - - y 1000? 1 tlsmgr
rewrite unix - - y - - trivial-rewrite
bounce unix - - y - 0 bounce
defer unix - - y - 0 bounce
trace unix - - y - 0 bounce
verify unix - - y - 1 verify
flush unix n - y 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - y - - smtp
relay unix - - y - - smtp
-o syslog_name=postfix/$service_name
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - y - - showq
error unix - - y - - error
retry unix - - y - - error
discard unix - - y - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - y - - lmtp
anvil unix - - y - 1 anvil
scache unix - - y - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
policyd-spf unix - n n - 0 spawn
user=policyd-spf argv=/usr/bin/policyd-spf
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}
My spamassassin config:
# /etc/default/spamassassin # Duncan Findlay # WARNING: please read README.spamd before using. # There may be security risks. # If you're using systemd (default for jessie), the ENABLED setting is # not used. Instead, enable spamd by issuing: # systemctl enable spamassassin.service # Change to "1" to enable spamd on systems using sysvinit: ENABLED=1 # Options # See man spamd for possible options. The -d option is automatically added. # SpamAssassin uses a preforking model, so be careful! You need to # make sure --max-children is not set to anything higher than 5, # unless you know what you're doing. OPTIONS="--create-prefs --max-children 5 --username spamd --helper-home-dir /home/spamd/ -s /home/spamd/spamd.log" # Pid file # Where should spamd write its PID to file? If you use the -u or # --username option above, this needs to be writable by that user. # Otherwise, the init script will not be able to shut spamd down. PIDFILE="/var/run/spamd.pid" # Set nice level of spamd #NICE="--nicelevel 15" # Cronjob # Set to anything but 0 to enable the cron job to automatically update # spamassassin's rules on a nightly basis CRON=1
My spamasssassin log:
Mon Aug 12 13:23:47 2019 [16867] info: logger: removing stderr method Mon Aug 12 13:23:48 2019 [16898] info: zoom: able to use 346/346 'body_0' compiled rules (100%) Mon Aug 12 13:23:48 2019 [16898] info: spamd: server started on IO::Socket::IP [::1]:783, IO::Socket::IP [127.0.0.1]:783 (running version 3.4.2) Mon Aug 12 13:23:48 2019 [16898] info: spamd: server pid: 16898 Mon Aug 12 13:23:48 2019 [16898] info: spamd: server successfully spawned child process, pid 16900 Mon Aug 12 13:23:48 2019 [16898] info: spamd: server successfully spawned child process, pid 16901 Mon Aug 12 13:23:48 2019 [16898] info: prefork: child states: SI Mon Aug 12 13:23:48 2019 [16898] info: prefork: child states: II Mon Aug 12 13:25:13 2019 [16900] info: spamd: connection from ::1 [::1]:58002 to port 783, fd 5 Mon Aug 12 13:25:13 2019 [16900] info: spamd: processing message for spamd:1001 Mon Aug 12 13:25:13 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-467.awsdns-58.com Mon Aug 12 13:25:13 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1622.awsdns-10.co.uk Mon Aug 12 13:25:13 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1158.awsdns-16.org Mon Aug 12 13:25:13 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-552.awsdns-05.net Mon Aug 12 13:25:14 2019 [16900] info: spamd: identified spam (998.9/5.0) for spamd:1001 in 0.3 seconds, 1610 bytes. Mon Aug 12 13:25:14 2019 [16900] info: spamd: result: Y 998 - ALL_TRUSTED,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,GTUBE,HTML_MESSAGE,TVD_SPACE_RATIO,TVD_SPACE_RATIO_MINFP scantime=0.3,size=1610,user=spamd,uid=1001,required_score=5.0,rhost=::1,raddr=::1,rport=58002,mid=,autolearn=no autolearn_force=no Mon Aug 12 13:25:14 2019 [16898] info: prefork: child states: II Mon Aug 12 13:42:12 2019 [16900] info: spamd: connection from ::1 [::1]:58122 to port 783, fd 5 Mon Aug 12 13:42:12 2019 [16900] info: spamd: processing message for spamd:1001 Mon Aug 12 13:42:12 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-467.awsdns-58.com Mon Aug 12 13:42:12 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1622.awsdns-10.co.uk Mon Aug 12 13:42:12 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1158.awsdns-16.org Mon Aug 12 13:42:12 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-552.awsdns-05.net Mon Aug 12 13:42:12 2019 [16900] info: spamd: clean message (-1.1/5.0) for spamd:1001 in 0.2 seconds, 1573 bytes. Mon Aug 12 13:42:12 2019 [16900] info: spamd: result: . -1 - ALL_TRUSTED,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE scantime=0.2,size=1573,user=spamd,uid=1001,required_score=5.0,rhost=::1,raddr=::1,rport=58122,mid=,autolearn=ham autolearn_force=no Mon Aug 12 13:42:13 2019 [16898] info: prefork: child states: II Mon Aug 12 14:35:03 2019 [16900] info: spamd: connection from ::1 [::1]:58214 to port 783, fd 5 Mon Aug 12 14:35:03 2019 [16900] info: spamd: processing message for spamd:1001 Mon Aug 12 14:35:04 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1622.awsdns-10.co.uk Mon Aug 12 14:35:04 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-467.awsdns-58.com Mon Aug 12 14:35:04 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-552.awsdns-05.net Mon Aug 12 14:35:04 2019 [16900] info: dns: new_dns_packet: domain is utf8 flagged: ns-1158.awsdns-16.org Mon Aug 12 14:35:04 2019 [16900] info: spamd: clean message (-1.1/5.0) for spamd:1001 in 0.3 seconds, 1501 bytes. Mon Aug 12 14:35:04 2019 [16900] info: spamd: result: . -1 - ALL_TRUSTED,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE scantime=0.3,size=1501,user=spamd,uid=1001,required_score=5.0,rhost=::1,raddr=::1,rport=58214,mid=,autolearn=ham autolearn_force=no Mon Aug 12 14:35:04 2019 [16898] info: prefork: child states: II
The lines in the spamassassin log which tells that its a spam, those test spam emails(GTUBE email) were sent from my server.
As it can be seen, spamassassin is only scanning outgoing emails and not incoming ones
