rspamd - does someone tried to run it using SmarterMail Beta?

Question asked by Webio - 12/22/2022 at 12:17 PM

Answered

Hello,

I'm trying beta and its rspamd support for spam filtering. Does someone managed to make it work running SmarterMail Beta as a incoming gateway? Only log entries which I'm getting in rspamd is when I try to use URL for normal worker (http://IPADDRESSOFRSPAMD:11333) but message in rspamd log contains only:

cannot handle request: invalid command

I'm using rspamd 3.4.

Thanks

EDIT:

This is entry from rspamd.log:

2022-12-22 20:23:18 #19926(normal) <93b906>; task; rspamd_worker_body_handler: accepted connection from HEREISIPADDRESS FROMSMARTERMAILBETAGATEWAY port 54356, task ptr: 00007F4639EA28A0
2022-12-22 20:23:18 #19926(normal) <93b906>; task; rspamd_worker_body_handler: cannot handle request: invalid command

14 Replies

Reply to Thread

Webio Replied

12/22/2022 at 12:42 PM

It looks like I've managed to make it work. I had to edit worker proxy config file and set param:

milter = no;

and I'm conneting to URL: http://RSPAMDIP:11332

IMHO I think there is also naming issue becaue in Spam checks when you edit rspamd spam classification there is "SpamAssassin scoring factor" where it should contain rspamd scoring factor or something similar.

EDIT: But still I see some "cannot handle request: invalid command" in rspamd log errors section.

EDIT2: It looks like it is not working. New stats shows scanned messages but log contains no data and rspamd.log contains:

2022-12-22 20:49:55 #20193(rspamd_proxy) <6194bb>; proxy; proxy_accept_socket: accepted http connection from SMBETAGATEWAYIP port 55239
2022-12-22 20:49:55 #20193(rspamd_proxy) <6194bb>; proxy; rspamd_proxy_self_scan: cannot handle request: invalid command
2022-12-22 20:49:55 #20193(rspamd_proxy) <6194bb>; proxy; rspamd_task_write_log: id: <undef>, (default: S (no action): [0.00/15.00] []), len: 0, time: 0.082ms, dns req: 0, digest: <undef>
2022-12-22 20:49:55 #20193(rspamd_proxy) <6194bb>; proxy; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 0 regexps matched, 172 regexps total, 0 regexps cached, 0B scanned using pcre, 0B scanned total

Kyle Kerst Replied

12/22/2022 at 1:09 PM

Employee Post Marked As Answer

Thanks for your followup and findings on this. First, the address I used in testing on this internally looks like this:

http://10.x.x.x:11333/checkv2

Have you tried with the /checkv2 extension on there? I see the wording issue on the Spam Check itself as well so I'm going to get that over to dev now.

Kyle Kerst

System/Network Administrator

SmarterTools Inc.

(877) 357-6278

www.smartertools.com

Webio Replied

12/22/2022 at 1:13 PM

Adding "/checkv2" to URL and changing port to 11333 worked. Thanks

Kyle Kerst Replied

12/22/2022 at 1:32 PM

Employee Post

That's great! You're very welcome.

Kyle Kerst

System/Network Administrator

SmarterTools Inc.

(877) 357-6278

www.smartertools.com

Webio Replied

12/22/2022 at 1:35 PM

For anyone here is info about this URL:

https://rspamd.com/doc/architecture/protocol.html#controller-http-endpoints

Are you planning to make some HAM and SPAM integration with rspamd?

EDIT: There are http endpoints in rspamd for:

/learnspam - Trains bayes classifier on spam message
/learnham - Trains bayes classifier on ham message

Webio Replied

12/23/2022 at 12:59 AM

Can you check in your code how rspamd is being showed in logs? Next to mentioned "SpamAssassin scoring factor" in spam checks rspamd details settings I see in logs (I don't use built in spamassassin):

[_SPAMASSASSIN: 0:1], [_REMOTERSPAMD: 1:2]

or in message header:

SpamAssassin [raw:43]: 44, _REMOTERSPAMD: 0:0

and it makes me wonder if this is properly set up in code (I don't see any mentionings in delivery logs and message headers of rspamd checks).

Andrea Free Replied

12/27/2022 at 4:48 PM

Employee Post

Hi Webio,

Thank you for your feedback here!

"Are you planning to make some HAM and SPAM integration with rspamd?"

In Antispam settings, you'll find a new setting for "Send user spam feedback to antispam providers". When that's enabled, and a user clicks on the Move to Junk / Move to Inbox, we will send information to the enabled antispam providers to help with their training.

I have added a development task to look into the possibility of including Rspamd and SpamAssassin as part of the "antispam providers" for that new feature.

"Can you check in your code how rspamd is being showed in logs?"

We can certainly look into this! It's possible we have a language string using the wrong name in both places. We'll look into this and get back to you.

Andrea Free
SmarterTools Inc.
877-357-6278
www.smartertools.com

Webio Replied

12/28/2022 at 4:30 AM

Great. Thanks

EDIT: When it comes to providing ham/spam to providers I think it is much easier for rspamd than it is for spamassassin (since rspamd is providing http interface so sending reported message could be done directly after this action without keeping this message in some kind of learning folder).

Andrea Free Replied

12/28/2022 at 8:27 AM

Employee Post

Hi Webio,

I agree. It may not be possible to include SpamAssassin in conjunction with this new feature, but if we're looking into adding Rspamd, it won't hurt to review SpamAssassin's possibility as well :) I'll let you know what we find!

Andrea Free
SmarterTools Inc.
877-357-6278
www.smartertools.com

Kyle Kerst Replied

12/28/2022 at 12:09 PM

Employee Post

@WebIO: I took a look at the Spam Checks, Delivery, etc logging but was not able to see where the RSpamD results are being referenced as SpamAssassin. We are aware that the Remote RSpamD spam check in Settings>Antispam>Spam Checks does reference SpamAssassin Scoring Factor and this is due to be resolved in a future build. That said, I'm not seeing any logging indicating an issue here, and the scores match what my RSpamD server is sending back based on its logging. Can you clarify what you're seeing logging-wise? Thanks!

Kyle Kerst

System/Network Administrator

SmarterTools Inc.

(877) 357-6278

www.smartertools.com

Webio Replied

12/28/2022 at 3:42 PM

How does rspamd is being logged to delivery logs on your end? I'm using SM beta only as incoming gateways where main SM is stable version but still IMHO delivery logs from incoming gateway should contain some rspamd reference. Take a look at example delivery log spam entry:

2022.12.28 20:40:19.200 [69778845] Spam Check results: [REVERSE DNS LOOKUP: 0,Passed], [NULL SENDER: 0,passed], [_SPAMASSASSIN: -4:-5], [_REMOTERSPAMD: 0:1], [_SPF: 0,Pass], [_DK: 0,None], [_DKIM: 0,Pass], [ANONMAILS: 0], [VIRUS RBL - MSRBL: 0], [SPAMRATS - DYNA: 0], [MAILSPIKE BL: 0], [BACKSCATTER: 0], [UCEPROTECT LEVEL 3: 0], [UCEPROTECT LEVEL 1: 0], [SPAMHAUS - CBL: 0], [GBUDB: 0], [BARRACUDA: 0], [UCEPROTECT LEVEL 2: 0], [SURRIEL: 0], [MAILSPIKE Z: 0], [CBL - ABUSE SEAT: 0], [SORBS - SPAM: 0], [SORBS - NEW: 0], [SPAMRATS - SPAM: 0], [SORBS - ABUSE: 0], [SORBS - SMTP: 0], [HOSTKARMA - BLACKLIST: 0], [URIBL BLACK: 0], [SEM-URI: 0], [SURBL: 0]
2022.12.28 20:40:19.200 [69778845] Spam Checks completed.

Kyle Kerst Replied

12/28/2022 at 3:48 PM

Employee Post

RSpamD spam checks look like this in our test environments:

[2022.12.28] 10:05:40.457 [86142045] Spam Check results: [REVERSE DNS LOOKUP: 0,Passed], [NULL SENDER: 0,passed], [_INTERNALSPAMASSASSIN: 5.2:10], [_REMOTERSPAMD: 1:2], [_SPF: 0,Pass], [_DKIM: 5,None], [MAILSPIKE L3: 0], [TRUNCATE: 0], [SPAMCOP: 0], [SURRIEL: 0], [CBL: 0], [SEM - BLACK: 0], [SPAMHAUS - CSS2: 0], [HOSTKARMA - WHITELIST: 0], [UCEPROTECT LEVEL 2: 0], [UCEPROTECT LEVEL 1: 0], [HOSTKARMA - BLACKLIST: 0], [BACKSCATTER: 0], [UCEPROTECT LEVEL 3: 0], [URIBL BLACK: 0], [SEM-URI: 0]
[2022.12.28] 10:05:40.457 [86142045] Spam Checks completed.

The RSpamD result is [_REMOTERSPAMD: 1:2] and is only added on servers where the rspamd check can take place. If your gateway is running the current public version it will not pass this spam check result along, as it doesn't have this functionality available to it. You could set up a second gateway for testing and have it run the beta as well so you can test both halves of the equation simultaneously.

Kyle Kerst

System/Network Administrator

SmarterTools Inc.

(877) 357-6278

www.smartertools.com

Webio Replied

12/29/2022 at 12:27 AM

Ok. I'm totally confused since now I see it :-D. I was 100% sure that it is _REMOTESPAMD instead of _REMOTERSPAMD. Sorry for that.

Kyle Kerst Replied

12/29/2022 at 6:50 AM

Employee Post

No worries at all :-)

Kyle Kerst

System/Network Administrator

SmarterTools Inc.

(877) 357-6278

www.smartertools.com

Back to Community Threads

Please leave this box unchecked

14 Replies

Reply to Thread

Tags

Related Knowledge Base Articles