==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.0
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version: CentOS 7 (within docker container lejmr/iredmail)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hello guys,
I have been receiving a high number of spam emails. Looking into logs, I can see post-screen fighting with plenty of malicious emails, but I am afraid that post-screen is actually working in iRedMail installation because when a spam email passes post-screen the spam never gets bounced by amavis (utilizing SpamAssasin), so I wonder whether iRedMail delivers working configuration for such a case.. I dit a few configuration changess in order to fight with spams, but nothing really helped. I followed this document: https://docs.iredmail.org/store.spamass … .sql.html.
I have no problem to rollback any of mu changes if that helps to debug the problem.. I am going to document my observations through a sequence of log outputs where I anonymized my personal account by myaccount@example.com. The example is an email that I received in the middle of the night (subsequently, that night I received about 15 similar emails which drove me to write this post).
Postfix log looks like this:
Feb 14 00:30:22 mail postfix/10025/smtpd[5270]: 48JZ666HGJzcfDZ: client=localhost[127.0.0.1]
Feb 14 00:30:22 mail postfix/cleanup[5252]: 48JZ666HGJzcfDZ: message-id=<O1Gy_ThYJTAxcvrfTSF2LH_z8yF0mwAOHKr3FyFYVfY.-0yf93J8lnaGsJz8GKT3PM_KKRNGt8e0404nR0Puigs@politetread.icu>
Feb 14 00:30:22 mail postfix/10025/smtpd[5270]: disconnect from localhost[127.0.0.1]
Feb 14 00:30:22 mail postfix/qmgr[27533]: 48JZ666HGJzcfDZ: from=<approved@politetread.icu>, size=10431, nrcpt=1 (queue active)
Feb 14 00:30:22 mail amavis[24570]: (24570-17) Passed CLEAN {RelayedInbound}, [213.142.151.250]:49496 [213.142.151.250] ESMTP/ESMTP <approved@politetread.icu> -> <myaccount@example.com>, (ESMTP://[213.142.151.250]:49496), Queue-ID: 48JZ635KZ2zcf4R, Message-ID: <O1Gy_ThYJTAxcvrfTSF2LH_z8yF0mwAOHKr3FyFYVfY.-0yf93J8lnaGsJz8GKT3PM_KKRNGt8e0404nR0Puigs@politetread.icu>, mail_id: md4_25w3sVG6, b: wIXj2hZBN, Hits: 1.184, size: 9758, queued_as: 48JZ666HGJzcfDZ, Subject: "Highly Effective Anti-Pollution Clean Air Breathing Mask ---------------------", From: <approved@politetread.icu> (dkim:AUTHOR), helo=politetread.icu, Tests: [DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,HTML_MESSAGE=0.001,RDNS_NONE=1.274,SPF_HELO_PASS=-0.001,SPF_PASS=-0.001,T_REMOTE_IMAGE=0.01,URIBL_BLOCKED=0.001], autolearn=no autolearn_force=no, autolearnscore=1.185, dkim_i=approved@politetread.icu,approved@politetread.icu, dkim_sd=mail:politetread.icu, 1166 ms
Feb 14 00:30:22 mail amavis[24570]: (24570-17) Passed CLEAN, <approved@politetread.icu> -> <myaccount@example.com>, Hits: 1.184, tag=2, tag2=6.2, kill=6.9, queued_as: 48JZ666HGJzcfDZ, L/0/0/0
Feb 14 00:30:22 mail postfix/amavis/smtp[5262]: 48JZ635KZ2zcf4R: to=<myaccount@example.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=3.2, delays=2/0/0.01/1.2, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 48JZ666HGJzcfDZ)
Feb 14 00:30:22 mail postfix/qmgr[27533]: 48JZ635KZ2zcf4R: removed
Feb 14 00:30:22 mail postfix/pipe[5271]: 48JZ666HGJzcfDZ: to=<myaccount@example.com>, relay=dovecot, delay=0.05, delays=0.01/0/0/0.04, dsn=2.0.0, status=sent (delivered via dovecot service)
Feb 14 00:30:22 mail postfix/qmgr[27533]: 48JZ666HGJzcfDZ: removed
Here in I was very surprised about the amavis status
Feb 14 00:30:22 mail amavis[24570]: (24570-17) Passed CLEAN {RelayedInbound}, [213.142.151.250]:49496 [213.142.151.250] ESMTP/ESMTP <approved@politetread.icu> -> <myaccount@example.com>, (ESMTP://[213.142.151.250]:49496), Queue-ID: 48JZ635KZ2zcf4R, Message-ID: <O1Gy_ThYJTAxcvrfTSF2LH_z8yF0mwAOHKr3FyFYVfY.-0yf93J8lnaGsJz8GKT3PM_KKRNGt8e0404nR0Puigs@politetread.icu>, mail_id: md4_25w3sVG6, b: wIXj2hZBN, Hits: 1.184, size: 9758, queued_as: 48JZ666HGJzcfDZ, Subject: "Highly Effective Anti-Pollution Clean Air Breathing Mask ---------------------", From: <approved@politetread.icu> (dkim:AUTHOR), helo=politetread.icu, Tests: [DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1,HTML_MESSAGE=0.001,RDNS_NONE=1.274,SPF_HELO_PASS=-0.001,SPF_PASS=-0.001,T_REMOTE_IMAGE=0.01,URIBL_BLOCKED=0.001], autolearn=no autolearn_force=no, autolearnscore=1.185, dkim_i=approved@politetread.icu,approved@politetread.icu, dkim_sd=mail:politetread.icu, 1166 ms
Similarly, the email's header is as follows
Return-Path: <approved@politetread.icu>
Delivered-To: myaccount@example.com
Received: from mail.example.com (localhost [127.0.0.1])
by mail.example.com (Postfix) with ESMTP id 48JZ666HGJzcfDZ
for <myaccount@example.com>; Fri, 14 Feb 2020 00:30:22 +0000 (UTC)
X-Virus-Scanned: amavisd-new at mail.example.com
Authentication-Results: mail.example.com (amavisd-new); dkim=pass (1024-bit key)
header.d=politetread.icu; domainkeys=pass (1024-bit key)
header.from=approved@politetread.icu header.d=politetread.icu
Received: from mail.example.com ([127.0.0.1])
by mail.example.com (mail.example.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id md4_25w3sVG6 for <myaccount@example.com>;
Fri, 14 Feb 2020 00:30:21 +0000 (UTC)
Received: from politetread.icu (unknown [213.142.151.250])
by mail.example.com (Postfix) with ESMTP id 48JZ635KZ2zcf4R
for <myaccount_cachalladdress@example.com>; Fri, 14 Feb 2020 00:30:19 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mail; d=politetread.icu;
h=From:Date:MIME-Version:Subject:To:Message-ID:Content-Type; i=approved@politetread.icu;
bh=jcizARpmzzh/vXmLQkN1LOjOcWA=;
b=jRkprF5zlGshhHb2QtWX8QFl8QmVuVvjkOGkPvzvhaxi7eXLkULQ6Q4Vc9lr9LcM86dFQwknQ7F9
2CogiIYXpgppAUk5GY1fT7fpQ69QmYdyMp2IYOwG5uuAIrEPLIXTMgi2o0il4FOh/Kw4D3ZwjCqC
x+F6yoJ6V7+9SjuPjL8=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mail; d=politetread.icu;
b=iQMkpAfUgF4nuX/QoAPf7zJdDkNQU1PNgsWt+uu6hulAnI16CIXRjV7PlbXKtL4BS012fPNFTMgJ
7ETqC1Kjvh8S0CB2sOXxZ32sfOgg+tkQTc5QmnPGE7pD5H5gdNI14ajG5jz4dBpXGwlcBWuTzgv+
hurl8muRYu+Kw/2s8iw=;
From: "Travel Mask" <approved@politetread.icu>
Date: Thu, 13 Feb 2020 19:24:51 -0500
MIME-Version: 1.0
Subject: Highly Effective Anti-Pollution Clean Air Breathing Mask ---------------------
Here an interesting thing is that the spam was delivered to an alias of my account, as I am using my personal account as a catch-all account too. Don't know if that is related, but might be related?
Based on the score I am seeing in logs it makes sense the email was delivered to my account, but when I scrutinized the actual email in Maildir directory using SpamAssasin I received a very disturbing output:
--------------921627366770447008480132--
Spam detection software, running on the system "mail.example.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Filter fine pollution particles with the most stylish clean
breathing mask available No longer be at the mercy of climate change and
ensure your future by protecting yourself with OxyBreath Pro <http://www.politetread.icu/uselbgkcx/qffjra110707csgl/ruO02Bt7hroUggk2KTy6c8E7FAyoVtK4h7UBzctCztY/XJLvj-QSuvjTaWv2iMQ2f7Bg1dqivhzYg-waAsKdUMxs6gTpVeXnUH8xlCHk9RCiRXMhqCjsnXVTk3r7Etb0YTm-85O_duwZE1JBYJCp2nC3tI67ONvV5K78uYXtjZJedObvEAG7at9dM6ylSdJZVsKW7TZWQnWaB-wVm9y-GWA>
[...]
Content analysis details: (12.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: politetread.icu]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL
blocklist
[URIs: politetread.icu]
3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
[213.142.151.250 listed in zen.spamhaus.org]
2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL
[213.142.151.250 listed in psbl.surriel.com]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
2.3 DKIMWL_BL DKIMwl.org - Blacklisted sender
0.0 T_REMOTE_IMAGE Message contains an external image
Based on the score I would expect never receive such an email! As mentioned in the beggining of my email, I enabled bayes filtering. Additionally, this example spam email is very similar to one of spam emails I received in the pass and which let let sa-learn to index.