Filtering SPAM on server with postfix, dovecot, and sieve
Written by ⓘⓓⓔⓝⓣⓛⓤⓓ - -
Identify spams is one step to fight against them. The next step is to be able to move them around independently of the device you are using to view your inbox.
Filtering spams by configuring the email client is sometimes possible (and sometimes not) but it requires to implement filtering rules on every client. Be it evolution on your computer or some other email client on your smartphone.
The solution is to filter them on the server when they are locally dispatched to recipients by the local delivery agent. (LDA)
In my basic setup of my email server I had postfix that was used as a mail transfer agent (MTA) and LDA. It happens that sieve is a mail filtering solution that comes bundled with dovecot. The setup is then made to :
- use dovecot as a local delivery agent
- configure sieve to move spam emails to 'Junk' folder
Of course the pre-required step is that spamassassin has already been set up to identify what emails are spams and what emails are not.
Base configuration
- Debian Wheezy : 7.4
- postfix : 2.9.6
- dovecot with sieve embedded : 2.1.7
Use dovecot as LDA
Modify /etc/postfix/main.cf file to change mailbox_command to dovecot deliver
mailbox_command=/usr/lib/dovecot/deliver
Configure dovecot to enable sieve
The first step is to configure where sieve should be reading the rules configuration files. This is done by modifying /etc/dovecot/conf.d/90-sieve.conf and adapting sieve_default location. The result is that the behavior will be the same for all users for which a local mail delivery is made. If your MTA is configured to redirect emails to external mailboxes then the spams emails won't be moved to a junk folder.
sieve_default = /etc/dovecot/default.sieve
Enable dovecot user to read the file :
chgrp dovecot /etc/dovecot/conf.d/90-sieve.confNext step is to enable sieve plugin for LDA (local delivery agent) in /etc/dovecot/conf.d/15-lda.conf declare sieve as a plugin :
mail_plugins = sieve
Now how can sieve move spams to 'Junk' folders ? This is done by configuring the /etc/dovecot/default.sieve file with this content :
require ["fileinto"];
# Move spam to Junk
folderif header :contains "X-spam-flag" ["YES"] {
fileinto "Spam";
stop;
}
This file must be binary compiled by sieve compiler
cd /etc/dovecot
sievec default.sieve
A new file default.svbin is created and it must be readable by dovecot user
chgrp dovecot /etc/dovecot/default.svbin
There are some permission problems with /var/mail/<<user>> INBOX with dovecot on Debian. The email can be delivered directly to ~/Maildir with a configuration of /etc/dovecot/10-mail.conf.
#mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_location = maildir:~/Maildir
You can now restart dovecot and test a specially crafted spam email ;)
service dovecot restart
mail -s "Product for you" an-account-existing@your-server.tld
The following content was flagged as spam by spamassassin :
Online Drugstore can have your order of discounted Viagra shipped to you for only 5 minutes of your time!!!
http://www.justgottago.com/od/azzbc/
No Prior Prescriptions Needed
-Licensed U.S. Physicians are ready to fill your order
-Guaranteed Lowest Prices Available
-Discreet Mailing directly to your home or office
Just visit http://www.justgottago.com/od/azzbc/ and enjoy the good life today!!!
