This tutorial describes the steps to replace amavis (amavisd-new) spam scanning software with Rspamd on an ISPConfig 3.1 server. The tutorial is written for Debian and Ubuntu Linux.PrerequisitesRoot access.ISPConfig 3.1 must be installed. The ISPConfig version will be 3.1.15 or newer after this procedure.The server uses Debian 9 - 10 or Ubuntu 18.04 on an x86_64 processor (64Bit Linux). Older Debian and Ubuntu versions might work too, but I did not test them.All commands below are run as root user. Login as root user or use 'su -' on Debian or 'sudo -s' on Ubuntu to become root user before you continue with this guide.if(typeof ez_ad_units!='undefined')ez_ad_units.push([[728,90],'howtoforge_com-medrectangle-3','ezslot_8',121,'0','0']);__ez_fad_position('div-gpt-ad-howtoforge_com-medrectangle-3-0');Note: This procedure will reconfigure all mailboxes and aliases to write the Rspamd config for each account (similar to an ISPConfig Tools > resync run), this may take quite some time and resources on large mail servers.Install RedisThe Rspamd setup for ISPConfig requires Redis, so we will install it first.apt-get install redis-server lsb-releaseInstall Unbound if BIND is not installedIf your server has no local DNS server installed, then a local DNS resolver like unbound should be installed.First, check if BIND is installed by using this command:(adsbygoogle=window.adsbygoogle[]).push();which namedif the command returns the path to the named binary:[email protected]:/tmp# which named/usr/sbin/namedthen BIND is installed and you must skip this step. In case no path to named is returned, then install unbound:apt-get install unboundInstall and Configure RspamdThe first step to install Rspamd is to add the Rspamd Debian/Ubuntu package repository.CODENAME=`lsb_release -c -s` wget -O- -stable/gpg.key apt-key add - echo "deb [arch=amd64] -stable/ $CODENAME main" > /etc/apt/sources.list.d/rspamd.list echo "deb-src [arch=amd64] -stable/ $CODENAME main" >> /etc/apt/sources.list.d/rspamd.listUpdate the Package list:if(typeof ez_ad_units!='undefined')ez_ad_units.push([[728,90],'howtoforge_com-medrectangle-4','ezslot_3',108,'0','0']);__ez_fad_position('div-gpt-ad-howtoforge_com-medrectangle-4-0');apt-get updateAnd Install Rspamd with apt:apt-get install rspamdActivate Redis in Rspamd configuration.echo 'servers = "127.0.0.1";' > /etc/rspamd/local.d/redis.confIncrease the Rspamd history, enable compression and show the subject in the history. This step is optional.echo "nrows = 2500;" > /etc/rspamd/local.d/history_redis.conf echo "compress = true;" >> /etc/rspamd/local.d/history_redis.confecho "subject_privacy = false;" >> /etc/rspamd/local.d/history_redis.confThen restart Rspamd.systemctl restart rspamdUpdate ISPConfigISPConfig needs to be updated to enable the Rspamd configuration. When the ISPConfig updater asks you if it shall reconfigure services, choose 'yes'.cd /tmpwget -3-stable.tar.gztar xvfz ISPConfig-3-stable.tar.gzcd ispconfig3_install/installphp -q update.phpYou will see the line "Configuring Rspamd" in the output of the update script when Rspamd is detected and configured.Enable Rspamd in ISPConfigThe final step requires that you log into ISPConfig as 'admin' user.In ISPConfig navigate to System > Server Config > Mail.Advertisement.banner-1text-align:center;padding-top:10px!important;padding-bottom:10px!important;padding-left:0!important;padding-right:0!important;width:100%!important;box-sizing:border-box!important;background-color:#eee!important;outline:1px solid #dfdfdf;min-height:435px!importantif(typeof ez_ad_units!='undefined')ez_ad_units.push([[580,400],'howtoforge_com-banner-1','ezslot_2',111,'0','0']);__ez_fad_position('div-gpt-ad-howtoforge_com-banner-1-0');There you change the value of the field Content Filter from Amavisd to Rspamd and press the save button at the bottom of the page. ISPConfig will start to reconfigure all mailboxes for Rspamd now.When you go back to System > Server Config > Mail, then you can see some new fields where you can read and set the Rspamd password.Make Rspamd Dashboard accessible from outsideThe Rspamd dashboard is on port 11334 on localhost, so it can not be accessed from outside. In this chapter, we will create a website in ISPConfig and add a proxy configuration. The configuration differs between Apache and Nginx web server, use the chapter which matches your installed web server software.ApacheEnable the Proxy Module and restart apache.a2enmod proxysystemctl restart apache2Then log into ISPconfig and create a website which will get used to access the Rspamd GUI. You are free to choose the domain name, I will use rspamd.example.com here. You don't have to enable any programming language or other options in that site, just leave everything at the defaults. Enabling SSL and Let's encrypt is highly recommended though.Go to the Options tab of the website and enter the following configuration into the Apache Directives field. For Apache 2.2, use: Order allow,deny Allow from all RewriteEngine On RewriteRule ^/rspamd$ /rspamd/ [R,L] RewriteRule ^/rspamd/(.*) :11334/$1 [P]For Apache 2.4, use this instead: Require all granted RewriteEngine On RewriteRule ^/rspamd$ /rspamd/ [R,L] RewriteRule ^/rspamd/(.*) :11334/$1 [P]Now you can access the Rspamd GUI with a web browser . You will get asked for a password, use the password that you generated during Rspamd installation.NginxLog into ISPconfig and create a website which will get used for accessing the Rspamd GUI. You are free to choose the domain name, I will use rspamd.example.com here. You don't have to enable any programming language or other options in that site, just leave everything at the defaults. Enabling SSL and Let's encrypt is highly recommended though.Go to the Options tab of the website and enter the following configuration into the Nginx Directives field.location / root /usr/share/rspamd/www/; try_files $uri @proxy;location @proxy proxy_pass :11334; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host;Now you can access the Rspamd GUI with a web browser . You will get asked for a password, use the password that you have set for Rspamd in ISPConfig.Rspamd GUINow you can access the Rspamd GUI with a browser and get detailed statistics about the spam filter rate and throughput.ISPConfig has been reconfigured to use Rspamd instead of Amavis to scan for spam emails. Rspamd is also used for Dkim Signing.Disable AmavisFinally, we stop and disable amavisd service:systemctl stop amavisd-newsystemctl disable amavisd-newConclusionRspamd is a modern high-performance spam scan software for Linux servers which delivers very accurate filter results. ISPConfig supports Rspamd as spam scan unit since version 3.1.15. This tutorial shows how to replace amavisd.new with Rspamd on an ISPConfig 3.1 server. About Till BrehmOver 20 years of experience as a software developer and Linux system administrator. Till Brehm is the founder and lead developer of the ISPConfig hosting control panel software (since 2000) and he founded HowtoForge in 2005 as a place to share Linux knowledge with other Linux enthusiasts. view as pdf printShare this page:Suggested articles74 Comment(s)Add commentName *Email *tinymce.init(selector:"textarea#commentedit",theme:"modern",height:100,apply_source_formatting:true,remove_linebreaks:false,menubar:false,plugins:["link"],content_css:" ",toolbar:"undo redo );CommentsBy: felan Reply Hmm. How would I go about getting the webinterface up on a multiserver setup, that does not have web enabled on the mail server?By: till Reply Put the Rspamd website on the master or on another web server node of your setup and use the IP of the mail server in the proxy snippet that goes into the apache or nginx directives field instead of 127.0.0.1. On the mail server, edit the rspamd config like this:nano /etc/rspamd/local.d/worker-controller.inc# change or add line: bind_socket = ":11334"; secure_ip = "";and replace the two IP placeholders with the correct IP addresses. Finally, restart Rspamd to apply the changes.By: felan Reply Excellent works perfectly!By: Mccyberix Reply Hello, I have a 3 node multiserver runing and have successfully switched to rspamd, but my problem is that I'm not able to ad more servers to the GUI. When I add the above lines I get a Serever Error: 503. I have also tried to add the neighbors list to the options.inc as described here but then it says: "cannot get server status, request failed". My cluster is on a public network not private! So does anyone have a clue how the implementation of other nodes to the rspamd-gui should be done?Thanks in advance!MccyberixBy: 30uke Reply This looks great! I will try this as soon as possible (probably this weekend or somehwere next week). Thanks for the tutorial. Very much appreciated :-)By: 3K Reply Thanks alot for this!By: Chriz! Reply worked like a charm! Thanks!By: Björn Hahnefeld Reply Can this snippet also taken with existing domain: --Order allow,denyAllow from allRewriteEngine OnRewriteRule ^/rspamd$ /rspamd/ [R,L]RewriteRule ^/rspamd/(.*) :11334/$1 [P]-- For example :8080 ? By: till Reply > Can this snippet also taken with existing domain yes > For example :8080 That's not a website of an existing domain, it's the ispconfig vhost on port 8080. You can modify the ispconfig vhost by using this snippet, but this requires some more work and you have to create a custom config template etc.By: Björn Reply This host I added in ISPConfig. So it is existing as web.By: Steini86 Reply For Apache2.4 you should use Require all granted I use it for my mail.domain.org where the roundcube is located. Running nice. Thanks!By: [email protected] Reply I put directive in website->options in ispconfig. But I get this:--
Replacing amavisd with Rspamd in ISPConfig 3.1 on Debian and Ubuntu
2ff7e9595c
Comments